{ "Event": { "published": true, "date": "2021-04-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-01", "timestamp": 1617321782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b22a0876-93e4-4da5-8e82-0d3d16861014", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d030d445-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617290438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290438, "uuid": "70f63931-fa62-45a3-9d05-2c81f5973a14", "comment": "Malware payload (IcedID)", "value": "c08dbea97f29e19358278f6edcaab82c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290438, "uuid": "00c324b4-2921-4041-a817-7ec74e372e66", "comment": "Malware payload (IcedID)", "value": "0006077b6d426d9e77dd90f1ac1d8792b33c861514792803d573aaf0ecae6eed", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290438, "uuid": "b186c676-bfcd-44f4-b62a-010560549cd0", "comment": "Malware payload (IcedID)", "value": "eb828b49bb952b1a99823129e42e2ed165df0a9a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290438, "uuid": "25bcd3ee-31ec-4a76-92ca-8e2a2ac92fc2", "comment": "Malware payload (IcedID)", "value": "a5b1f87a72dec884be69b911f1575e3a3b3f39c8c747208b6f30fc197345efd21ebe5e5d77100a7ca5cca638841a6c7a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290438, "uuid": "7b1199d9-7836-44f4-826b-3a0dcb4e5e9c", "value": "89838CCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290438, "uuid": "f850168a-8caa-4b17-9c36-dc80edb56a4b", "value": "1536:IB240XZfcaaxf+EQliU2hawqCAIoo8+BNvMhfvyR:+2d1cBWEQXMq9o8+nEhH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290438, "uuid": "9e35361f-a533-4a82-94bd-65adf518f87d", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290438, "uuid": "24f29388-0820-44cc-baf3-a036c41b420c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290438, "uuid": "55ce55d3-a180-4403-93a8-196d9bc190f8", "value": "3046.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769c5455-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276973, "uuid": "bb6f98d5-cd4e-4046-a5c7-2ff46778a5db", "comment": "Malware payload (IcedID)", "value": "38bb8838b8341fcaef220ea53e1f3c71", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276973, "uuid": "b1b64a54-3e40-4bf3-9d76-79267a581441", "comment": "Malware payload (IcedID)", "value": "001920a0d353395285be5e801e9539430557f14836ada8693959a9499fe74671", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276973, "uuid": "5574db5a-1760-46d8-92e5-6d786c4779c9", "comment": "Malware payload (IcedID)", "value": "17c1b8a6f0f8cac1b1db32bca48e6b44523c25a8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276973, "uuid": "194a75bf-544b-4f4e-a3c0-1243016473d5", "comment": "Malware payload (IcedID)", "value": "dcbb5466d1adbbe33d69ea17c8636d9fef13c8a4fa48fdfe38248ddc59b67b52b2420ad421986f1cb198bb81fe6b2891", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276973, "uuid": "7e7778e9-3e36-4fb4-9c66-18a8030af45b", "value": "DC044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276973, "uuid": "1b9d8b17-a7e9-4ae5-bc2b-9e36c665ab7e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276973, "uuid": "46e863f4-8c8a-4c34-b366-1663b2b5565c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276973, "uuid": "fbaedd28-ad68-46be-b23d-b23ca9342dac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276973, "uuid": "fb4f5c82-1e98-408e-83e3-1db941d69729", "value": "document-596330097.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0f616d-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276610, "uuid": "dfec9513-0af4-4596-830e-383dba0ce043", "comment": "Malware payload (IcedID)", "value": "c4ea313b3f14ecf849b26537df67fa53", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276610, "uuid": "db28ac6c-a14e-4824-8905-3221bd4012f0", "comment": "Malware payload (IcedID)", "value": "001be5ef9fd1a5d6c16e55bafaeff1476c97c6039494cb067358e61fdb03b5b9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276610, "uuid": "fa3f9ff5-6964-4ece-969a-788b61be8ae3", "comment": "Malware payload (IcedID)", "value": "da0e575834aa157b6d3e3a7f9ead3e937a0ae061", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276610, "uuid": "c584caf1-572b-49bd-af72-3659e1ce44a7", "comment": "Malware payload (IcedID)", "value": "14b68cb4c647358c617ee0d7927162e422b9fc5c658b8d6796bb3fe30f7b9130bf52d119e7f3b449b2e12bc17c6032ea", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276610, "uuid": "97fa1d5a-599a-49b7-99b6-1d65335c21ae", "value": "A7044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276610, "uuid": "569e3787-c06d-4e2d-9400-92d106048ea1", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276610, "uuid": "db44d539-3b67-4f2e-aad2-c504916d20bf", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276610, "uuid": "8109cbd6-ec00-4e61-a452-3061a75ec3ba", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276610, "uuid": "3641f76c-f6ed-4635-95a3-c9f83ab8b427", "value": "document-1423404906.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ab7dd5-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279874, "uuid": "b8ca5b02-50a4-4184-a809-ff1c8804b79b", "comment": "Malware payload (IcedID)", "value": "b058594669b275d186207929b4b32eeb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279874, "uuid": "60390f70-abcf-4c75-99a3-dee13846cc98", "comment": "Malware payload (IcedID)", "value": "00a55a2ef2774d581e152e154a34e07fb231a4d5f0fc17a3cb1726fa02843243", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279874, "uuid": "12d0fd19-e5d6-40f2-868d-f1003366e022", "comment": "Malware payload (IcedID)", "value": "f48e30b9e13cec95978232da40f1d2c279e91191", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279874, "uuid": "cfa454b5-5152-40c7-84ae-c25eab7d8019", "comment": "Malware payload (IcedID)", "value": "677eca27838b77e834d9bf0a40fb96594b7f75a80cf0e2d8e3599e17dd640616d2d37faeee584475af8b2f06ffb838e1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279874, "uuid": "4127dd8c-5146-428c-acb1-0152938d83c2", "value": "3B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279874, "uuid": "cb545404-7891-4931-a6d9-464ea542ef52", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279874, "uuid": "09da79b8-43b0-4323-ba29-aee7388b913a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279874, "uuid": "5ee8b6f4-907c-45e3-a4a5-a589af9f657e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279874, "uuid": "828c7652-2baf-4740-821f-94df6424fdfd", "value": "document-1771131239.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02476105-9313-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617299541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299541, "uuid": "bb5c3dfe-6553-4624-8f5c-66705c815f31", "comment": "Malware payload (IcedID)", "value": "90770735424d89f85b8c9a70e2369fb9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299541, "uuid": "d3db5b01-ae2e-415f-8889-ddd19baf32da", "comment": "Malware payload (IcedID)", "value": "00a597c6a26c76a0f2d63379d6b2cca2391dd9f09651b8d711e560e269731e81", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299541, "uuid": "9973f990-22d5-4c58-9d9a-42d1cfad706c", "comment": "Malware payload (IcedID)", "value": "b4839990d12e2953199c33d339a4ed847edca022", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299541, "uuid": "e5096732-66c0-4a02-88c6-39defcf1d39d", "comment": "Malware payload (IcedID)", "value": "866f8d9bca06f7fa0fef0c5674c345e7bd2bbde125ce070e3ac9c34aeb4769230aba96e26654dbc5b98bad31c192033c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299541, "uuid": "edf338c6-376a-4175-b7ae-a31d3d632ec3", "value": "0B44C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299541, "uuid": "ada26982-ee9c-4ec8-8756-a7e0b452a833", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299541, "uuid": "46226c52-7e34-4d7f-a7c8-c95664286790", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617299541, "uuid": "39d47b87-062d-470c-b15d-0f5f6a00ff35", "value": 276602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617299541, "uuid": "4e210847-ba28-4261-82b8-c6169902b005", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299541, "uuid": "fdad4677-9650-4082-87c6-dcd29ee0e070", "value": "90770735424d89f85b8c9a70e2369fb9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b17f4e-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275903, "uuid": "c9829616-2d75-46b8-98d9-0291a0cca4ae", "comment": "Malware payload (IcedID)", "value": "d3119874b8d64d6b71299d801bab9b44", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275903, "uuid": "f05231f4-6ed6-450e-ada9-05795a148f02", "comment": "Malware payload (IcedID)", "value": "00c0e38949284364dfd5e72b326bafbb9289abe5d01e44a4cc3ef661d5d22cd0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275903, "uuid": "30e54dcf-496d-4058-8e1e-e47451702537", "comment": "Malware payload (IcedID)", "value": "c3a2919b0b0e23d876c873adfe052e334d9d9be4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275903, "uuid": "b0f8d4ab-7ab1-4b21-850b-34b779809329", "comment": "Malware payload (IcedID)", "value": "d789d71c4dd1245dd60603759bf068045f948992fd2179e8a45904c41759c8e77199014303a20dae64faa907cdb3b24d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275903, "uuid": "392423be-86cc-4635-aacf-8282a5baaa91", "value": "F8044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275903, "uuid": "897e1033-8b35-4517-a2c9-f9db2e564e28", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275903, "uuid": "15ce1126-b66b-43ab-bb6d-85c5b0fa8b53", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275903, "uuid": "6bc63202-53a1-40d7-81a6-ba9711d5f16c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275903, "uuid": "c030a484-6fd9-4f00-a772-4f74522e6023", "value": "document-1347505939.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42987c57-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279892, "uuid": "ba791eaf-b6fb-4d31-af6d-62b73fda3fad", "comment": "Malware payload (IcedID)", "value": "0be5dbe4f3f28de0df8a9cfeeb621963", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279892, "uuid": "416b503d-93ca-488a-9cad-e00daf196199", "comment": "Malware payload (IcedID)", "value": "00f45994ce70ae4c2d95c56452742f7b8834416cd4bf9eaa523d127e13b9cbc4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279892, "uuid": "c333a8f8-dea1-4c6f-b735-17a5f3912200", "comment": "Malware payload (IcedID)", "value": "700c483a1edac31299d30edb2f4367406ed70d7e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279892, "uuid": "1df79b99-b29c-4ed1-9465-90d6777eb920", "comment": "Malware payload (IcedID)", "value": "0716ef08d243de02d4701bc12f5513852c9100ec770f585d157be94236d0876db6c8b224beaec17f975e85124fe3a1e0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279892, "uuid": "a47701ef-6390-4af4-a68a-aa3de5d83ae2", "value": "60044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279892, "uuid": "803625cf-bda3-429c-9331-85ceac369124", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279892, "uuid": "966a4d50-bea7-4e97-ba92-17f914f99a08", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279892, "uuid": "6ab1e3e9-1b32-4f0c-bf28-1d2658c0280f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279892, "uuid": "a9b7edc1-9af9-4b46-85e5-0733af53ae02", "value": "document-12162673.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f056a2e-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279940, "uuid": "fd61ddcf-e1a7-4ba2-9871-ff0965c44b73", "comment": "Malware payload (IcedID)", "value": "709e81832f0b26ced5b7fff8ba3f7352", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279940, "uuid": "c9f5c7e9-f9dc-47d5-b5dc-23988df586f1", "comment": "Malware payload (IcedID)", "value": "00fbdcf2bded7128289841324edbc824302d9e7b07a4d6aa0efcfbbb1588cbc8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279940, "uuid": "05661d01-74db-4f45-89ad-0cf2bb573a77", "comment": "Malware payload (IcedID)", "value": "85d2484533dfa35ceeabc3bcba81100bed63230b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279940, "uuid": "ab1f6c9a-1104-4366-8562-738f415c2a28", "comment": "Malware payload (IcedID)", "value": "fbcca18ab32af4fdef4913127cbc3e4d716450da6aaaf62db3c6fc79b3c5bfb3509229dfc7277fd71d0ce4d8d84eb36b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279940, "uuid": "e2ec4195-792b-405b-ba3b-f09ed3e9cef9", "value": "4B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279940, "uuid": "f17536eb-ff08-4405-b041-eaea965fb743", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279940, "uuid": "8ac8590c-ad90-4553-8115-95a8891eee4b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279940, "uuid": "14224b1e-c122-4c89-9358-cac95ff5a768", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279940, "uuid": "1b98fe05-d573-46e9-83c8-b42afcaaf64b", "value": "document-779106205.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b4cb07-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279032, "uuid": "9e50e1f4-01c6-4845-b51b-22d775821a98", "comment": "Malware payload (IcedID)", "value": "cf0d0ae1dd2466f6e8aaee17566eab34", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279032, "uuid": "933a57b8-77a9-4054-985c-0b94b3ce017d", "comment": "Malware payload (IcedID)", "value": "00fd13471ffedab270e7c4f856ae3da60ad4f107d0b6bfce662d80b125d189a5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279032, "uuid": "f97f6a97-a6b4-4558-a54a-76c107b77377", "comment": "Malware payload (IcedID)", "value": "a0773e4b4e94ddd5c9cf84e1714f3776701d4674", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279032, "uuid": "920616b7-7ff8-4263-a531-92233e157099", "comment": "Malware payload (IcedID)", "value": "d12499f353235bc403b67b6eeab548f026406388f8b4e48a813b6d2e2b0d29df6abf1535dc2c98777a2ce474625972c9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279032, "uuid": "b154dba0-0e68-401e-8b60-62141ff7c0eb", "value": "F6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279032, "uuid": "bda990b4-4ffb-4ce9-a745-01c1ceb6cfe3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279032, "uuid": "d53af7ba-2d6d-477c-8226-a559e972db27", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279032, "uuid": "76960cb1-5217-46aa-8b5e-da00b385369f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279032, "uuid": "c89beb49-407e-450b-8453-2cc49d9ee344", "value": "document-1942808943.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1b9d45-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280927, "uuid": "9d6191b1-73fb-4513-845d-512bd2a24b84", "comment": "Malware payload (IcedID)", "value": "aac0b62e391e8da7d0b188c8906391d2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280927, "uuid": "cad76aec-2a0a-44ea-b742-11763eb829e1", "comment": "Malware payload (IcedID)", "value": "011223b7f961e213c36cc6b03c77f3bf802cd7d24dcc471cfb269ca80f0f75f5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280927, "uuid": "f9a21768-86f7-4132-bd3f-339a501e7846", "comment": "Malware payload (IcedID)", "value": "63c92b6099398f9d988b021e09d6cd662a154761", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280927, "uuid": "e3434ee4-f74c-4326-9afd-b4a025cbc232", "comment": "Malware payload (IcedID)", "value": "533775a3afeca4a79467b655f3742cf4a4005f59aaa33b2a5491c967b9c8c7706e160b462a608949b86304c592bea8ed", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280927, "uuid": "97af44bc-e3a1-4644-970e-43b9aabedaeb", "value": "0F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280927, "uuid": "58b50f6f-39b7-4a70-9983-00c53ea7a50f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280927, "uuid": "a1b14bf7-52d3-488a-83c3-d276b09192b6", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280927, "uuid": "8667fc03-e3e0-464c-b064-2078e6e0b0e4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280927, "uuid": "50ca073f-1f2e-49ed-b622-b343697a98c1", "value": "document-2111352180.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988dfd64-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280895, "uuid": "8033f719-f8b8-417a-8759-ff3cf391bc31", "comment": "Malware payload (IcedID)", "value": "cb231f06e8cc67c014e437275a903294", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280895, "uuid": "3a0a4607-1ee4-4c53-8284-a9e9846d77dd", "comment": "Malware payload (IcedID)", "value": "011edd37b1166ba836fcecb03ffd390e5cb2d47487cdfb98ec603f17ea07887e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280895, "uuid": "9b979105-58f0-46f8-90d5-b5820d320295", "comment": "Malware payload (IcedID)", "value": "6f461e65f7cf04ec1b199740c60597001b840766", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280895, "uuid": "84aa9fa8-40b4-41ec-8689-2920beb31ec4", "comment": "Malware payload (IcedID)", "value": "3366c82e636958ab1e1d3d16785a91d14b8077f6d0145187c715471397a0aa2fee8ef23e2e69678abb4c8f1eb65510bc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280895, "uuid": "a9adfd3a-e17f-4ac1-b61f-be6b3220f2b7", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280895, "uuid": "0b6848b4-16e7-40c0-8766-6a72494b6a36", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280895, "uuid": "fcfe1fa7-83c8-4d7e-817d-a2b95a9f49f5", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280895, "uuid": "8f04391e-9864-4888-9735-5c750f695512", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280895, "uuid": "d09ded81-1b48-4ad7-854c-34c1451d7bd9", "value": "document-1061603179.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3eb8f16-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617262151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262151, "uuid": "e0dcfbc3-3ada-472d-90e6-e1636a2f11d2", "comment": "Malware payload (Formbook)", "value": "816b095246841f9a316b367325716bc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262151, "uuid": "6c3547b2-d2b8-42a6-838a-c31734774248", "comment": "Malware payload (Formbook)", "value": "01476f904e668758ea516e84f359d6d0a4d85dadc179a51788a214ea46ff9dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262151, "uuid": "b4e1d8db-8d1b-4c0d-ac57-e5fbd61f1e56", "comment": "Malware payload (Formbook)", "value": "895d3aea9da0d55d069e6f78779cd8aa1a58c9ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262151, "uuid": "5752ed13-ae49-46a5-b979-662449a2af06", "comment": "Malware payload (Formbook)", "value": "bad32a288fe71a7225bcb7872d97dc7a47cf2ddce11e2845a1e09730e5aa3c856bf804f39f5d6c812a8602ecda620ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262151, "uuid": "3540e442-8353-4151-9966-16c9d5d80c6f", "value": "73848C81E35088CBDC290671487BAF391843BD7D6870651E6EAD3E7F3E73392146E929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262151, "uuid": "d4a640a3-90de-4ecf-96d3-3f46810cb962", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262151, "uuid": "a02c4a7d-bcff-434e-bac8-ed57e2bfc681", "value": "6144:C9X0Gn0GtJEJwJ5LgpCG7LyfhlZHtjrlxfjrN9wsJ:E0zLANnTfHNOsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262151, "uuid": "bad36362-68ae-4662-a629-3b69d2e67ec9", "value": 372730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262151, "uuid": "567463eb-80f0-4040-a2d5-315802a84c75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262151, "uuid": "50194011-1d53-4abe-b493-42ace1988076", "value": "PaymentInvoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d589bb-92e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617281210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281210, "uuid": "3f65181f-0c56-4a9a-b201-4af454976294", "comment": "Malware payload (Dridex)", "value": "8596762248607990c142c3c908748e72", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281210, "uuid": "c8fe707c-542c-443e-82ba-255f591d66bd", "comment": "Malware payload (Dridex)", "value": "01c41f45fb8a0dc50d925b7cfe4abdace27a535afe0f6b0d0f6bde1f9d79e336", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281210, "uuid": "74614bf6-3f8c-4f99-92d1-0c2a3036a5a6", "comment": "Malware payload (Dridex)", "value": "c3d9d8b793e623e229a6ae52628b57a277080d64", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281210, "uuid": "75020fa6-8ea0-43b1-a174-fe1135759a92", "comment": "Malware payload (Dridex)", "value": "84e45d14917ec5a63fd055413c756145d2a00fe0ec624403cd00f588182923c20fbb26d91ca00a213906061aa31eefc4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281210, "uuid": "8413d875-08d5-408a-bf74-4465e694513a", "value": "8F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281210, "uuid": "bbdac24c-59d7-4dbf-b71e-529d827ef40e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281210, "uuid": "1b5a7c21-4269-47a1-92a8-6a43713cade9", "value": "3072:Popj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:gpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281210, "uuid": "6dbb85f5-50a4-46e4-a01f-c22d13d86d87", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281210, "uuid": "d70c9644-783d-4211-b376-54b9bd35153c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281210, "uuid": "8ad355f9-3e52-42d5-a34f-b85775a3bae5", "value": "01c41f45fb8a0dc50d925b7cfe4abdace27a535afe0f6b0d0f6bde1f9d79e336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320d374a-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617283300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283300, "uuid": "287bdbb4-2b08-459f-ab96-c76c941217d8", "comment": "Malware payload", "value": "79f5e0161338f4b4010ad3ba6961b79e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283300, "uuid": "2c7244b6-1f94-4c71-aed7-ab1096151fb5", "comment": "Malware payload", "value": "026dd9e563f023bddd5ba89ff6a28f220b3f4ae5ab47e1b9365888badde3a58f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283300, "uuid": "2c387c7a-a644-46ee-81a2-f2278c05bbce", "comment": "Malware payload", "value": "6e4cbe81263714ccd779e98fa10394c303258ac1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283300, "uuid": "1abaddf4-7fe3-4115-b6d7-c37bed767383", "comment": "Malware payload", "value": "4f89982bc44a2834d29edf9341b712236d3a65f8d4f503881cf804b49013894200eaa7f84cdafb7b91e7b48dd733b4a9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283300, "uuid": "d93df6dd-ae69-4001-aa76-4ee6845c51c1", "value": "93559EA87600758ECA5FCE36C5641C20EA70A5769707E387604B65E8AA4E3D7EF341F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283300, "uuid": "10a23209-1cf6-49b7-97a9-16f3e373f21b", "value": "12288:wCxhLbhaZ9/gL8aZcehPWBp5KzitBngzm14cd00FhFjGraWUKYNVVo:wIZbZImrMHtBf9dlFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283300, "uuid": "777372ef-60c7-4728-be44-8deaff7c1680", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283300, "uuid": "d2cb5adf-8516-44c7-8994-11ab0203da4d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283300, "uuid": "fc108947-da4c-4c08-aad6-fe878fffaede", "value": "dbs.payment.slip.pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4585b00a-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292353, "uuid": "1f8e6c2a-9a25-40da-a95a-3a38dd7cfef1", "comment": "Malware payload (IcedID)", "value": "fc949497c9f312fdafc8510a88024346", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292353, "uuid": "51bcf5c8-b5fa-4c44-9e45-b3319c266752", "comment": "Malware payload (IcedID)", "value": "027942a862ce3ca265d42e3e2f87742652b4cafe909eef6b9e2cb8f4032518bc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292353, "uuid": "6eb8d341-a4ca-4713-8317-055c9e65e4f2", "comment": "Malware payload (IcedID)", "value": "e3de4a9e7d3fdb6d9d87e82c4fef2f244ac9c74b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292353, "uuid": "4fe7c2db-eef9-4c2a-8c3e-2e9c3306c9af", "comment": "Malware payload (IcedID)", "value": "28440dea53fb92a21e1875f079167fff58d37c5d740d2c7987c8adb907b794dcdc2abb9372c0185869b54cd926cae5c0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292353, "uuid": "1a6a6d29-034d-44fb-a403-821bb622fa63", "value": "1A838DCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EA62E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292353, "uuid": "81a5e6a8-c5aa-47b3-9044-38c2d9fab94b", "value": "1536:IB240XZfcaaxf+EQliU2hawVCAIoo8+BNvMhfv7d:+2d1cBWEQXMV9o8+nEhHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292353, "uuid": "ce29fc23-ba51-4953-b1ca-f80f4e7cd5b4", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292353, "uuid": "df7eaeae-a712-473d-8c52-7986088abad8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292353, "uuid": "4fd3c511-d003-4b51-9260-3376423c5210", "value": "3166.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2859ed85-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278989, "uuid": "34dd9008-8a10-4902-be01-2499c8ebd253", "comment": "Malware payload (IcedID)", "value": "e7faf53b45505a83e56f47dff4086a78", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278989, "uuid": "65bc0fd6-694f-498e-858c-e9e328c24f74", "comment": "Malware payload (IcedID)", "value": "02c8c7a99d45c774dbebe36a43ae2560e32d235c639f1a19e24c4e98f0ac19ee", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278989, "uuid": "92fecb28-e5f8-4b5c-9b66-3aff2033f36a", "comment": "Malware payload (IcedID)", "value": "53e0d8c7e8b70be2bdcc3bd4a9d68647b42bf9d0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278989, "uuid": "4e54af56-efc0-4b71-a82e-f6a8816562ac", "comment": "Malware payload (IcedID)", "value": "d336af80c98d830f3d2351cb1712181e6e43e3236d27e7355c1708c0e059ae5e42894da19350bef8ef2aee47ba96068a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278989, "uuid": "8d47e37c-c223-4c39-80fa-d55bb24d1054", "value": "D9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278989, "uuid": "48337a39-c110-4f30-98b1-7fd29a5f4a5f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278989, "uuid": "37b5384a-e713-4dd2-843f-851b3a751869", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278989, "uuid": "9725fb61-932e-4625-af26-86f2cf4713f4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278989, "uuid": "bfff0b6c-d203-483a-bfc7-8e0440c4e4cc", "value": "document-1333242707.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b974c59d-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277515, "uuid": "b97e0d11-7a89-4113-8239-6ced136dfe07", "comment": "Malware payload (IcedID)", "value": "fe1405d1a6b790a7e39d004b9dd862ff", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277515, "uuid": "6781c91f-a1bf-4ab1-852f-1da517ec9d7b", "comment": "Malware payload (IcedID)", "value": "02d67a91016f92039817478f73005a1d4d8b4a79d29138bc3f87909f464349ff", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277515, "uuid": "07a31cf5-9cce-44d0-baad-1710b3f3e22f", "comment": "Malware payload (IcedID)", "value": "c34c68042a79767880ce33ffb1d482a8ff524f96", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277515, "uuid": "29bf37b8-708b-4208-bad1-b58903930529", "comment": "Malware payload (IcedID)", "value": "bdf0420bf2d160f5aaf582db8f393a56a702d108e2b238de61a1cbad2dbe265379d4946af690e6fe1bfd837ced704403", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277515, "uuid": "cc1e361f-2b75-41b3-a5c6-c2e68e96b473", "value": "E1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277515, "uuid": "9ccbd194-fd70-40ef-9898-9ff2a91dc99d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277515, "uuid": "8f534a02-51f8-40aa-8a47-76c8be39cd19", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277515, "uuid": "ae7b0db4-1d33-40b9-aa95-18939f9c8ca5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277515, "uuid": "d0920134-924f-4be8-bf06-4ca962ad0841", "value": "document-1358292396.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4acc19b1-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292361, "uuid": "daa94945-7fa2-4868-b17e-76d83434bba9", "comment": "Malware payload (IcedID)", "value": "0cccf42c204ec64f6172e1cb78d33cb0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292361, "uuid": "762e6e9a-6332-4939-aa89-08c68147af17", "comment": "Malware payload (IcedID)", "value": "02de710464acc3506ed50501384e79fec02275629650fff6b1cdb7295f20feb0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292361, "uuid": "7b4ad633-b553-414d-b8c4-632f328f5701", "comment": "Malware payload (IcedID)", "value": "4abb0036cdc33df592cea83699b85e9accf6c935", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292361, "uuid": "9ea9f3c7-b150-492e-8b8c-440974896eff", "comment": "Malware payload (IcedID)", "value": "f1059c42ca398ce51f4f7acb9f753ed74cea8ff8d64936204deafebde8eb6a5b82ef39a1a929aa70a028b58b1ed2f3dd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292361, "uuid": "393692a6-aced-4217-9db7-cf471c1465e5", "value": "35838CCDC917E1D9C2559FBD5A0A308112F4E0B6276FF11B148EAA2E0D42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292361, "uuid": "3769f106-4b42-42cd-8bf7-4e30495d42e1", "value": "1536:IB240XZfcaaxf+EQliU2haw3CAIoo8+BNvMhfvdg:+2d1cBWEQXM39o8+nEhHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292361, "uuid": "e01f3d8b-6e8d-453d-bdea-1076aad11eac", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292361, "uuid": "0beb113d-b294-409a-b9f3-2006baac710b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292361, "uuid": "40adc487-11b1-4c5e-b5f8-0bb20bcda4f6", "value": "77.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0888f079-9316-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617300840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300840, "uuid": "1c9ad65f-7380-4da9-b2a9-afe43ffc777a", "comment": "Malware payload (Formbook)", "value": "cddb714cac94bc5278f81f1929b810a9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300840, "uuid": "feea1e70-5035-4c8c-934f-039514447bac", "comment": "Malware payload (Formbook)", "value": "0349c97fb1c6823d99cd0db36d6766c91006dd936ce6a5260862109c34eed2c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300840, "uuid": "add5576c-1399-4014-a380-24eae185d454", "comment": "Malware payload (Formbook)", "value": "a4fbafd9793d9b0eeb18e2b44150d3ad821644fc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300840, "uuid": "f03e458c-5ed3-4be3-abc0-efa054adc33e", "comment": "Malware payload (Formbook)", "value": "a4a151106d53532eba25055740cf67e70426aed4029e6ae97d8df66ad4d8d083782353f4792d54e58756399b78dcd8d2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300840, "uuid": "3398b1de-f8b1-444a-967f-3a088437f20f", "value": "CE35F1C4160B6826EAF633F56F117B86BD0BF53516EA50A8709FE1753376186FA3B020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300840, "uuid": "5aa2d738-97c0-479b-8e35-82cee32644da", "value": "24576:zPHi0QPHi0QPHi0QPHi0QPHi0QPHi0QPHi0QPHi0QPHi0QPHi0QPHi0QPHi0QPHK:Taaaaaaaaaaaaaaaaaaaaaaaai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300840, "uuid": "1a145cd5-d5e0-475f-9a6d-551ffa6d30bf", "value": 1139602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300840, "uuid": "aa618e70-9f7f-428d-b810-6a830eedee46", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300840, "uuid": "4808cde6-0d1a-45e3-9dbf-706a7d81ac0c", "value": "4-1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d552d72-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617261898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261898, "uuid": "50d0fa85-d00b-4eae-8cd6-b23f9d56711e", "comment": "Malware payload (SnakeKeylogger)", "value": "963be82dcae59c91d2db8d24b4ca80bc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261898, "uuid": "8d0ee0dd-425e-415f-967c-0d677f7508c8", "comment": "Malware payload (SnakeKeylogger)", "value": "037e25d19a91237eaf23aae887acddfaf0120f0bf31875b0a6964760c43fae4b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261898, "uuid": "3d242136-3601-4c20-b73a-e3efd3e9a477", "comment": "Malware payload (SnakeKeylogger)", "value": "2c2fcc2324206a0e6f497c7045f51268d7dd9d22", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261898, "uuid": "48b54279-b2c5-4953-8a1d-04afc1c60fc5", "comment": "Malware payload (SnakeKeylogger)", "value": "29d70055abf84d727e8afe462b439d6fba6554cc92d51c3466b2e0a0d56ef9d1c66d165b64eb0df332614ac1540ef60f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261898, "uuid": "71115b94-7db0-4922-8206-861836ccd938", "value": "C2C42320636AEF1979D4B56FC773CB08F4DDE83D52031B3970E3078E9CAA9C4195658A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261898, "uuid": "06d4cd56-d6f6-4876-947f-4b93ca63fd90", "value": "12288:NMwZ2Vy56e5BiYQM7TeDP9pBc7jubPyNiKJL:NhaemRM/SBc7jubPyzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261898, "uuid": "a7f272e6-572f-4c54-9642-7fec06ec92aa", "value": 561765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261898, "uuid": "7bfbf04c-10d1-4acb-a150-06885c3dc59a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261898, "uuid": "a608861e-7650-415b-b8bc-398cf770e8ac", "value": "SWIFT copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fef767-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276969, "uuid": "dcc7b5e3-285c-4397-9005-38e44bddc864", "comment": "Malware payload (IcedID)", "value": "a0c4381cd66df7002bb8e72055b46279", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276969, "uuid": "06f72abf-7867-4d92-80af-8266f995a75b", "comment": "Malware payload (IcedID)", "value": "03893dc4666c6178755fa86034427e4d4fa8b2780fd007bce97fbed955fd68af", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276969, "uuid": "81a1d317-a24c-43d8-8b03-cf2bede3c708", "comment": "Malware payload (IcedID)", "value": "fb74910e44ef5244d7ea442f90399feba48ad165", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276969, "uuid": "f2b523ab-5d8b-42df-aa96-9c7e26caff90", "comment": "Malware payload (IcedID)", "value": "6a2fb62f03de273226bc54742edf93d32ef01fc6ba83d39344c2053818e767861956a46bfcb21b129cc2f39fa54e33f5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276969, "uuid": "d61184c7-3ced-41f3-8bd3-9c71cc6e4ad1", "value": "44044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276969, "uuid": "61e06a8e-04e9-4e60-bd57-33861554108a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276969, "uuid": "5c897e1b-fb1a-4b70-bdd3-6d526a50bca9", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276969, "uuid": "bf6dd628-78a6-420d-a849-1cd13aa5e8e8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276969, "uuid": "16bb6cfe-6caa-4f60-9521-e4474e45a014", "value": "document-819610294.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2e7eb9-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275051, "uuid": "045a7004-62c8-41ae-8ee3-1bc4cc321403", "comment": "Malware payload (IcedID)", "value": "cfe8fb3ecd611fc890a589d29f475b9c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275051, "uuid": "40f689d1-f7ff-4153-9a84-f035b476e3d0", "comment": "Malware payload (IcedID)", "value": "03922f9b70109ce9a4401c5f4a8639357911c3aa2c97d18cc018706b9e434022", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275051, "uuid": "1e965e9c-c954-4c8b-b79c-5b07c7c86bc9", "comment": "Malware payload (IcedID)", "value": "1182c3ff054373dd86eeb070fdbc566abc65837f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275051, "uuid": "b5b6d40b-17f0-4795-86d4-c37299d79a74", "comment": "Malware payload (IcedID)", "value": "785591135d4c741af9223322b3a8c94e148b5baeac262bf46172ad7f927431eeee8c7d020f79610f6393c33032a19493", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275051, "uuid": "aa191ef5-6b3c-4d48-85c7-1a419635adf5", "value": "67044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275051, "uuid": "e8703c82-be9b-4bd0-abdd-f83ad439117a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275051, "uuid": "3406aaf8-6f74-4e89-86df-8773f0ae1116", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275051, "uuid": "35aac730-0392-49a3-8b03-ef82b1c9c71e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275051, "uuid": "3329876b-2a8d-4b34-aec5-81c80ffe917f", "value": "document-1052126646.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a94fa5-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617261343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261343, "uuid": "fad73bc0-121a-4c53-94d6-48c0665e3f29", "comment": "Malware payload (AsyncRAT)", "value": "af98823af1b72c744da7da8f942847ab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261343, "uuid": "1f5816da-1b06-46c9-91a1-799df54aa44d", "comment": "Malware payload (AsyncRAT)", "value": "03bb2d33ad01de0d1f6841ddc595d36357e8efb6e7669fd42cb5167d01bf4d30", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261343, "uuid": "8eb268aa-14df-4110-820a-d0054afe99c1", "comment": "Malware payload (AsyncRAT)", "value": "e36920d03adac56c70ef0b97f780233ecb6b6292", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261343, "uuid": "782f8570-00ab-4722-9549-424ad2752c43", "comment": "Malware payload (AsyncRAT)", "value": "7111756fe78cd7d865dd4c1d1981d0216fd790c3c8ea3058599fd2773353ebdae78df648a8a0288470692492cb947dab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261343, "uuid": "34eed5f0-219e-4e0b-83eb-e72dc9d989b1", "value": "CF017B8D051DB0E71BA561434DCBAE1CC278036EABBA59088259C0F5342FDF9614FBF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261343, "uuid": "4478e6e3-ec89-4cfd-a0d0-b2974be862ff", "value": "12:Zn2/GhZoKc8OtmammtucslMMtEi3/stMM42I6ogsOWsMW2zEpFI6LkDflX:ZnnJO80UzlMMS7MMS6ogr1XtrRLkD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261343, "uuid": "5f47e114-e0db-44b2-a70d-c1cb87856fae", "value": 706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261343, "uuid": "21b57923-92b9-443a-b2e8-0ddb34ff2d73", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261343, "uuid": "17337cc2-4b5b-43cb-ae12-227c1c4c363c", "value": "Statement-ID429417118075.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e021189b-92ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617256105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256105, "uuid": "83220e1a-c984-41e9-a6d1-73734fefb357", "comment": "Malware payload (AgentTesla)", "value": "c3a6a2baffc1f7fcb909de1aceedfbd9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256105, "uuid": "834af4fd-e6d4-41ce-8202-ebfc49dc9a34", "comment": "Malware payload (AgentTesla)", "value": "03f5029b639906633282883b58f94e8932cff44a950d3f3becd155e285c4bdc6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256105, "uuid": "fd5d4b7f-c830-43f7-bc22-d8d52db7c107", "comment": "Malware payload (AgentTesla)", "value": "4587674e7e8a8169e5add9749639c438d0663ff1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256105, "uuid": "79ce187c-d020-48d3-a084-c0c49307a384", "comment": "Malware payload (AgentTesla)", "value": "c643dfd407241e343fce448846ebdd75d0a14fcad922a74bbd217c261adf0329f16c21a94c0b84590c989521dbac1a3d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256105, "uuid": "4cd3be74-3690-4a47-a918-d131e92d92ba", "value": "A194234AE7EE3E999594E2DC61C3D94AF3154ED878B12DEE235EE0410244B0C58EBF2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256105, "uuid": "af3d0d0c-35ea-4e51-895a-6ac888787cdd", "value": "6144:5/zfGRFcNQDzoA8wpfXAaOwIdWXi5MeA0O8st9FaZrQDg2T9Kul2gY39ZU:yiNQD9bBTIdW2W0ORt0rCg2T9wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256105, "uuid": "aa24cb56-b747-4d38-a4c1-1a0256b680e8", "value": 416280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256105, "uuid": "c04529a1-2cdf-444e-ba48-9b644d365e42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256105, "uuid": "67d44065-dd58-4c78-bcc4-53abc057f96c", "value": "New Doc 2021-04-01 13.31.05.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e159f78-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617261336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261336, "uuid": "848446fd-9897-4106-b2c8-45a2c134090f", "comment": "Malware payload", "value": "aa9b802103a516f11a030b0ca96c74c2", "object_relation": "md5", "Tag": [ { "name": "AXA", "colour": "#B8E8F0", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261336, "uuid": "100cbda9-cf35-4a9a-9443-fa37bc837e68", "comment": "Malware payload", "value": "046fb9bdc3e5857c9f6b472cc4e7dd6c12c99d566c6be8e3a5025cd168a738f4", "object_relation": "sha256", "Tag": [ { "name": "AXA", "colour": "#B8E8F0", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261336, "uuid": "f4ba0bdc-55e6-408e-ab71-391e118a2726", "comment": "Malware payload", "value": "342119320fb99b250406518936e1ddc77b59ce36", "object_relation": "sha1", "Tag": [ { "name": "AXA", "colour": "#B8E8F0", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261336, "uuid": "024c0aa9-544f-45c6-b4cf-6102b3ce11f5", "comment": "Malware payload", "value": "3d14ada8d2cde90b5cda07fff37bda790f83e7250c8579c247d94fd94adf8984a2d8afdf43eb2ddb66a53e7c14092a60", "object_relation": "sha3-384", "Tag": [ { "name": "AXA", "colour": "#B8E8F0", "exportable": true, "hide_tag": false }, { "name": "FRA", "colour": "#FC6B68", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261336, "uuid": "4391f2a3-3309-4d7e-b89b-0c4cb8f909a6", "value": "36F0E188FB0AE25EE66FAB720D8ADB557BD2D4880688326E005D459156D48EF0AC8902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261336, "uuid": "830ef9cc-10a1-419b-86d6-003a53fb6472", "value": "12:5jssYnlp8DEvFHfIfvcmEzR66zSfwd+YRWQMftntdGTk6ISzAPal:9ssYn6N8mEz9z9QXn7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261336, "uuid": "4ec37981-c083-459f-a789-228418408b37", "value": 588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261336, "uuid": "8d3753a9-dd1f-432e-9bcc-42d77b41e475", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261336, "uuid": "b869e3c0-f1f6-49b8-aef4-28fda8663c6d", "value": "D12547698.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d7e271-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277504, "uuid": "7f658ea5-ba44-49ce-b323-1e4bb9d36c05", "comment": "Malware payload (IcedID)", "value": "bfd43294d34375e983253e303f960c70", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277504, "uuid": "1ff9d4f5-b070-43fd-a471-616183e93b5d", "comment": "Malware payload (IcedID)", "value": "04b24ccd491815ebdc03fef3d399ca8c52e2f8ce283a904c1a8fbf2ad86e5bf8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277504, "uuid": "da62f3b8-b525-45d8-9602-f8fa2b17fa16", "comment": "Malware payload (IcedID)", "value": "02bfe2943e2ae458c17f3fd7532b2a2487795846", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277504, "uuid": "5f99fb52-9960-4256-b194-56cc899095c2", "comment": "Malware payload (IcedID)", "value": "d1de3700f69914d4688fd2e20e6de50208bd8b24a55d1ba040c7216347933aa8e69f5908630f71a1c7382e587eb25b77", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277504, "uuid": "1080c52f-7112-4052-b43b-6cd7e447ae5e", "value": "98044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277504, "uuid": "6f157724-40f6-471e-b57a-f75fc2915577", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277504, "uuid": "2398c93c-5b08-4958-829d-fb0ca47138f1", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277504, "uuid": "d5585289-92b2-40a0-b7ef-2332461029d0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277504, "uuid": "4361deb0-6f14-4cc0-98d6-33659c9cb912", "value": "document-1281356573.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c763c06-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275668, "uuid": "dbf7d315-22a7-40be-bf23-e6ed321b28eb", "comment": "Malware payload (IcedID)", "value": "5c5f68f7ce235be03b15b4b2006509f0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275668, "uuid": "06455210-0377-4d99-9894-833dfc8e94c2", "comment": "Malware payload (IcedID)", "value": "04c02b61a19817e94bf3b1ae1ae764a71a7b402f0b6a8d880628753176943a48", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275668, "uuid": "298cc6f2-2d39-4d32-b143-65931d865a38", "comment": "Malware payload (IcedID)", "value": "1ebd3e3ced30bcbbb3b991a49f9f8e1e3f7461fe", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275668, "uuid": "055ac86c-c7cc-442c-9570-d82ad4647e3b", "comment": "Malware payload (IcedID)", "value": "0a9b05599f482b77661f5ab0559ec62c399a59f5b598c96b61e619a5db021ebc8e1d2b976883aab9d63649e4a387d695", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275668, "uuid": "6786817e-f87c-4396-b8c9-a377665882ba", "value": "7A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275668, "uuid": "3e99f779-e6ac-49b8-bdc6-5684b42c5eec", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275668, "uuid": "7c4b68fb-d76c-4fb8-acce-2096c7e5012a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275668, "uuid": "29a41f2a-7b74-40ed-884c-41d4dee605c6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275668, "uuid": "d4f78cdd-fac0-4397-a7d8-dccf0d1c78d6", "value": "document-1487064894.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ee41c2-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283528, "uuid": "332ce054-6bb6-4713-ac9a-99dc6763825f", "comment": "Malware payload (IcedID)", "value": "d211a113d82045988450f58e5cc622cc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283528, "uuid": "0fc7428f-3f9e-4cbc-bcbe-1037a2e6f493", "comment": "Malware payload (IcedID)", "value": "04e290be10358b6ce3ae86728ffca93503a78d7682bbf6159dca264523b87a09", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283528, "uuid": "5cd019c2-4516-4146-a768-d25a4f9615a9", "comment": "Malware payload (IcedID)", "value": "75e213205ea1ee5a7c5caff0d9cdccd365f8c4ec", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283528, "uuid": "c85dafdd-a8e7-466f-8544-8edc77c5b5ef", "comment": "Malware payload (IcedID)", "value": "ae239ab05360dc6a45bd74367dae3d69b0b9cb55b81a11d8414c068aa9481c091bf6bcea0ae9281281cf9a67a0e72c0a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283528, "uuid": "aa52975c-c828-4eb3-baf5-64a68c1c5e23", "value": "89044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283528, "uuid": "46027bbe-473b-4a30-a255-1bbea77a17a3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283528, "uuid": "d6a4f943-85b2-4a3b-aa8e-496283ce3c3f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283528, "uuid": "760892fd-609e-45b5-bb36-f97017817f4a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283528, "uuid": "4636c709-cffb-4b85-9e26-eaa84d7ff9fa", "value": "document-576314200.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5267866c-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292374, "uuid": "f182fe91-498c-4791-b601-019a888fbf23", "comment": "Malware payload (IcedID)", "value": "5ce2b959cfadba5e2b7dcab59b26e3f5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292374, "uuid": "a52fa851-4729-4ba8-b94e-c67c14fdf1c7", "comment": "Malware payload (IcedID)", "value": "05139d4f22a8e4e86bc073992a14dec378f9ddd7b3e64a91b5152137587f68c2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292374, "uuid": "8d8fcaf6-cea8-4c0f-a977-3057d6376c30", "comment": "Malware payload (IcedID)", "value": "7497baa4fbb5544ae31ef118d81ba8e8d826bfe5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292374, "uuid": "c6b6436b-afb8-4bc0-a4e0-8348e3b57c75", "comment": "Malware payload (IcedID)", "value": "50fb2576b82e1b6f0a4c8b8fce8fa61cad5c6c6e58c6c02c52304d3d337eb5dc18f6a8351ac81b58cd1c396745841379", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292374, "uuid": "4beb9d4d-86bc-4dd7-bd6b-17143f161b74", "value": "6C838DCDC913E1D9C2559FBD5A09308112F4E0B7276FF11B148EAA2E0D42FA40A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292374, "uuid": "c637e91d-eda1-4c0f-a3f3-6bb397293d52", "value": "1536:IB240XZfcaaxf+EQliU2haw2TCAIoo8+BNvMhfvl8:+2d1cBWEQXM2T9o8+nEhHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292374, "uuid": "177185d2-cb5f-46ba-8595-682ad0b31d91", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292374, "uuid": "38d5c416-1a50-435f-87e1-83770e1c39f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292374, "uuid": "7d3525a9-98ee-4760-90f2-b8c9a5c86f69", "value": "2339.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93b815e-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275045, "uuid": "c9c48055-9dc0-48c9-b8b4-97ece08a91bd", "comment": "Malware payload (IcedID)", "value": "ca5d74c4a67ea6dc6b9d0e86aa88d2e5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275045, "uuid": "6bbd8b58-ed56-4e20-a052-2a97c7e32a47", "comment": "Malware payload (IcedID)", "value": "051e920bf4b733a2cbaa9e1e628ac01179508b14ff42c216c1799cb7f1fb3eac", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275045, "uuid": "2fd12f45-dd36-4119-a8a5-dd32f23abf63", "comment": "Malware payload (IcedID)", "value": "f29970347dc7276d941e43b9fbab8a654e03d9e4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275045, "uuid": "836f95d1-50cc-44de-b884-0faa5ba3ba4b", "comment": "Malware payload (IcedID)", "value": "307319d255ed399b51cee9758cfb71ef26fba0dbce80314d160d52376a97025a28d6b6a0629968d5766a7f84e16c5a7b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275045, "uuid": "8daa428b-3b14-4b54-a5fa-100dd3cf14b2", "value": "22044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275045, "uuid": "584d4b24-56c7-4e74-a02a-ca4825ac4dbc", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275045, "uuid": "ff3bf9e7-99a2-4e44-a441-36cc5255199a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275045, "uuid": "4fa00f93-cb1c-4ddc-80e8-727ac8fe0e4d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275045, "uuid": "a2ba5738-eb94-4286-8bde-a5cf4c2fe475", "value": "document-807712502.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02085270-9304-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293098, "uuid": "aa26ad69-5502-498a-af80-24a3dcb97595", "comment": "Malware payload (IcedID)", "value": "fede9fb82cde97ea77f9b36bd6f476ac", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293098, "uuid": "57b35dc8-ecfa-488e-a035-50166508d532", "comment": "Malware payload (IcedID)", "value": "055b191f87c4dbcc3e69498d5978adb9bfde9915a9fe4bbdd8c5f7b88541f828", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293098, "uuid": "8faeb8ff-23ee-4107-8248-bab4a4626c65", "comment": "Malware payload (IcedID)", "value": "baa1c3ee3ce1f0e004c9240029de9c50cd428901", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293098, "uuid": "3dab952f-3ada-4122-ae19-1dd7d13c3a47", "comment": "Malware payload (IcedID)", "value": "ac8956341cc005e10401fedc4f0fd4b606783cccbfe849a1ea1e04d6fe6e61fde3f26bab6a78095dc46c957db221e891", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293098, "uuid": "1b8bdfcb-2150-4d95-9ac6-3b428ae7e48b", "value": "C3838CCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EA62E4C42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293098, "uuid": "150a3542-80b2-4c3b-9724-34cb3ce4bc3d", "value": "1536:IB240XZfcaaxf+EQliU2hawCCAIoo8+BNvMhfvD/:+2d1cBWEQXMC9o8+nEhHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293098, "uuid": "7b03f3a0-cc40-452b-ace4-4b413c076c30", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293098, "uuid": "1c8960e1-8f1a-41f3-b269-621028349ec8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293098, "uuid": "0308e408-cb68-4d6b-a7d4-9ec81fd188b1", "value": "1739.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825cf1e4-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617281717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281717, "uuid": "21adce86-72b5-46bb-a914-1b0493a36be2", "comment": "Malware payload (Dridex)", "value": "9052f4630f847cbd5c90448a0ea25a0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281717, "uuid": "2a1f3edd-dfae-42f7-8452-e6361786c21d", "comment": "Malware payload (Dridex)", "value": "0566f0817f9dd2c06d10cb7dbbdf899a90d6909b9e2624f1c2ba3dac7cd916a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281717, "uuid": "fa49319f-723d-4d73-9a5a-90e1ba14e3d2", "comment": "Malware payload (Dridex)", "value": "76f9750b6ae4f42c318da93e001786b44400b40d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281717, "uuid": "1f1b2c53-ae98-4da6-81a1-2a4cac729c2e", "comment": "Malware payload (Dridex)", "value": "060291158ce19e2fa20e5908bc60d0ebef6b22b21e04627c95d61f16296e51ce8b8d73ab903fd0fd5b83134e77fc5fcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281717, "uuid": "6fec2eba-0c1d-4b61-96bf-8c6de95f8654", "value": "D214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281717, "uuid": "8f3afe1c-2eb3-4ac4-9075-ef148a62517a", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281717, "uuid": "38ab771a-bead-4acd-970d-bc1f07945a9b", "value": "3072:Hopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:IpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281717, "uuid": "850b7523-2279-466f-9a13-ff28bf244e04", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281717, "uuid": "10ad177f-1434-4ff5-8960-f4b1c45243cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281717, "uuid": "54ecf34a-9238-48ac-8c03-d756ff7e3b8e", "value": "9052f4630f847cbd5c90448a0ea25a0a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71d74cb-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617262022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262022, "uuid": "66477a49-9b8b-488a-8693-9119e7f143e3", "comment": "Malware payload (Formbook)", "value": "add30304462b6cb99f7cc8e34296f998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262022, "uuid": "30c01bc1-9739-4bda-bcf5-2eea84bdc7a2", "comment": "Malware payload (Formbook)", "value": "05a44966d6dda37e5d365563d5792dca28d5e2557e8a31990be5b588d97ed84a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262022, "uuid": "a624a0a9-ea93-4e1a-8084-2896602e2bd3", "comment": "Malware payload (Formbook)", "value": "26c1e3dd6fec71176f2c5ae7a7499e7814482c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262022, "uuid": "28ad58dc-d918-4ca7-acc3-6e733fb63efa", "comment": "Malware payload (Formbook)", "value": "36a91603f03810244b5b35ec5d63beaa4cd86a580b309ac3954dc230dea0cb13bf1b809625a5d94b79529f505fb7b0e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262022, "uuid": "42b3ec03-5828-4334-b314-5ef026437592", "value": "17C48B2333877B5ADDB803B40551458833F1AFA6F66BC30D6C64729C4E776C187AB6A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262022, "uuid": "3379ac03-1306-4093-ad90-3f309d674108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262022, "uuid": "0499d271-ba5c-4ac3-b0a9-c182b86a9939", "value": "12288:mNW8jkU9jY+ZlB93B6lLNVe5Nz5t37TeBPWs4LN+JZn:mQgY+ZlBQSlTfeBPWg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262022, "uuid": "12a9aed5-9552-4280-90e1-bd0568fedd9d", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262022, "uuid": "6d6e0720-6d2c-49fe-b111-836c20f5308d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262022, "uuid": "16427262-b000-4831-ba46-8c8e6979067b", "value": "Order_IO774378384748347734.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793781c3-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288574, "uuid": "e3b9ff20-83f6-4b80-839d-84f538f6822b", "comment": "Malware payload (IcedID)", "value": "8db5e82a49937b0ed64e2b0ff5043d1c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288574, "uuid": "60312160-4655-4791-a094-62fde68df8b4", "comment": "Malware payload (IcedID)", "value": "061ff8950247a7263274e85e6f7a5a21433672cf2a011a8eaf72ae2f1f737ad0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288574, "uuid": "ba3e5f1a-dc5b-4207-8393-5f08a82fe56a", "comment": "Malware payload (IcedID)", "value": "299721b769d1a432961659f876e16a50e61323be", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288574, "uuid": "533f47d8-ea3a-40f0-8abc-c0a41f5de1ab", "comment": "Malware payload (IcedID)", "value": "b6b64a33ba6740628fd2265f1fe344c40a4904ee469c1e5684f7d935d99800d75c5fe67505cf54babcead83b9ca81c9d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288574, "uuid": "71875ff9-63ee-4623-bf08-085a96a30e67", "value": "7F838DCDC913E1DAC2559FBD5A0A308112F4E0B7276FF11B148EA62E4D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288574, "uuid": "ff1e0832-dd9e-4ed2-bf5f-f84c13858e11", "value": "1536:IB240XZfcaaxf+EQliU2haw4CAIoo8+BNvMhfvmy5:+2d1cBWEQXM49o8+nEhHX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288574, "uuid": "ff519e60-f702-4d6a-9944-9a0e1b100d23", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288574, "uuid": "c5e9f129-702a-43cb-83c5-11537b6147aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288574, "uuid": "8408212a-9a54-43c5-9ea2-cb193488adbd", "value": "1366.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947405bd-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287761, "uuid": "d067092a-dad0-45c6-8be4-7643f26795ad", "comment": "Malware payload (IcedID)", "value": "5c38c3b6fdcbb690d03383d594b81fb1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287761, "uuid": "665d47b3-1ec7-46b8-8c70-3a1444241de4", "comment": "Malware payload (IcedID)", "value": "0692b54dfe33b4566d1b4e8bc8a00908efa3847fc8ad378f8d5d607f1ba4f638", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287761, "uuid": "9e0607b8-d28a-4794-871f-f4d458dbef2b", "comment": "Malware payload (IcedID)", "value": "5740b9a969a6ce0a9062e943929856b67e6bbb18", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287761, "uuid": "100d1844-0005-47bd-9ce2-39d9f6383680", "comment": "Malware payload (IcedID)", "value": "305975aa334238d0418e4a40c0885b7cab9edd045536db1d8f457af0b31a14bfbdf9ea0b48c63161d02e0bf70973d308", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287761, "uuid": "95e60d2f-9708-45ec-8bf5-475726282a8a", "value": "B6838DCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EAA2E1D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287761, "uuid": "412a6cf3-a7ca-4133-acac-b36d6f8e6bd6", "value": "1536:IB240XZfcaaxf+EQliU2haweMCAIoo8+BNvMhfvb9:+2d1cBWEQXMeM9o8+nEhHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287761, "uuid": "1baafb2a-a5db-4c79-82c6-e56468c51281", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287761, "uuid": "2ca6f333-42bd-49a7-ada3-4d7950aad342", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287761, "uuid": "892f87c5-1eef-4b1e-8c44-d8bed18af52d", "value": "3248.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb819cc-9309-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295668, "uuid": "de85752c-4678-4d3a-b847-8524bc127912", "comment": "Malware payload (IcedID)", "value": "8f98c44e523e108f3acf5fec794c8e4b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295668, "uuid": "d370c88f-1fab-4571-ad3c-62b4ca50842e", "comment": "Malware payload (IcedID)", "value": "0693cdbf1d1d787949a1f7250701d397f69a2ece3de5860324872ec2123a5eb3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295668, "uuid": "12bb308f-3ba1-4c34-82fc-c7ed9348ec47", "comment": "Malware payload (IcedID)", "value": "1076a4a12d78282d9f85c1e8219f4aeaa2e506c2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295668, "uuid": "dbe90244-b57d-439e-ae7f-e5892da272f3", "comment": "Malware payload (IcedID)", "value": "41e0c96040239c2f0b35018b023fdf3fa475b5275510ea2a9d1e6afde2dcba3404cdd23745ec58a5dfe845940688546c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295668, "uuid": "bcd5f5e1-5ff0-40d6-81bf-47e351dacc6e", "value": "19838DCDC913E1D9C2559FBD5A09308112F4E0B7276FF11B148EAA2E0D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295668, "uuid": "69781e1c-6c4a-4982-8e8d-d9932a25d095", "value": "1536:IB240XZfcaaxf+EQliU2hawrCAIoo8+BNvMhfv77:+2d1cBWEQXMr9o8+nEhH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295668, "uuid": "12f033e5-5c87-42c9-aeb7-80b5d7cda7b2", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295668, "uuid": "3073500b-ce4c-4c8e-a856-1f52dba229a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295668, "uuid": "4eedff31-e453-4cbb-b24c-aaaae2396ac0", "value": "692.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083055ee-9306-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293968, "uuid": "da2d47d8-a550-4fc5-9a9b-eb670a820120", "comment": "Malware payload (IcedID)", "value": "b40478c9837b46e0c7c58ed6e2b287a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293968, "uuid": "cf9d5c29-7d1b-435c-8f63-85598e9ef2c0", "comment": "Malware payload (IcedID)", "value": "0696ce4d1073d56993acf108816e8f6d4cadc0803fc24a1ede47569faeb1ed80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293968, "uuid": "322dec8b-3542-42eb-ab1e-3aa9b5db410e", "comment": "Malware payload (IcedID)", "value": "641f010814fecc35133e5d4e679822fed619174d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293968, "uuid": "1e5db838-36af-4c1f-a0f1-f4d7a6505714", "comment": "Malware payload (IcedID)", "value": "11dc6cf3c2e48b16326638706a1e9f4cae9eebeea349af917eb84b79e96baa82c13f796a4939b98ee8a68e1ae131be1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293968, "uuid": "93b7bffe-2923-4338-a669-2de53d9619ce", "value": "AA1408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293968, "uuid": "a2878585-0e1d-4f1a-8b43-ad7de697808b", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293968, "uuid": "1b11d711-4534-4ccf-b512-3df0b835cd48", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293968, "uuid": "7b8fb56a-2a85-4fdc-803d-a9d0f0671952", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293968, "uuid": "18209a55-082d-4800-ac65-35c4bfafa25a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293968, "uuid": "1d43cf58-c94e-4fa4-9625-9fafb14a0c86", "value": "0696ce4d1073d56993acf108816e8f6d4cadc0803fc24.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b674e2-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278986, "uuid": "0cce1949-f9e8-4642-8560-4358b2445c58", "comment": "Malware payload (IcedID)", "value": "493ee60573ba503b8455ed2e0afe3f51", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278986, "uuid": "ac6e0632-f2a7-43f6-9543-c85fc78940d9", "comment": "Malware payload (IcedID)", "value": "06a55ade2ce4bcfdf021592ffa3a1287b3dfe1480b0af97dee1f7a23d5973977", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278986, "uuid": "62a083db-2104-4b70-b323-5f32ee53e32f", "comment": "Malware payload (IcedID)", "value": "18e8941917f8f47f0c9ae1d0aa5d6759a4d75857", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278986, "uuid": "af4d751d-d066-4a1b-85dd-95559e3bb5a9", "comment": "Malware payload (IcedID)", "value": "1f11148f43a0dde49ba9938204cf6e43bc25eb858fac80aa994d6f0e223d094f77abb6cf87d150bf96804abe07064ad4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278986, "uuid": "67559b95-6591-4a81-8f4f-92bdaa04d5c3", "value": "7A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278986, "uuid": "8e0784cf-f699-4c3e-879b-2da33bee6479", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278986, "uuid": "6ed9b5d4-dfe2-49f2-8eee-adb4fa158b6b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278986, "uuid": "1969473c-55b6-43f9-8d0a-b8725dc2bb9b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278986, "uuid": "468f60e1-9ab7-4f4f-bd50-4fc9c5b72eab", "value": "document-25716647.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47185f9-92ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617256112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256112, "uuid": "d9f38f4a-1ce1-4afd-b329-70b0e968da07", "comment": "Malware payload (AgentTesla)", "value": "5945e648fcaffbde990c70e7aab76e1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256112, "uuid": "6cffea29-9790-4562-b607-6fa0e49315cc", "comment": "Malware payload (AgentTesla)", "value": "06b4de3d0ea9895ad2d5d1139d3fbc9a671890e8a66c3b7607351ac10fa30562", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256112, "uuid": "28b35cd3-5aab-4081-b99d-7f72c063fc2b", "comment": "Malware payload (AgentTesla)", "value": "663ae5c22591251b962d307589eecd88f66835c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256112, "uuid": "8c100011-9855-4726-b682-01500c0b79f3", "comment": "Malware payload (AgentTesla)", "value": "9b6432ea9b3c5f0cd407ee6969addce719eae29f54fcdd55607114eb59697e66adb958da665e7db801c478a74966882a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256112, "uuid": "7e5854e7-ad69-4414-9e0e-127e49460f44", "value": "A8A4CFB532D45B15F07AEBF87861110093F8A53D96E2E64E1EA850DE0572FB098E6F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256112, "uuid": "8b46c6ee-4141-4b1b-b87a-a616a6f7df22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256112, "uuid": "280b07c1-576a-46c2-9b99-4c24ff53e930", "value": "6144:i5vXhtxWMcmWgoA8GpfXA+OwIV+PU5MeQ08WstRFeZrQDS2T9s0lwgY39Zg:ifMDw9/TIV+qq08Xt8rCS2T9kM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256112, "uuid": "df5c9c99-c13d-4dae-b190-2966d56d1e85", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256112, "uuid": "090a03b1-c6de-4a39-b7eb-49d0c36b7f55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256112, "uuid": "61b737a2-f809-4a13-bcf4-fb4530dfbf19", "value": "New Doc 2021-04-01 13.31.05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35b659c-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276619, "uuid": "abd00657-3aec-4367-8a04-5f34b0099b9e", "comment": "Malware payload (IcedID)", "value": "c1997b05c863deb0af301a315117e787", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276619, "uuid": "a0117d00-bb48-468d-9d5b-e737c2ae5f05", "comment": "Malware payload (IcedID)", "value": "06d782114050a46d287f54ccd7d9f55c0475651bde325afb2510fb7b9ab93d8c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276619, "uuid": "e6bf88f6-97be-4769-94b4-3c3bbc449045", "comment": "Malware payload (IcedID)", "value": "f8dbd735739bcdad1d4a2d501c3374b228dcf823", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276619, "uuid": "d93783bf-b9e3-4b9e-841c-7df006ab5ce4", "comment": "Malware payload (IcedID)", "value": "2009e690f2487533e2b522fe97fa0c9be30bb98359808f2f9ad5d582267725ce5bb30b6d5b4da2dc5f39934a31778ef1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276619, "uuid": "5baef991-476b-42e6-8276-539658ac95fc", "value": "58044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276619, "uuid": "c01edded-3dd4-41dc-a7e5-f3f4e554ea3f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276619, "uuid": "de874dae-f32a-4bea-95ed-8ac7f1606c5b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276619, "uuid": "f67a71e4-ef26-4ab0-a28a-4c2713eb2d00", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276619, "uuid": "aa016091-7e82-459d-a9fc-13350b3ae96d", "value": "document-1135978850.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead5c5c6-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617274591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274591, "uuid": "fda28408-856b-4b51-918a-7f362adbfe2f", "comment": "Malware payload (AsyncRAT)", "value": "73e662d533f7469a086abb6ec7de6c94", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274591, "uuid": "b89879d3-f194-4368-8b9a-db874c4a702a", "comment": "Malware payload (AsyncRAT)", "value": "0734e8907cb7ff021d602a5046fd6b2b3790ef37113eb2faf3c6e23425e4755c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274591, "uuid": "13e8ddf5-45d2-4b19-acf2-088e3d5e4023", "comment": "Malware payload (AsyncRAT)", "value": "86d13d647c3f810adccb2d4633ecbe7aee5be66a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274591, "uuid": "32d6e35b-2296-478d-a2c9-3eea25a118fd", "comment": "Malware payload (AsyncRAT)", "value": "13a0141ff7ba11820402456d399679a3765ca7477116d0cf0c3ba8246d35f048f7c1a592c032f1e14e98e92581be27b7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274591, "uuid": "d44b2a93-21ed-49ec-970c-2ba4f3c54e31", "value": "B0654A49BB987F9AC32A0F39C117945887E9C5635377F34F39D158E22C02B6A6D4F0A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274591, "uuid": "c1201585-4b91-4251-80cf-f5ddfdacce96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274591, "uuid": "ce1ba7f9-1060-4765-8107-a7dca2d3919c", "value": "24576:dtj3hcRL6qnSNAeU2cMylR1u+/OaVqunDv7:ORWqniH+7jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274591, "uuid": "abc67cc3-1ffe-4dff-8029-be18b7530bf7", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274591, "uuid": "bfaba609-9ece-4083-b3d8-47d21e8caba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274591, "uuid": "928667a5-f641-42ac-8d56-ac51b91e5f8d", "value": "SecuriteInfo.com.Trojan.Inject4.9779.49.9585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5288a9d-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617290446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290446, "uuid": "f5a50f75-de13-4bf6-b595-42b6ad032f9d", "comment": "Malware payload (IcedID)", "value": "818d12f3c44cd1b89156e2235abb69cc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290446, "uuid": "fb54b62b-360b-4880-9282-622c4ed00df4", "comment": "Malware payload (IcedID)", "value": "075645153794d8913d3c1e05e613a17efb6826943d7bdb61a46b2dddd4171fd2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290446, "uuid": "bec1c591-c019-43a8-b496-835d0b6cff47", "comment": "Malware payload (IcedID)", "value": "bd924b98080e946183c6e81f60f8bd8b3a9e4a0a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290446, "uuid": "27528df4-7fb6-42ff-a168-cef0c6579e62", "comment": "Malware payload (IcedID)", "value": "0ae5ee0b9ea608ddc132d4dfee05896c3d446154e06321bed28fe9b672bae1228d5342d0763fe5977ffa5bf24eba7b9d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290446, "uuid": "476b2122-0c1b-47a6-ac01-79a8d342bb41", "value": "B0838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EA62E0D42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290446, "uuid": "60d6f94b-a707-4dec-987b-cc2941c58b9e", "value": "1536:IB240XZfcaaxf+EQliU2haw9CAIoo8+BNvMhfv+:+2d1cBWEQXM99o8+nEhH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290446, "uuid": "a8926bf3-8262-4116-b226-330d94407c12", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290446, "uuid": "82a23d14-47b3-497e-9db8-0f6de0ad5563", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290446, "uuid": "801bb2a2-eade-4a0f-9914-0f101c6d926a", "value": "649.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892ef731-929c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617248657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248657, "uuid": "ac1e1273-dd1e-4aac-8454-9059ae498ef9", "comment": "Malware payload (Dridex)", "value": "3f788a7632f80f3bf14643df51b2de76", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248657, "uuid": "549e01af-210d-4cec-970d-5a02aa224b5c", "comment": "Malware payload (Dridex)", "value": "076a45b6c8eafc148822b8c65e815667648aa6e51d4fb382cbfe2a685e2198fb", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248657, "uuid": "8c984f00-e31c-4d7f-8dbe-c8f0803ea961", "comment": "Malware payload (Dridex)", "value": "96c6bcc8f253184bcc7efa57feb375eb01a7d099", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248657, "uuid": "873e67e5-0397-4954-a619-8ca8bf30b8a0", "comment": "Malware payload (Dridex)", "value": "8c11aaa43fd8d470e9113df9d8350a26d2b24b0e22dbd84a781263e6213c5469232e711e45643659642a375e1efd3390", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248657, "uuid": "aec26e19-0e55-4cfb-b635-ee2f4d9bb4e7", "value": "FF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248657, "uuid": "c49d4b58-1659-4e2d-b60e-71235091ce1f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248657, "uuid": "a3a672e7-a674-4f7d-989e-3d8ccd5bc702", "value": "3072:wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:XpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617248657, "uuid": "020ccf12-9605-44ae-aab2-0b37c275de28", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617248657, "uuid": "505527ec-117b-48c7-b9fa-36692c19c39e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248657, "uuid": "be0937b1-630c-462b-8a29-6030ec641948", "value": "076a45b6c8eafc148822b8c65e815667648aa6e51d4fb382cbfe2a685e2198fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbc6e99-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261924, "uuid": "168bedea-9df5-40f5-9bef-acc213ae54cd", "comment": "Malware payload (Formbook)", "value": "1c5046f349e608984d791ee6ecd719f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261924, "uuid": "f0a0dbe2-1e57-4574-9d9b-4beb6c61d569", "comment": "Malware payload (Formbook)", "value": "081f11a29cbbc406d40f6444ce0f6befcb83ccdb4745711abb2c191774c5ef1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261924, "uuid": "bcfd6a5c-eeba-4331-a3ac-635d4465ad8c", "comment": "Malware payload (Formbook)", "value": "76b95d9122490e4e3308b07f8e30d606ceec2cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261924, "uuid": "3679b67b-7e08-46f1-882a-f099111f421e", "comment": "Malware payload (Formbook)", "value": "82d2315c3160fb522ef16d1e783bcbae280722ab47d13401da975922decf0a30b345a20b53ff9be5b398c0ffc5dd5273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261924, "uuid": "f77c13a3-9743-4e8f-80e4-15b9da79cabe", "value": "DD94D06F636AC097D824DD791625E82C1EB5ACB226A50B17364D3FEE6FF73003C85612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261924, "uuid": "bdce775e-e8e5-4408-b99e-cd70a8e732cd", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261924, "uuid": "72d03711-5e88-486a-ac87-a21a0626a9f3", "value": "6144:eqjIiaddSp47Cc+I7ZFTJ4dvw2Sks0uq2wHhPA7BpZJDJ2GqsazxdQs:f9azSvc+I7ZF6dv0Wuq2wHhPahV21ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261924, "uuid": "dfa427c5-443b-497a-b1d7-67cc6601bafc", "value": 421843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261924, "uuid": "57eb6921-267e-45d9-afe0-8029855c00a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261924, "uuid": "c1eeba26-bd71-418e-8392-ff3fcbe75fdd", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99624ce-930d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297245, "uuid": "b34d6804-9ef1-452d-9803-232580d704b4", "comment": "Malware payload (IcedID)", "value": "d606a5e51f202205389ded186e504028", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297245, "uuid": "bb2b90ad-16b7-4303-ac1b-1fb18f0868d4", "comment": "Malware payload (IcedID)", "value": "08be194e2e2151bac1582dbad7d450e0ce33712ed7c89112fec6f87a680ca92b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297245, "uuid": "500efd2d-4347-41f5-b693-3db7ee62ff41", "comment": "Malware payload (IcedID)", "value": "d511e0447b0c7bffb9b9014ec0c348be7342ea9f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297245, "uuid": "1bd4b3aa-ffaf-410f-bbba-cc44d6eb30cd", "comment": "Malware payload (IcedID)", "value": "611f04e5371b938f41f9d7364d336a88119cf2319ecd10d69deaed8d7f1d6efbd7c2c4378a580e336ab5c774ed0a2145", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297245, "uuid": "e922f8ba-554f-4e97-b828-f20434072570", "value": "6D04123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297245, "uuid": "88bb239b-07fa-4e8d-988b-6f9d71e48007", "value": "3072:TXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:bE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297245, "uuid": "4985f742-2396-48ce-b483-353ef87e9a74", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297245, "uuid": "e16e1264-d329-489a-95ca-e281cd6432b3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297245, "uuid": "6ae1477d-4498-4042-bee7-41216735fbca", "value": "71782553566-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf31c4d-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291424, "uuid": "6fc03d0f-b5b8-4c1c-beaa-17d83877a7bb", "comment": "Malware payload (IcedID)", "value": "a9ffe9e6d818ca1b003752715a6e776b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291424, "uuid": "fa3ed4c5-2b06-40c7-a988-e0e2fd2295a6", "comment": "Malware payload (IcedID)", "value": "092b9deba7c2931c8b49bb5f185b307e484ee550e5fc590080b43f65ce31031f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291424, "uuid": "6841ef69-13dc-46ec-8021-36b587423b70", "comment": "Malware payload (IcedID)", "value": "d72bda1a35ec936b22459125d6b5469eea02cb23", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291424, "uuid": "234c526d-d614-4208-9393-9124fb9a08ce", "comment": "Malware payload (IcedID)", "value": "40026d632009e74ac390e52bbe7c245dd37fc295f5cd092874a568cb6b9c718bb9aad9c16422bf431e023582310893af", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291424, "uuid": "d5a27c7d-8e3c-4c3b-bc9d-464cc1eea1e6", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291424, "uuid": "1653dc61-d3b7-4e28-b486-044c783f2943", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291424, "uuid": "1401b26e-dbbc-427d-8356-d8525efddcb6", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291424, "uuid": "8cf462ae-3593-490a-aa49-723c4cafa1f0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291424, "uuid": "c7bfb307-b633-417f-bdfb-3f7ac337a7c1", "value": "document-2030226017.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a46631-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277451, "uuid": "87bbe934-1ab6-4981-b211-3a899b01f90b", "comment": "Malware payload (IcedID)", "value": "6565619e361fadc42a366f08d1841b80", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277451, "uuid": "208971cc-1ac8-42f6-a144-4e2f06b183dd", "comment": "Malware payload (IcedID)", "value": "0960e5bc0902bf4d0e148780a2b7842e75b64ef20a9eaa099229bc5c7b71ee3b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277451, "uuid": "ac2f9881-000b-4fc6-879e-c16012aa0ac4", "comment": "Malware payload (IcedID)", "value": "00b2fa0aa54c7dba931bc30be2f1c84cdab4e267", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277451, "uuid": "e1b85746-0689-4489-b917-640d6e146df0", "comment": "Malware payload (IcedID)", "value": "345d1293b31f085a5655baca6703ccbad14ba822701428e3f6ad1acec0f880f341511c4228109b2731a4c8962e7edcf0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277451, "uuid": "d9ce1b5e-ec5c-42f9-b38f-6413da2b8c49", "value": "81044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277451, "uuid": "79755f79-baa7-4200-970a-bc94394fbf46", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277451, "uuid": "01d2314e-49bb-48c1-b33c-8a0cff3e4aff", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277451, "uuid": "72d4d162-6dae-46a4-866e-b1f51473321f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277451, "uuid": "b0bfacb8-038e-4637-8c13-a818a0d06883", "value": "document-532270114.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca4f363-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274379, "uuid": "6a6911e4-1bf3-419c-a1de-f8ffdcb98ae4", "comment": "Malware payload (IcedID)", "value": "4218f211f86409c5d09e7c0051918de0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274379, "uuid": "f0a1c0b9-8f50-49b3-95c6-1a4b843e286c", "comment": "Malware payload (IcedID)", "value": "096a13bafea7d0c8b2c426a954db5555fa8bfe28e1268bf684d1ee48c7514ce5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274379, "uuid": "0e84bd20-fe6e-48fe-a50d-061da742774b", "comment": "Malware payload (IcedID)", "value": "6d3f831ba4194cfcabd1999b02821abf05c2599a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274379, "uuid": "3f70980a-2038-4b7a-bb0e-0cbe9f1eac53", "comment": "Malware payload (IcedID)", "value": "2747fae21ae9eb95d57e6874ba770380179fbcb7305a2e81c1bcf6dd7e9b3d9d75a5cbc24eb577d6710bbbb33ec5ab52", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274379, "uuid": "84e8b64d-7e77-43b1-b7f4-4e55fe255117", "value": "44044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274379, "uuid": "d6bfaab6-a900-45fa-a360-7379a6ce0d7f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274379, "uuid": "979981c8-b942-4052-ae1d-a9ec60b6e7ac", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274379, "uuid": "517e1fce-6cc7-4b36-b337-cf00450aa63e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274379, "uuid": "284a9eca-c652-43fd-b406-274262954b5b", "value": "document-1799654176.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af894cb-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288577, "uuid": "f589d621-068e-42da-8570-8bcd38393972", "comment": "Malware payload (IcedID)", "value": "2d765efc429ee538c18dea35c7a67a1e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288577, "uuid": "ffa6a0e4-88e2-401c-b3c5-7885ac3b104f", "comment": "Malware payload (IcedID)", "value": "0985a6fe5dd0ef716c666f76420198cc5252d6de48d6d410f7a37c0a9830c7bd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288577, "uuid": "4ae89064-59d7-476a-bb30-0505d4bb6103", "comment": "Malware payload (IcedID)", "value": "d508967df25b07824fce41fb707e8cd57756d494", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288577, "uuid": "d8ae5de9-f633-4502-bd42-847643e475f5", "comment": "Malware payload (IcedID)", "value": "f16d8c8ea2cd5d42772fc88f69fcf46e6a1050ba092585a522b5ad9d8715b95609df9ea817a136c1eca7debfca080e19", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288577, "uuid": "65e38446-d166-4ded-86f2-583238fb36dd", "value": "3B838DCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EA62E0C42FA84A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288577, "uuid": "e0e3fdba-d0a9-481c-8aa1-dd97cbf71ddf", "value": "1536:IB240XZfcaaxf+EQliU2hawDCAIoo8+BNvMhfvEV:+2d1cBWEQXMD9o8+nEhHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288577, "uuid": "2273187b-2f90-4f35-8584-1fb1087884bb", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288577, "uuid": "cbe12fef-0404-4dea-b49c-2fa64e09df48", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288577, "uuid": "8f014b6c-2ccf-4bac-b767-ed93d5d90946", "value": "1430.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32466550-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279006, "uuid": "1ca88193-a731-4909-aa65-83ef87c9c001", "comment": "Malware payload (IcedID)", "value": "966732d8b16438ac65b83558cbd5e6f5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279006, "uuid": "82c246c9-9c16-4bbf-8966-6e7bc1091da1", "comment": "Malware payload (IcedID)", "value": "0a07b5f83c6dcfc49b12a6e7b3ed04686cd95652f11cfd17ce1ee7c8ccc62b3e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279006, "uuid": "9771ba7d-f160-4af6-ac66-43b971fb4ad6", "comment": "Malware payload (IcedID)", "value": "c70a81cddcf0654ac664cd40b4491eb80c777114", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279006, "uuid": "b81e3ef7-2c0a-4866-89b2-c63e3972759a", "comment": "Malware payload (IcedID)", "value": "a9285bb1ee0e775ce8f677b2899fa8b353fd3b93abf90e9c867f41b58e43e4abe36ae33e0857fc64a0a20839371f2b18", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279006, "uuid": "dd80681d-c3b8-4a96-b70c-9b326dede4b6", "value": "1E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279006, "uuid": "67eb31e4-12db-45ce-a1e5-f0f7b587bc9b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279006, "uuid": "dba661fb-4ce5-4cd9-bf6a-9946965b1d6b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279006, "uuid": "34910cb5-5edc-48bf-ac14-99475a677c84", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279006, "uuid": "b4f3e34a-8dbd-4212-b9bd-a40a546f47dc", "value": "document-800208986.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc146f2-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275670, "uuid": "e5b7ded3-52fe-4caf-be11-74beba028852", "comment": "Malware payload (IcedID)", "value": "cc8cfb384813e24c60d4a0d4f16641cf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275670, "uuid": "1e86c3e3-5b69-4f90-b251-eb51266c28d6", "comment": "Malware payload (IcedID)", "value": "0a5db744e5515ec4181ccc79f2064d6362452586401ed8ddf3084e84a8e8ca0c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275670, "uuid": "d7e79788-2124-41ec-a059-1321859c0d58", "comment": "Malware payload (IcedID)", "value": "89501a7d660ed30dc07dad2ce1577bccf1a21d03", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275670, "uuid": "5b06d7e4-072a-408a-a75c-fcfcf45573d2", "comment": "Malware payload (IcedID)", "value": "a250290d9566c337008a7f5905fb504a25fb729fa1760e1041747e29acc203f9069f526b007c5516cb511ea4657712e3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275670, "uuid": "fab2c508-2aec-4615-8717-2814a8866c64", "value": "C1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275670, "uuid": "1dc6e864-8a97-4a3a-acad-0eabb4b4f4b5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275670, "uuid": "d4614235-780c-432c-8f4a-0cd01bdbacce", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275670, "uuid": "39182c66-e384-42ff-aceb-7f154700a536", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275670, "uuid": "0a0bd147-3810-43b7-bd54-1acec30c20d1", "value": "document-751034329.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a21156-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284268, "uuid": "b1c21290-314d-439e-8be9-fbc0efbd7f47", "comment": "Malware payload (IcedID)", "value": "c3830c8e46b06370730868da968bd5e1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284268, "uuid": "43367f2d-414a-4e77-93a6-64baf9ffc0e9", "comment": "Malware payload (IcedID)", "value": "0a6abb513c571396e5c0a165537e74ebd4c546c4b4b878e44bffa3bbbfd4ab22", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284268, "uuid": "a2c2ecd7-a53a-4ada-a7be-fe65ff202b2c", "comment": "Malware payload (IcedID)", "value": "b794193f1d14f9cc617f2ef1c92fc57db5c9fd9f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284268, "uuid": "5437da4b-dd8f-4178-b2c9-63c1d748512b", "comment": "Malware payload (IcedID)", "value": "479b5347b78aaa34da908787610d74de0f243f226967cdcc9b1127cf673dcd81d0932d1456b0b49b3f0cab799da6bc82", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284268, "uuid": "dd1d6b6d-b1b0-4f57-aff6-e0da403d6eaf", "value": "37044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284268, "uuid": "1c64a7e6-ff07-4f57-ae49-6334744f9779", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284268, "uuid": "59540472-48e3-42f3-a0b8-ebad3a2dd8ed", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284268, "uuid": "67e1fe63-0de2-4987-a2b2-5eb80e0289b5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284268, "uuid": "00609040-701f-4319-9023-7d02caf34528", "value": "document-1992298690.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a378a885-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287786, "uuid": "363aa105-dcbb-440c-8188-2716c8872237", "comment": "Malware payload (IcedID)", "value": "cbdda35aa016f4d168b750e49f9815f1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287786, "uuid": "c69a5f8f-42fb-4ec5-8d1b-728cd37b8720", "comment": "Malware payload (IcedID)", "value": "0a6c6b2e8351c0b3c38effe03c0e081054a27d7146ea197c475d33a6bdded19b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287786, "uuid": "ef1d3103-6e36-4bcf-9fde-6018de807ff0", "comment": "Malware payload (IcedID)", "value": "c16335048048cdd41c1da6605fbad008d48fe2dd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287786, "uuid": "ba2ddee5-89a4-45ad-8d67-923220b60181", "comment": "Malware payload (IcedID)", "value": "7da767c8ebf079c17693923133ef525684958fdcea7e63ecdd12f4e79c25b4f226bdc409928bff6341d21017c4ff7246", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287786, "uuid": "781239e4-5f5f-418a-9cfe-fb22ec069025", "value": "E5838DCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EAA2E4C42FA40A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287786, "uuid": "bff7733b-5231-4692-9513-f812d8c81ce5", "value": "1536:IB240XZfcaaxf+EQliU2haw6CAIoo8+BNvMhfveTM:+2d1cBWEQXM69o8+nEhHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287786, "uuid": "bd67b91e-52bb-490f-9dc4-49e4c4d40289", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287786, "uuid": "65074522-983b-475a-b64b-52decf2b4d57", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287786, "uuid": "3afa7360-30d5-4400-bf0e-a84c881f4739", "value": "3024.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52669414-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276912, "uuid": "0c541f17-bb14-425e-8be8-ad259a7b1e75", "comment": "Malware payload (IcedID)", "value": "c732eeff4bf270c07a8aea11e609182e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276912, "uuid": "ad4845d3-19c1-4255-9fbe-02b0321ca6aa", "comment": "Malware payload (IcedID)", "value": "0ac2ea4c04f4a6bbd8d3da29f634bed6faebfef99d64fb1637756142bfda4f9a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276912, "uuid": "27211e62-4da4-47be-b5dd-7943df7fe02c", "comment": "Malware payload (IcedID)", "value": "998531c9882c3e06026d8ce8e37dc55e8096bed4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276912, "uuid": "3541e96b-7cb3-468e-988f-3c9c45c0b05d", "comment": "Malware payload (IcedID)", "value": "7aecbc1b11fceff8589eba4e8dc70ec4b1de9decaf06241f6b23fbd5055bd452b07ebf73644d7c7f61fab0d88d041385", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276912, "uuid": "174a9ed5-236b-419b-8c94-cee35cca03a9", "value": "E034C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276912, "uuid": "f81f78db-91a1-43ff-b570-76050ea8b945", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276912, "uuid": "22dfb3bf-0cca-4aac-927f-2c05a64bd63b", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276912, "uuid": "f26c7e1b-e382-401f-b4b4-1732207f8d32", "value": 235400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276912, "uuid": "8dde8513-b2e1-4c00-824c-7f5aa44a87f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276912, "uuid": "b2623179-2d2a-4a62-947e-0b234deba823", "value": "0104.gif.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099899f5-9306-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293970, "uuid": "bae9a17b-d48a-4503-9002-8e14aea76ea5", "comment": "Malware payload (IcedID)", "value": "8633ff7aca8a3e38a4cbce06d65611b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293970, "uuid": "b944d802-73c8-4278-a3d3-266662a320be", "comment": "Malware payload (IcedID)", "value": "0ae1451a3539de1347a16ab6e47b03a6bcca680459b4f0048a3bbd6b4242330c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293970, "uuid": "4d7ac7b3-ed52-4679-a9f0-b053e29d5079", "comment": "Malware payload (IcedID)", "value": "88302876b1bb86a774052810df2a69d3f6489b1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293970, "uuid": "881cc8e1-e0fd-4dca-bf18-d1588351bb3b", "comment": "Malware payload (IcedID)", "value": "1795fc3537b682c223d0e22b1bab441eb1ab7e908af5da3dc6c30e12037e7fc75dde267f0d4ab550e4fcd6e2b3ba36a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293970, "uuid": "02d4d693-6f7b-4462-a1d7-b083d87074ca", "value": "AF1408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293970, "uuid": "78118253-870b-4608-992c-92cf637eb6d5", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293970, "uuid": "6ef107ef-80ac-4a65-9e9e-31bce46470c6", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293970, "uuid": "08749d4c-ead3-415c-b88d-59d6da432bb7", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293970, "uuid": "6ab9633a-fd92-4c8a-8b84-dc41eae6ecc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293970, "uuid": "82f7ef01-5899-480d-b06c-df06fd40691b", "value": "0ae1451a3539de1347a16ab6e47b03a6bcca680459b4f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3018b709-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285874, "uuid": "2700f023-e321-4a9d-b5a9-b2949b547702", "comment": "Malware payload (IcedID)", "value": "f44150679d10f218f0de622c565ab4e3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285874, "uuid": "f3804ab6-733f-48df-a32b-55dbe6eb014b", "comment": "Malware payload (IcedID)", "value": "0b67fc23087e734d69f660db99776fd55b0f37aaebfeb0f6eaf4f00be1ad9439", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285874, "uuid": "5b0402eb-fa01-4808-9e46-eb1ea5d80f06", "comment": "Malware payload (IcedID)", "value": "83746dba1bf0e5d6029f386fe8dc846fc4ef4e83", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285874, "uuid": "c96d6bba-331c-445e-ac01-345ac760d792", "comment": "Malware payload (IcedID)", "value": "072bb51d09cef709dd4fd3838b9c37e9a54aade3c5433f5177b396a81a4f1adc0a754f048dda1d0a8401b8c245c27bf3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285874, "uuid": "5dfb1d8b-3968-411e-b139-1ed9a1f3717c", "value": "DE838CCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EAA2E0D42FA40A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285874, "uuid": "2ecba587-8667-43de-9df4-da0432fe4d30", "value": "1536:IB240XZfcaaxf+EQliU2hawJCAIoo8+BNvMhfvWY:+2d1cBWEQXMJ9o8+nEhHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285874, "uuid": "f6eda213-ebf6-445c-aa9e-6244b9fc48ad", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285874, "uuid": "a83a86b1-774d-4f11-bc1f-6adf64ed9e4c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285874, "uuid": "664df8d9-c4fb-48a7-9bc6-133d2912fffc", "value": "1943.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2036a9c-92f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286548, "uuid": "64cc33dd-c7fb-4b0d-8718-c17d99e38774", "comment": "Malware payload (IcedID)", "value": "acd3ccc7b4491c98ab099bc46f3fd934", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286548, "uuid": "3e68c5fd-c939-45e6-95de-a847086e0c82", "comment": "Malware payload (IcedID)", "value": "0b9dfdb5b917f39ba674efc54ea1888dbaa7407038b3e1cb232ddc040a0c6551", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286548, "uuid": "eb5f66c6-048e-49c6-b899-315cdd19f408", "comment": "Malware payload (IcedID)", "value": "6982f15d0d291e9277b4c408bae507ea484cc08c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286548, "uuid": "5a738016-d405-4b8f-b5a3-921e82853de2", "comment": "Malware payload (IcedID)", "value": "6aecf47d005288fd2b0a1764414953f5eeee5b45dde47d0d066d38787375d2c7b4908e78fdf4663e7235aaa32c46dd20", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286548, "uuid": "1e44b98a-92aa-482e-8415-1a912a189a7b", "value": "91838DCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286548, "uuid": "163119a6-9514-4fca-a984-93d516ac7e25", "value": "1536:IB240XZfcaaxf+EQliU2hawwCAIoo8+BNvMhfvOC:+2d1cBWEQXMw9o8+nEhHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286548, "uuid": "925fd01f-e8c0-420c-b346-e6aba4f9ae91", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286548, "uuid": "d221de70-d269-4636-8175-5684eddac97b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286548, "uuid": "1760dd8b-6ae0-4b35-a0aa-fbed783131a1", "value": "89.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7551762f-92bf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617263656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617263656, "uuid": "fc5ad69b-9f4f-4680-a946-8d0e405fff10", "comment": "Malware payload (Dridex)", "value": "9bf563793b9d4e5834ffb7596ad0406d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617263656, "uuid": "5db3bfbb-0d11-4f03-b951-ce42b49bde03", "comment": "Malware payload (Dridex)", "value": "0bc6046c112c8fc8204ede5f6baf6f447a431784758b6ecebb2d3bd5b59ba99c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617263656, "uuid": "3219efb6-98fe-4444-b349-239940a246d2", "comment": "Malware payload (Dridex)", "value": "f9101afbf5c271077c3314f40124a42a026033cc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617263656, "uuid": "6782a6e6-eec9-45f2-b38d-a712a900d12d", "comment": "Malware payload (Dridex)", "value": "9d565b61c4922e37b698b17d0c1102248a8fc62d2f26255472906612528f54c1f98affa51ea826c52605dc9cefb13351", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617263656, "uuid": "f3195640-c8d9-460a-b3e6-31ec67bd8f29", "value": "D014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617263656, "uuid": "c31c0430-9459-4553-9075-da9407b8513c", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617263656, "uuid": "2c9a052d-7327-44bb-a387-c0dfa6c8336a", "value": "3072:X1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:li78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617263656, "uuid": "23a59c54-bfff-4e57-81c3-f7cf0f470e83", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617263656, "uuid": "62b75713-0ed9-4316-8d97-16571c569b39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617263656, "uuid": "edd3fafe-2ff7-4d6d-a82c-05e2802b63fb", "value": "0bc6046c112c8fc8204ede5f6baf6f447a431784758b6ecebb2d3bd5b59ba99c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ff7ea7-931d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617303956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303956, "uuid": "62740a07-a03f-4872-9758-893dd9b3dabb", "comment": "Malware payload", "value": "995d8da92fc74b6aee1521f527fee8b1", "object_relation": "md5", "Tag": [ { "name": "BancoEstado", "colour": "#B9CBCC", "exportable": true, "hide_tag": false }, { "name": "CHL", "colour": "#432E11", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303956, "uuid": "41bf9f13-7158-47a8-810b-c47018dcffe1", "comment": "Malware payload", "value": "0c71bb401046b21691ed7d96c1d6a050233a5783aa77ef95a359270db88d22a2", "object_relation": "sha256", "Tag": [ { "name": "BancoEstado", "colour": "#B9CBCC", "exportable": true, "hide_tag": false }, { "name": "CHL", "colour": "#432E11", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303956, "uuid": "d4d0da3e-f0b7-4c01-a71d-a03025826759", "comment": "Malware payload", "value": "f56d89e8d74b4d29a2633de96cf6ec8e4123207e", "object_relation": "sha1", "Tag": [ { "name": "BancoEstado", "colour": "#B9CBCC", "exportable": true, "hide_tag": false }, { "name": "CHL", "colour": "#432E11", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303956, "uuid": "3775af81-a680-4aae-bca1-8f0cf72ffc8b", "comment": "Malware payload", "value": "d770e18a43e9e6153672a1262e24324dce8c5103ce8eeb2c4d617fbd9317f7b19c27c4c66e9a15673409257c60224b61", "object_relation": "sha3-384", "Tag": [ { "name": "BancoEstado", "colour": "#B9CBCC", "exportable": true, "hide_tag": false }, { "name": "CHL", "colour": "#432E11", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303956, "uuid": "46510c20-d0c6-4e09-b290-b6f708f18f5d", "value": "47F493B444C908A5E2DBC0517EDEFD6002B6F5D7CEE68D6403BCD7720D69B666E83A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303956, "uuid": "6b8ee7d6-7518-4271-ba6b-a6f570f2ae08", "value": "12288:f05jBU5j/65jBJ5j/m5jBH5j/k5jB35j/1:OjB2j8jB7jgjBZjejBJjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617303956, "uuid": "cfffb9bf-5cd9-497a-847e-6564a18863e3", "value": 752600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617303956, "uuid": "e224ac3d-01bf-4fac-82cd-8fed2866b53b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303956, "uuid": "32ea86e0-5a60-47de-aff3-b2eed6e6d24a", "value": "Transaccion de pago 31.03.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7c2982-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284313, "uuid": "846e27e9-f813-4544-bb3a-0a3f33c1c582", "comment": "Malware payload (IcedID)", "value": "282d22c1975763ab85f54c0773e5df0a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284313, "uuid": "1460533a-136f-4da3-ae95-b8c9da14f7f8", "comment": "Malware payload (IcedID)", "value": "0c764d62b915c91b07be724943e9cdc9e4e359e5b834acbbbdea77dae07ef781", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284313, "uuid": "37337c5c-2f8e-4a6d-9ad9-938a7084cbde", "comment": "Malware payload (IcedID)", "value": "23d278953f2b7950c6f25233c817a9ef569521f8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284313, "uuid": "05cc2eeb-7875-4fb4-a369-b9a731112b13", "comment": "Malware payload (IcedID)", "value": "a8a34b394efad1bee79704731d9b22ce08319a91c2272e3347daaa5eadcf897447f23297ecf488ab3b709fe796044682", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284313, "uuid": "2640f96d-4579-425a-8e80-9fcd52fc2a91", "value": "73044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284313, "uuid": "8693ca57-1d1d-46de-a18e-12dd042c8f16", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284313, "uuid": "647a547c-a3ec-44e9-94f4-4cf538787723", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284313, "uuid": "fd105206-6868-425c-882d-6821df635549", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284313, "uuid": "1f2647fb-f4b1-475a-8989-b6cb37df2581", "value": "document-1306564479.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3a524e-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617288794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288794, "uuid": "5ebdb166-db0e-4399-a4e6-acf5978086ad", "comment": "Malware payload (AgentTesla)", "value": "c801d8c27a2a7ad07d915eae21dc9a9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288794, "uuid": "1e145243-50d1-423b-a60d-0133a5d96f21", "comment": "Malware payload (AgentTesla)", "value": "0cdb6a6c3ecc765a473e6bc523998c3de1de652b08501fd163e7c239c8e04359", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288794, "uuid": "03d40293-853f-410e-a7f7-128491d3ed52", "comment": "Malware payload (AgentTesla)", "value": "98cbed6c7aadbdfe20c6d1d91d23022abac650ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288794, "uuid": "3ec36435-4e04-4ebe-8b87-9ec6f41968c3", "comment": "Malware payload (AgentTesla)", "value": "4f4d40575edb6f8089241446c9c92c00cf0424a893145b527458ca9ab4a0b3fd69b6c0a0b4ca75ebd72652b7a1c434ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288794, "uuid": "95a71965-43b6-4785-a012-45b8321b37de", "value": "6C45DFB532D55B05F07AEBF868A4101083F4B53E92E6C6192DAC10DE0E73FB199A1E77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288794, "uuid": "c9956038-a677-4745-9914-33075f481b17", "value": "12288:Y8GwCMr1rGtECjsmDuWln6YE66lOIiY5PtKRhVdHQtTAhy:wOCx7N6460i5FKRhVdHQtTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288794, "uuid": "2fa44955-476f-4d0e-9098-53760eb67c20", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288794, "uuid": "36de4481-0f56-46b9-bc0c-92d4a0c1daa0", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288794, "uuid": "ac05fe1f-b6d2-434c-acb2-76a53caa24be", "value": "SAMPLE order.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed3acdd-9329-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617309387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309387, "uuid": "006a5597-c4a1-4643-abde-2e07b727d6a0", "comment": "Malware payload", "value": "c20494954cdedec3d50d3eb633192393", "object_relation": "md5", "Tag": [ { "name": "5544", "colour": "#5F8D52", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309387, "uuid": "db67e214-77e5-40f6-8b8e-c732b498c2b6", "comment": "Malware payload", "value": "0cff9ddbd36932e917fc47b4927fe9142b3129fde39061f7497fb989bcd13b3d", "object_relation": "sha256", "Tag": [ { "name": "5544", "colour": "#5F8D52", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309387, "uuid": "02d66032-2ba8-43ec-9eb1-8c89307cbed3", "comment": "Malware payload", "value": "c0e87fec1ea0272956f0ad03ad3f3cdba7f74889", "object_relation": "sha1", "Tag": [ { "name": "5544", "colour": "#5F8D52", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309387, "uuid": "43d4d76a-54e2-404c-a3b8-638b66108357", "comment": "Malware payload", "value": "bf982c175c0a5e7b5beb9d150467e6ac5cc664a8d85d6629a4c272ceb5a85f0703476d8e55688b226c5edd987ec5d0ef", "object_relation": "sha3-384", "Tag": [ { "name": "5544", "colour": "#5F8D52", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309387, "uuid": "b13631c7-b3d8-47e7-88f0-59e56c862634", "value": "D583F123DF16AB42D6D95ABD7E872BCC7B02251CB95324DF06400B8B793462A0F4F69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309387, "uuid": "194780b0-6e68-4d89-9838-67a383e0d9c5", "value": "1536:hafYV1yY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWBFJLD:haf0Z1k8g05oyDJmipk4vykYARfWBHLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617309387, "uuid": "f139ca9c-6f53-40d6-b307-aa6c29c8cd8e", "value": 82284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617309387, "uuid": "171da3e8-c259-4dba-9803-a19eccee5179", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309387, "uuid": "e0361695-f21d-43eb-acba-343634d3b5ce", "value": "comando-04.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d43025-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284295, "uuid": "221666eb-8af2-4333-ba56-52466dcc4715", "comment": "Malware payload (IcedID)", "value": "8973e18e5ef81acf8ede7c4390d61c64", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284295, "uuid": "ed78f86f-fa16-4d35-8316-e670c60202c2", "comment": "Malware payload (IcedID)", "value": "0d41b2a96d413e1621738c04aeb72c2f64fef0724cc79e05e73c222989b3c4c6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284295, "uuid": "c5dda59c-2f65-4282-aa52-083d36128d23", "comment": "Malware payload (IcedID)", "value": "a10a78a444d80a3d1ff46f6e40f4d3eb25cfa91a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284295, "uuid": "d23a4b54-5d52-4be8-9d8d-42832e8d0c67", "comment": "Malware payload (IcedID)", "value": "877a2058be0f7b440f02503593a8d6a96669dd215942545670fb12863f0e812403ab1ba358be751a87823b4221b6d1b7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284295, "uuid": "0dbfa016-89f3-4876-bcbf-8ccfe1e7aee0", "value": "06044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284295, "uuid": "df6a16c1-7373-4573-9a9b-96d989fadd92", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284295, "uuid": "62ee080c-4c1f-4984-9a02-e3f81084854d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284295, "uuid": "dd65282e-25d2-44c8-aed5-d45635609cc4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284295, "uuid": "80b16e01-0a7a-4c80-8175-be5e0ef5426d", "value": "document-242963709.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb31312-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617261444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261444, "uuid": "4a70511d-6b3d-4199-8676-980e1f52ed77", "comment": "Malware payload (AgentTesla)", "value": "ecc754c7c6f598eda0a21bfc8818c316", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261444, "uuid": "3fe5e230-4ae8-41f5-bec7-b523ab1b1a1b", "comment": "Malware payload (AgentTesla)", "value": "0d53fbc335eee867688aab720da9851de9d3caf27f697dafe155df64094c72bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261444, "uuid": "96a23d85-ed5e-4898-94de-d66526f38246", "comment": "Malware payload (AgentTesla)", "value": "2988df91a989df34179748caf9e98fe4244f2b70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261444, "uuid": "6af6fc8c-3e0a-4290-b244-a65e9378977a", "comment": "Malware payload (AgentTesla)", "value": "4409faa4a9232853953cd314a368c203bce487e1cf09de669102a9ddfcc9f0983f64dd493a9e6381994529d6c25f3981", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261444, "uuid": "d5d9bdf6-c418-4119-abf3-9bb825026a4a", "value": "AA9423FEBFB108A9749449EFA0A3E0CDF36968C3E9E1F641991A044F2840AEDD5F1855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261444, "uuid": "d081c411-7e0d-47ee-bc6a-eff9b1ac57a6", "value": "6144:TtNsMF/69kOeBlRvHp3UPsY3mQ1KfZONRuOzTaV0tR+mAPczUPN3FeRLh1:TRU9nQvHNu31KMukvgf6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261444, "uuid": "907187bb-355a-4489-94a4-6549141ac6ef", "value": 431975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261444, "uuid": "4105ddd6-cd62-454a-9a25-fbf24fb2b7c4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261444, "uuid": "03858ff5-53d7-4e34-a26b-62e2c4c838d7", "value": "New Order Quotation.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b182b15-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276927, "uuid": "45d8e566-8822-48d6-9ea3-a3ffdd6ca061", "comment": "Malware payload (IcedID)", "value": "903842f1ea37c7eba84b39d6ed6c643c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276927, "uuid": "0eae72cc-af6d-4b72-8065-afa4bc939913", "comment": "Malware payload (IcedID)", "value": "0d83e8f4396bd6d726ca51716f938b211675c7b0bb9180f5757cfdbe82aef6f9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276927, "uuid": "3f55056b-9e40-494f-96e6-387a6c277329", "comment": "Malware payload (IcedID)", "value": "c9bcdb4eb05b195806b4144582247fbfbc5aa26b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276927, "uuid": "db879fa3-1783-4a91-8593-b0ea2bed4e9f", "comment": "Malware payload (IcedID)", "value": "c2e630cd9ff12593d89c4c25c3e0943e7564584edefddaaec77f34cbd718f2312130f35c8686209cf99f1d38a7f38a4e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276927, "uuid": "cb601acd-b9c3-4c5d-aa38-9ac88037dc81", "value": "E6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276927, "uuid": "ea2b82d5-fdaa-4803-9dde-dda39ad83967", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276927, "uuid": "626cb0eb-3c34-445b-9e7d-b2ed103fb3bc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276927, "uuid": "af9bef01-59f4-4f89-bf48-0c5183ea16cc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276927, "uuid": "066e7dde-29a4-403f-8131-b5d942484da9", "value": "document-674085886.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f999ae-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275308, "uuid": "0dd30a2b-cf34-4876-8ac0-f14eb2dc3b15", "comment": "Malware payload (IcedID)", "value": "0d0a3ec59150e5f9c4a4da55e04dfd91", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275308, "uuid": "5d52189b-2447-4316-9c65-7651a043e497", "comment": "Malware payload (IcedID)", "value": "0dd009ee2a0a5dbc906ebe569abdef95baa4cc31ac8536a0a1ee33d24093028a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275308, "uuid": "66d5f7f8-84ba-473c-ad23-af4d1f667286", "comment": "Malware payload (IcedID)", "value": "6aa9835b8c1e16f75ad6e6999ffb4ab4b8bede10", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275308, "uuid": "35ae97c6-0645-4833-bad1-7dbc976d2a84", "comment": "Malware payload (IcedID)", "value": "f8465587c1076c39563d639ccb1053bda53273a6a90c94b573d7a47753fe344febc43d7895932165ddbe6e23407767a4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275308, "uuid": "3416e8b4-d3a9-4388-ad9d-47e85012ea58", "value": "A9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275308, "uuid": "876b7080-ec04-4688-ac48-7294fa45e169", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275308, "uuid": "c0b3b52a-5634-44b6-bc39-e3f7049270eb", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275308, "uuid": "8cd8a9bb-4169-400b-87f9-3f9604132c50", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275308, "uuid": "91c28ccf-26f4-4960-afd0-28ad381bb785", "value": "document-983055389.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90b02ac-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617262025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262025, "uuid": "d5d9bd96-e563-47c3-ac65-19c98f3bf7b4", "comment": "Malware payload (NanoCore)", "value": "bdcafccfbdc23d5a9a00716b8353ca89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262025, "uuid": "a0506277-2e7d-4be1-bed8-f639a543fbea", "comment": "Malware payload (NanoCore)", "value": "0e206f1cf56315c1d4245ca01cac08ebab51decab43760d40e43a754d27da7b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262025, "uuid": "b7a96c1a-7d60-44ff-a7a1-36895f72019e", "comment": "Malware payload (NanoCore)", "value": "4c24a9dfcdc9d7f090b9c3562dc91e2456fd6284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262025, "uuid": "707c5165-9724-4441-8640-58c2110dd184", "comment": "Malware payload (NanoCore)", "value": "4fb5d3b2a4eb0191bd20680a34513c89cb21d4488d838e5dee82b1356deaf0295a08c8bda6e0ed8c777a80173f40c836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262025, "uuid": "8e259522-1ad9-4f09-81d7-5af273ec1c47", "value": "6BB5C4023F09E88AC64809B4C87A8BF412607E9FE659DE1735D4BE9DF4722C77D0598B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262025, "uuid": "9fd9bb78-18af-4045-b1d7-350bc3e5d70b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262025, "uuid": "917bc18d-317a-4021-96a9-cda81b2f1f67", "value": "24576:FipOZqO56ZnQKHTsxF9SxF9BTU/E1gLXyOxZ/mnkxMmnkx1UTD65BtR:bgA0rHTQQvTU/E18Xy2mkumk4D8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262025, "uuid": "d0318675-128c-4bd9-9aa0-99749beb55d8", "value": 2407936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262025, "uuid": "de0da57f-2d51-4082-baf1-74a88b75285e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262025, "uuid": "5fecb098-cc3b-4e30-9411-edb1534c958c", "value": "QUOTATIONs#280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02af1d6e-930a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295676, "uuid": "d90c23b3-6f49-45e3-88bc-f599d8b2a7fe", "comment": "Malware payload (IcedID)", "value": "17b55b52a61553eb89143cbc3e2b6984", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295676, "uuid": "3412ab7c-11b0-409c-bec6-7978d1e1304d", "comment": "Malware payload (IcedID)", "value": "0e66d1088e90849f52ec17f0ad9391e70c2c7265bc5ab46c64182758f785d74b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295676, "uuid": "51c944d7-6bfc-4a85-b86a-f795a8832eef", "comment": "Malware payload (IcedID)", "value": "55e9faaee41e732c80515f24af3d0ac83a09f278", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295676, "uuid": "abc8d5d1-d243-44bc-9afc-10bb586e93e6", "comment": "Malware payload (IcedID)", "value": "3100bf773fd7627b0d2e9c8d77c32f0e313767dd934e997ff5f438f441c0a533c237068b2010b8fb93dd259a396b0b6c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295676, "uuid": "580f557d-38db-49b7-95b4-03bc90449cf7", "value": "9B838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295676, "uuid": "a546c05b-ee32-4de4-b54d-e29026addfde", "value": "1536:IB240XZfcaaxf+EQliU2hawRCAIoo8+BNvMhfvHr:+2d1cBWEQXMR9o8+nEhHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295676, "uuid": "282677b1-8705-4c23-a753-910cca8f256a", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295676, "uuid": "763e4b04-58b5-4774-95fe-63d242e5ade4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295676, "uuid": "57cfd697-3519-479b-8c28-87c32274004d", "value": "1536.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69758d5f-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279098, "uuid": "ea70fd8e-71bb-45d3-86be-71b8bc7a0bd8", "comment": "Malware payload (IcedID)", "value": "e97fca7e3c24be993c9f30389fc3afc3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279098, "uuid": "f04f94b0-1c51-4fb8-bec7-711afbe4dec5", "comment": "Malware payload (IcedID)", "value": "0e988f6f072429bba73f2e6209066c8209b4e17f19904d78c5eefbc1cdd35885", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279098, "uuid": "f74649b1-d343-4c9b-b614-fb19404252ed", "comment": "Malware payload (IcedID)", "value": "0e7cc6d22bac3a616040a418ec7e8d87d3a38e0c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279098, "uuid": "658b04ec-fe93-462d-9ae1-4e1d3a06a020", "comment": "Malware payload (IcedID)", "value": "7750cd3ba61a1eaabbffc032a1f5e87c686290142e77087d532ff233c65a0dda4c66dac26bc80560636533644c05314e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279098, "uuid": "e220ed3b-ed66-4f99-bd7e-f992f85f9476", "value": "2F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279098, "uuid": "57e610d5-eadd-4447-9e1c-7ef71766307e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279098, "uuid": "1be9a409-ee3e-48e2-9157-cbaaa321f7d3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279098, "uuid": "268fb92b-53b9-46f6-afec-a68c90242b0f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279098, "uuid": "bb732943-0ef1-4f83-9d43-f78eb6a34784", "value": "document-1062852249.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf2bd5d-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617292417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292417, "uuid": "e431deda-a496-49a1-8960-597b1f5bcfea", "comment": "Malware payload (AgentTesla)", "value": "636ef73b34fc31643b15e42550917540", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292417, "uuid": "97a1bf0d-5cd1-4503-89cb-9b5d102527f2", "comment": "Malware payload (AgentTesla)", "value": "0ec8177450ccf161683c45548873e33053c500a17cd911a82b7a8f29ce7ccc02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292417, "uuid": "91ea1c2a-90c3-4de5-a145-c203ef06a65f", "comment": "Malware payload (AgentTesla)", "value": "9313909b522d5d18551d6a1f04f820c22b63c256", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292417, "uuid": "da3b2f4a-8417-4fda-9d6b-77a49aac5c7a", "comment": "Malware payload (AgentTesla)", "value": "af6c2927c305b6bdb713c634a70b7fd39ba1d8d0cb2138aa395de45f7bc60f5d0c5a47c953c90a73df779310de88112d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292417, "uuid": "bec896ca-7f9b-43db-89fe-3a40ac34d722", "value": "DCD433940B28DBF9D446DFD4544D0DB5F10EB74E68D9BE3EB11228BC1AA6BA2C0847DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292417, "uuid": "01ecbee0-56ac-44cc-af07-1de9cba39459", "value": "12288:gBGdVOhT07XiZqukzKRjWBhib267U12BpJQO+XWHxE3B8sgZw:gBkVOhg7XiZqxuRjWBhg26QoBgXWqJgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292417, "uuid": "a658566e-5540-4d80-b803-91764a26e9f9", "value": 621039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292417, "uuid": "5416645a-62b3-4e51-9ace-d498bb533709", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292417, "uuid": "115d6df2-2b53-4a8d-927b-f0b814f37e2a", "value": "SOA_01042021.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca69f874-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617277543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277543, "uuid": "52b3773a-aae3-43cf-b9be-db5a0fe1da12", "comment": "Malware payload (Dridex)", "value": "f8c825ceff6bc8492987b06214496940", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277543, "uuid": "240ec6ec-7228-4dab-9486-1201cbb0d0ba", "comment": "Malware payload (Dridex)", "value": "0ecc1c75069fad6a6de2aa9b08b5d603f45918e17b6c6c585d7a1ce3a17a38c9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277543, "uuid": "f55c9fae-8393-4ef6-b814-1178d2fcbf73", "comment": "Malware payload (Dridex)", "value": "3dc092b3700a7bf7e8f36fce70eee1d3054a47a5", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277543, "uuid": "616b336e-9e69-4964-bf6a-ce51fbb0d780", "comment": "Malware payload (Dridex)", "value": "cfb9be3844774e25d46b139d9ae1124772093421f1e11eca13760d31c30bd9f5d7c7967b77bec97fd606da392597a1a4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277543, "uuid": "9eaaa2fe-6cd1-44f0-980e-14e6e0f85432", "value": "DA14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277543, "uuid": "c5382f69-f0c4-4d28-a08d-b46d37018f94", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277543, "uuid": "63e9e5a2-02bf-4238-9e0a-e0e9f1cc7db4", "value": "3072:wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:XpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277543, "uuid": "edcad651-9046-4e60-b2f2-59c305ab4b16", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277543, "uuid": "dd4ff8fd-c8ca-4c36-9faf-438d8eb8ad96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277543, "uuid": "65798001-23d7-479f-80b8-a1e7c9c6c414", "value": "0ecc1c75069fad6a6de2aa9b08b5d603f45918e17b6c6c585d7a1ce3a17a38c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d872b90-92ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617282058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282058, "uuid": "5909bcec-bc47-4fcb-a499-42f030015239", "comment": "Malware payload (RedLineStealer)", "value": "dd33f19f8304c9b080ece59f76be2340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282058, "uuid": "14af6cc1-8a58-4914-9a54-fe8abc13d2bd", "comment": "Malware payload (RedLineStealer)", "value": "0f1153b16dce8a116e175a92d04d463ecc113b79cf1a5991462a320924e0e2df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282058, "uuid": "c6497002-9d1f-4421-ac1a-73e96bacce61", "comment": "Malware payload (RedLineStealer)", "value": "c4ea3327dbc4a22140e8e5e209e5dad5b9cbe3ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282058, "uuid": "c74b70ac-e299-4956-aa9e-7531e8665ea6", "comment": "Malware payload (RedLineStealer)", "value": "4bf4f07e40e54127de7640f1a146e398a2de4b189a21dd1e9d26e310c61a12887cfff874d47ed2b34e818ebe6cbe4dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282058, "uuid": "75e5eda4-8233-4cd7-a981-85f0349e998c", "value": "A494C01133E0C032D09715B68925C7B04EBBB9751A765ADFBBC40ABD5F246E29B3630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282058, "uuid": "6cc0b5bf-c49a-4f59-9814-23907fe34c48", "value": "58720068c13c39e43ba1cc0727dc6386", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282058, "uuid": "7da92fbd-298d-4209-9f77-1e955674bbb5", "value": "6144:cJfGTh1uG9awzyJaiOWqHJPPulZeGsuv3fg7tR/1RWirj8vlU6:cJObuG9MJQ35qeGsuvPg7tR/1R18tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282058, "uuid": "a4407e74-8758-4311-81f5-19400d48dae9", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282058, "uuid": "32f50150-bde7-4d76-9906-86859bb3c801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282058, "uuid": "cbd05eeb-db30-4d49-b23d-d422f8cb359e", "value": "dd33f19f8304c9b080ece59f76be2340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae395562-9283-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617237982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617237982, "uuid": "92b70f28-d527-4bfe-adf1-6fd82a58adba", "comment": "Malware payload (Dridex)", "value": "8de432e30e6b295b9f03f35227b1ab0e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617237982, "uuid": "4903f1c5-dc0d-4d90-b942-12701be53b15", "comment": "Malware payload (Dridex)", "value": "0f4c99222e1fc4701960a6dfebe586097d643b9e4b13ddb8cefc947e0b64fcf9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617237982, "uuid": "d2be17b3-d140-4947-b9c2-a0b3ba95cd1f", "comment": "Malware payload (Dridex)", "value": "760decdab6d8d1ecaa95f862e1e9339e01d091e0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617237982, "uuid": "3f7a7b80-a5ac-4fe3-9bf6-3f3f20a4e2df", "comment": "Malware payload (Dridex)", "value": "96f14c0c4469a35e673078cff9b36744dc7e6c019f8c956c680182780f9256f84b805e4ec60f74cb9e5f51b0c2097b3f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617237982, "uuid": "8c5249b3-2e40-4d39-bc1c-c5e48d2be85c", "value": "8E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617237982, "uuid": "33f6e72a-211e-44c3-9de2-86737363a369", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617237982, "uuid": "5bcb287d-fc3a-4cf6-b044-5e3024c72606", "value": "3072:bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:spjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617237982, "uuid": "540e4cd9-7a1b-476d-9baa-9d7098589802", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617237982, "uuid": "84c0e870-2a6f-4e12-8826-07364b02ba56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617237982, "uuid": "9118ea7f-4513-4271-a6e1-30f4da70d72c", "value": "0f4c99222e1fc4701960a6dfebe586097d643b9e4b13ddb8cefc947e0b64fcf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7e71f5-9305-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293945, "uuid": "423bbec0-998c-4a2b-a7ee-18ab4c68bf4e", "comment": "Malware payload (IcedID)", "value": "cdc21c45a5569c0b07531babc468d11e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293945, "uuid": "ffcf0341-24df-47d8-ac97-94b39837da23", "comment": "Malware payload (IcedID)", "value": "10283f6a3c4fcb2b43a8e4b3bf38c7d1b0d90453dbe106502cfa653810cbcfd4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293945, "uuid": "7244144b-998f-4cfb-a0ef-fddafa06a684", "comment": "Malware payload (IcedID)", "value": "2257359239570c72bdd8a5d77e01353dd1cd669d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293945, "uuid": "7e8ebf5c-9bf3-4cf6-8b33-f194e1bd634a", "comment": "Malware payload (IcedID)", "value": "94d43968be943b8cf06d3c30dc80e8fa04397766831b5c80ced55b9078a5e81648aa6db45b60ef83b76c9024c2abce22", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293945, "uuid": "f3ba279a-d213-4957-a5b1-af162ef4d88c", "value": "BD838CCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EAA2E4C42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293945, "uuid": "0145c790-c5d7-48d2-b0fb-cccecd11a1c1", "value": "1536:IB240XZfcaaxf+EQliU2hawLCAIoo8+BNvMhfvK:+2d1cBWEQXML9o8+nEhHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293945, "uuid": "fa56675d-f7dc-4dc1-8dd5-ad11973f333c", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293945, "uuid": "d822c93f-9257-406d-a256-345b19203187", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293945, "uuid": "72e20012-3393-4c2c-a699-51117dd2b752", "value": "3037.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccdcac4-92f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286540, "uuid": "23d0b449-7610-461c-8320-d23577f5a7e5", "comment": "Malware payload (IcedID)", "value": "75068bd088d30fc095cd39ff84fad966", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286540, "uuid": "e2a121ff-fc8b-4309-b18c-bedb627f83db", "comment": "Malware payload (IcedID)", "value": "1034b65e90c1db48b03ccb016bb61f8da3b3e62a41290fef29cee537f96ac6f9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286540, "uuid": "4fb151bb-e50e-4155-8b3d-5c33dbd711d2", "comment": "Malware payload (IcedID)", "value": "5eed42e1a77e1468d1c2b1e59bc57e962a0401ab", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286540, "uuid": "98fd23c5-1715-4e3e-85ee-614190986adf", "comment": "Malware payload (IcedID)", "value": "f24c7b8b1d18b63a1552fcc5b9704cc3ade0d74abb75664e407efdacb10883c03fbfc9e3c54802f5370ec73fcfc0fde2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286540, "uuid": "d90be5f6-3d58-4635-b12f-a1357e0d1e29", "value": "6B838DCDC913E1DDC2559FBD5A0A308512F4E0B6276FF11B148EA62E4C42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286540, "uuid": "a693c629-7b80-4437-91fb-b1d987c4d547", "value": "1536:IB240XZfcaaxf+EQliU2hawLCAIoo8+BNvMhfvK:+2d1cBWEQXML9o8+nEhHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286540, "uuid": "9156e096-bc2c-48ef-89c7-0dba0730f439", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286540, "uuid": "80d381d2-f56e-4042-965b-1daa271fd329", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286540, "uuid": "cc14f58d-21d4-4bdc-b800-eb1ec3494c4b", "value": "2205.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f5dd01-92f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617285020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285020, "uuid": "a7fa3f33-146c-4ebe-bf8e-de8ecccc51ce", "comment": "Malware payload (Gozi)", "value": "4bfeb4c545f5545e3d320ac6727689c7", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285020, "uuid": "6e58d37c-b295-423e-bcc6-effb0d3e7bbb", "comment": "Malware payload (Gozi)", "value": "104ba1383e23c14fbf6695667a1ac5c1c8b8968c37a1faa46918b72efaa7a723", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285020, "uuid": "76442a36-870d-4ec2-805d-fb6a30d8c613", "comment": "Malware payload (Gozi)", "value": "fbe623db34365ac06cad506d73bd48e1dcc4faf5", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285020, "uuid": "d19df42b-7ba6-4d83-b8de-6b5e6ed71c08", "comment": "Malware payload (Gozi)", "value": "930c8cc3b7aeba9bed2adb5747abc5b061d609e147647f21649ff79de57bf44a6c405e242da6b016f4e4e92a40431b5d", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285020, "uuid": "7f5d3848-afe4-479b-8dea-c3253295aa0e", "value": "FE83F123EFA19782E19866BA7D471BACBF01292C599775EF02904B4B3E153320B4E19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285020, "uuid": "d3cbb83a-2486-4d2d-a59d-961bdd8ea7b5", "value": "1536:6QpZeGx9yY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWB6rF:TxDZ1k8g05oyDJmipk4vykYARfWB6rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285020, "uuid": "2b06fc4d-f14e-4d68-9157-e63df190e83f", "value": 82191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285020, "uuid": "fb4c7280-afd2-40ea-9df9-93f0013356cb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285020, "uuid": "0c1f193f-18d4-440e-a72e-ff356846846d", "value": "inchiesta-04.01.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6691299a-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274369, "uuid": "14ce2b4f-2a05-4eb8-bce2-fbef03593e4e", "comment": "Malware payload (IcedID)", "value": "9be98c5c1dcfb74c5d8a856e3d22d30f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274369, "uuid": "44dfdede-5661-4643-b60e-998e32c8943b", "comment": "Malware payload (IcedID)", "value": "10559381c33c6802a6d6db8ac7ff29edf8babcc56117a99381178d1602b8e715", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274369, "uuid": "4a182eeb-e95f-431a-b202-9ec5d7826f5f", "comment": "Malware payload (IcedID)", "value": "759a279b23b3331313ae94a5e4e73fa1204228f4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274369, "uuid": "d5d23bad-89ed-49d3-929f-f125f8ec7050", "comment": "Malware payload (IcedID)", "value": "3c54abd1a9732d0ee5b5dd0b3aa03de38e5e7e93b9da8d815b40dc2b405404ef5e5e15cea540690a00b2d26f293279ea", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274369, "uuid": "0e2e0d61-2d08-4533-9917-8cd8786e7558", "value": "F7044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274369, "uuid": "397f9590-af26-4a72-814c-ad6a0f29300b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274369, "uuid": "334dc914-d9af-43da-856f-f97064bbc8ef", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274369, "uuid": "3ccfad94-e268-4215-ac6c-37b8497e2495", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274369, "uuid": "d3f58834-971c-493a-894d-ffc070283a56", "value": "document-1800016492.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e4f23f-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261864, "uuid": "1af086cb-7e5e-405d-b1b8-4530a8602d2d", "comment": "Malware payload (Formbook)", "value": "a3dec61bfe7a6af05305e9fa108827b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261864, "uuid": "55f473c4-317a-4eca-91c9-f010b9a730ba", "comment": "Malware payload (Formbook)", "value": "1063d24be84f1889d0d21fb5f35ee4ec16ca653f0d4f37009aa4231aab81dd70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261864, "uuid": "6543422b-2987-4027-9576-53d7f9ecfd9f", "comment": "Malware payload (Formbook)", "value": "2e72bdcc494741650f427ca30402d1749bbef20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261864, "uuid": "35748ecf-610c-44fb-87c6-0dcc3056465a", "comment": "Malware payload (Formbook)", "value": "884a7b1c7865547d32229faac29941a80a3cc5aa77469bfe2875dc24670525c21fb58f1af464a4b720e82947e0ce4e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261864, "uuid": "d50f1df2-5384-4557-9921-b7c98a69d05f", "value": "F3C4AD233387BB9EED7957751051851033F1AC2AE72AC60D7C68724D8EB76C183EB662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261864, "uuid": "5ab5ef7b-29fc-44ae-8a5d-05e54714caca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261864, "uuid": "387f1611-3ee7-4232-b1be-940f639880d3", "value": "6144:0Uf89EjDQjmCWMcpBn2PnWga7uGmsqh2+Dc7n6B8vcoCxmUOD5JYtBQ6:0Uf89Tj+pB2PE7uGmsKknyop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261864, "uuid": "6cde23b1-d35d-444f-9dab-f8278cd8e810", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261864, "uuid": "fadf4f61-9c43-45b5-bceb-4231a547cbd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261864, "uuid": "3397f62f-6e57-4a1c-8222-f9506f73bb25", "value": "Scan74893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6216932b-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282952, "uuid": "6ad11f20-6aac-4542-92b8-78160482e8e7", "comment": "Malware payload (IcedID)", "value": "3d9b5f303a789ca7ee0a159cbca36099", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282952, "uuid": "da932148-8838-48a7-a527-e2c6da0c1649", "comment": "Malware payload (IcedID)", "value": "10de0063f3cb1ad90fca23884a190cfd1ecdc5328b673631388251445e290e78", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282952, "uuid": "d8773d8c-5ba7-4ee5-be93-f0af99bad8ee", "comment": "Malware payload (IcedID)", "value": "c85bf2732ee12b474466c5a342b71b4ca3184820", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282952, "uuid": "a0997aac-9c29-40c1-9269-fec1c94b6dde", "comment": "Malware payload (IcedID)", "value": "5d9ee45dda706c94bb9b1625abec0d966727018abcafffa7eee1e9f87c64bd389f58d21ef3df8d37b820eb7a9065383b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282952, "uuid": "7e4ce31a-e2dc-4cc0-9d68-7770932b981b", "value": "8F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282952, "uuid": "f1b69cda-2392-4676-8762-62fce3551e47", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282952, "uuid": "c4a68112-ef96-4d65-8784-50777bb6942c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282952, "uuid": "34675ce1-113f-4025-b2c6-51d40d63075a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282952, "uuid": "73f39655-ae7e-4bda-b712-8927c9cbe7d4", "value": "document-2064292974.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98943c5-92e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617278025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278025, "uuid": "26642893-d5b1-400a-9e6d-69dacc0c22e3", "comment": "Malware payload (AgentTesla)", "value": "5d2d9e4000108be47aba2e2de8e5ae23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278025, "uuid": "9824308c-b1bc-4fed-976c-9192267c0324", "comment": "Malware payload (AgentTesla)", "value": "10ee7858dd22c0520caa8dfbbc9a974d8d0296fb752178032a0ca3bb70bc929c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278025, "uuid": "91f2454a-a05e-43a1-b08d-8d57e6f74c4f", "comment": "Malware payload (AgentTesla)", "value": "7b8d4430a7326b86cbd1f8c89279bd0acd43729e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278025, "uuid": "c694f764-34c9-42d1-bc51-265a56e4f193", "comment": "Malware payload (AgentTesla)", "value": "1643d2f7e672c0026a9e46f96e2985b161a03d406aeac2738e970bb4d59cbeffbbe83c5968760aa7c61a5cf29b9308f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278025, "uuid": "3983f2d0-2953-406a-800b-45152b0b2caf", "value": "8725AE283F14518DC4A719399858D04C9FE6BC6A68D3D2837EEE33DB64B3F9307A4196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278025, "uuid": "bfe50e23-38b6-4eee-8ae4-beeeb641d778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278025, "uuid": "5cb0b485-57d8-4c96-8f8d-11a888abcd80", "value": "6144:qr+FcqauXalBzefGdLSLGx7TtQ7FvKv8V2qTwwlfZ/KDdkawq0CATaO+9PfBSqxW:US8e+J7CZiv8Swe7AeP52zfZ1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278025, "uuid": "07fb5753-6b6d-4953-85d5-5b45906322a5", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278025, "uuid": "0a162b81-31da-4696-b3d8-8ec728ac35a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278025, "uuid": "72cfccb5-4bb4-48b5-8f09-01cd097fcc0b", "value": "ORDER_01.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e8c60c-9345-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617321237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321237, "uuid": "488f60ae-c7ff-4d4b-8aae-e0784e95cb6e", "comment": "Malware payload", "value": "d3e989f44fe3065ec501fe7f0fc33c3e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321237, "uuid": "71c05f61-34ab-4546-a75f-ffad9c847e31", "comment": "Malware payload", "value": "11056fbdc79e23d2bb9747bf9506b1f764567198728ba84f93e322b4f285171b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321237, "uuid": "5209cf1b-b4b0-4205-be8c-4d55d08b9208", "comment": "Malware payload", "value": "89700204f83a135a738d5acb02fba7abee18f59f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321237, "uuid": "42c266bf-04d9-4b83-bd27-ed55f20e06ff", "comment": "Malware payload", "value": "cff71266f68480bdd379429673d62475d9977364427a2cb8024ef9b563415ac458f04a4e05db037526be11ce8b75752a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321237, "uuid": "c201edec-cf7a-4b85-a774-0068d9a1c67e", "value": "A182092FF4A253BA012BA0E9704059C3E2E32D5B02D95799BF6C481D0F05EEE7DDE295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321237, "uuid": "9b36f10a-933f-46b9-97b4-27ab98d9d722", "value": "192:KduAg8GriE8EzXkh/prQUuOl/Z2cP+lS8Va8Sc:KduAg8GriE88XW/prQNOlR2cP+0888Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617321237, "uuid": "13dd6da8-3216-4507-b3ef-fd6ff2b17674", "value": 19117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617321237, "uuid": "63fa2316-253e-48c4-ab4a-6bd1a1f292d7", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321237, "uuid": "f71451a2-f0ed-47f2-93a1-08c2d53897b2", "value": "11056fbdc79e23d2bb9747bf9506b1f764567198728ba84f93e322b4f285171b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16eda290-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291415, "uuid": "3b289d2e-2a1a-4da0-8e9f-d8ccd546081a", "comment": "Malware payload (IcedID)", "value": "5580f31f2e1d2756b498fe7acf88184f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291415, "uuid": "8eb786ad-d743-457c-956a-805ba3e85658", "comment": "Malware payload (IcedID)", "value": "113ae821200f700c2088c3392531aa46b202773ce0c3086a04d97d90e023bd1d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291415, "uuid": "22003954-70bf-4230-80fd-a0367f9236b4", "comment": "Malware payload (IcedID)", "value": "bebc928825fb0af72ac714ff51bec6b25ad10de0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291415, "uuid": "5fb1a8e6-7b28-4baf-bace-8bb397c84853", "comment": "Malware payload (IcedID)", "value": "f78320c1d8af5fec7c82a9eb41cb01fdccc4a49771f24a8a93243cdb450b7e97da411f3165214b8385a4de2db149554e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291415, "uuid": "a92a2f9f-1cb8-42ea-a316-34641807ddfb", "value": "B1838DCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EAA2E0D42FA40A5E7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291415, "uuid": "4cb0a1d8-6f1c-4e5b-aed7-48632d699594", "value": "1536:IB240XZfcaaxf+EQliU2hawM9CAIoo8+BNvMhfvgL:+2d1cBWEQXMM99o8+nEhHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291415, "uuid": "0d098b67-8337-4654-9340-16d856090aaf", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291415, "uuid": "ef78afe8-8bea-4129-8b18-c05f963d0ca4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291415, "uuid": "91ed6220-8722-4113-94ca-0012607ec861", "value": "339.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eb3c9c-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617287595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287595, "uuid": "ce02167c-d03a-417c-839e-1c6d3778f2f2", "comment": "Malware payload (Dridex)", "value": "1b7abee57f334917fa6bce166e3a1a91", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287595, "uuid": "925cf0e3-510a-4006-af1e-e063a8bd89ca", "comment": "Malware payload (Dridex)", "value": "11478c76475af3ee34b08b33c358d903eff2a0294839c84bb68853d092dd97a1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287595, "uuid": "4e2198f2-7b79-44af-9434-fd99afa81b5e", "comment": "Malware payload (Dridex)", "value": "10062a204ca05c1c5f3ec1f136a8ab614317acd6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287595, "uuid": "23ebe3fa-d182-49ba-9b29-3a5dc8cbc558", "comment": "Malware payload (Dridex)", "value": "b232d97e91704022425bd3ee709d8041242e790bd2da7874e812ec00114a29b43596f15197532ef3bcb40ca37c6d9fc0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287595, "uuid": "01b125ce-508b-4b37-aba1-727f5dd4ed36", "value": "8E248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287595, "uuid": "3d518854-142d-4ae8-a9b6-0f3ff900a23f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287595, "uuid": "0fef904b-17dc-4c4e-8c50-a3b3d3061abb", "value": "3072:A6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:AoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287595, "uuid": "5afaf46b-1a7c-49e6-b128-978ca4f072de", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287595, "uuid": "7943b772-d29f-4b3b-ad3d-ba7b16bc08d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287595, "uuid": "a008c730-1613-4a1a-9f2d-7c92ff128e4f", "value": "11478c76475af3ee34b08b33c358d903eff2a0294839c84bb68853d092dd97a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0152ee-92ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617255962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255962, "uuid": "1cf99912-34d0-44ba-854c-f9bc85756dd1", "comment": "Malware payload (Formbook)", "value": "445adbafac01715f7768ee4884ad8160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255962, "uuid": "34d2a391-8b2b-408e-8b32-832ab5adfa79", "comment": "Malware payload (Formbook)", "value": "1190cb66d731098dffb19ac78c746e5d71e25783921c3bb6f60ab5133233b3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255962, "uuid": "3b473c4a-babd-4aa2-bcbb-57713d0f494d", "comment": "Malware payload (Formbook)", "value": "b87726c285fd5f3a2ec917319e568a3f854c0002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255962, "uuid": "683d02f5-6901-47cf-a5c5-31c456d1c22f", "comment": "Malware payload (Formbook)", "value": "d01f1584689f698f797a156f70cee1d47f3f72d25e580f98c0445345ea27a40c3d28e18a62c3feb3503c33b85962cffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255962, "uuid": "ac821d00-a352-491a-87ed-c660c131f1cc", "value": "F0257CB9B3E1F6B9C5148A3199227C7053F04DA3D931F696ACECF9E0C530EA91F1A146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255962, "uuid": "a758f441-045d-48b4-8f7a-a5e82803dd01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255962, "uuid": "e5213c87-2b1d-4d0e-9f5a-9e3935b33915", "value": "12288:39aOstnvyx6yQOpkrgCVTbaakxaM9qBxaM9qx8lehJYFveXsMAuiCvTX:tKtnQKHTsxF9SxF9AvJYFv2piC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617255962, "uuid": "8811d92f-18e5-4175-a521-db57f0ce0f86", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617255962, "uuid": "876f7fb1-76e1-49a5-96d2-0ca5f3857cd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255962, "uuid": "a0aebcdd-85d6-46b5-8aee-c9588fe87ef6", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1587ad-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288575, "uuid": "f38511c5-f5b4-4499-8404-bc45e55fa876", "comment": "Malware payload (IcedID)", "value": "92a17842c0bbf9d3edc00de7afdd60f9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288575, "uuid": "01873251-86fc-45f7-8f8e-ee1a8a347c51", "comment": "Malware payload (IcedID)", "value": "11e13c3a3b3bf60885e5e2dcfae6f56854c9326aa6490012db7be3deb0ee416b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288575, "uuid": "80dd0a6d-4639-4b32-9716-66559b545f7d", "comment": "Malware payload (IcedID)", "value": "04950787771208f80b395bde4d3d35173a90149c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288575, "uuid": "ffbf8938-33ea-450b-be6b-7813ee9fc730", "comment": "Malware payload (IcedID)", "value": "e6a331227f0cc57b007b73c1629edd448da3408477fe00b0be37861830e8c510d1ced72b537e05ae32e4c57ab31413d6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288575, "uuid": "75dd67ce-b5aa-49b3-9b59-3259b78e4b30", "value": "C9838DCDC913E1DDC2559FBD5A09308512F4E0B6276FF11B148EAA2E0C42FA84A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288575, "uuid": "fa9ed48b-9d55-4516-8329-5bbed7e00883", "value": "1536:IB240XZfcaaxf+EQliU2hawkCAIoo8+BNvMhfvY+:+2d1cBWEQXMk9o8+nEhHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288575, "uuid": "f3382ac3-31c2-4c9d-ab3f-8f6e657a1399", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288575, "uuid": "efffd45d-fab3-46cf-a50c-11d3321ccee0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288575, "uuid": "1d52dc2a-3137-4b4d-9414-3cdd39a19383", "value": "2086.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a69f34f-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282509, "uuid": "7579d4e6-1aa9-4e27-8d70-de27749b4d81", "comment": "Malware payload (IcedID)", "value": "ceb020c97978aabc31febf9975eb07a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282509, "uuid": "8166eadf-e8e6-4d2f-8192-cc01b7e45f42", "comment": "Malware payload (IcedID)", "value": "124d1f53f4701da2d9c780e3cad088d7cc069a18c99e14d0aba0cf60fb291d60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282509, "uuid": "d2ecea4f-1467-4f90-a215-87c5e614c7f3", "comment": "Malware payload (IcedID)", "value": "3054cffd663c7d527685b6e3433147cd671a6a76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282509, "uuid": "8774eaf8-7f0c-44a3-8925-f7d2d4c2aae7", "comment": "Malware payload (IcedID)", "value": "4cc558660caa92f44ca234929bc21c080fc698639e4065c3b0396bc705deacb4fbf135448bca629f685edaeb57ad465b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282509, "uuid": "5c04d9b0-a0f3-4a8e-b940-93469372b696", "value": "CB437DC6C9700622D6366973C1F22B28E116FF60F3A38AFFC144726585A2390DB72766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282509, "uuid": "6662f815-1d9f-452b-a4bb-61064fde650e", "value": "768:es0/GspUSBfGsMWx1hkbrYQ6t0G7ynQWB9E7QIkKgwcEsOfP5YQ0g6tbXRLZM7:M/59Gsdms0G71YE5Ow3ZP0g6tdZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282509, "uuid": "7da5950f-f7c8-445e-8219-072f706ed74c", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282509, "uuid": "47aad3a9-7a13-4086-bb70-8d62f8798485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282509, "uuid": "2b3e780c-4342-4e72-a9e3-5dab3cb88bc8", "value": "ceb020c97978aabc31febf9975eb07a8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09e2bcb-92b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617258656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258656, "uuid": "72cee6cd-5db1-475b-8ae3-4250e46d3a86", "comment": "Malware payload (Dridex)", "value": "a9afeaa64ec3e79e2e9557c3829a343b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258656, "uuid": "00301f77-2cff-4e4f-b006-b397d28903e1", "comment": "Malware payload (Dridex)", "value": "12659ef4b6285975e390188db72f0347171062165e7caaa4cc4b015bdc155984", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258656, "uuid": "07163f88-8487-4dfe-8c68-6ed093d4ae98", "comment": "Malware payload (Dridex)", "value": "d826ca21aae7d5b365706e74a923af25590d9a8f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258656, "uuid": "29216a25-5190-4cd7-a84a-d4f9651b9e8c", "comment": "Malware payload (Dridex)", "value": "bc6a6da701decc429cb965217a0510869f2b8f15ba27ea5abf70678a6560c60d4224a6e41940f7fcbc5a369ceaad99a8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258656, "uuid": "55a00a56-a3a7-4e8d-9ac3-be200db9f635", "value": "D1248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258656, "uuid": "5c892495-9f4f-4abc-af0f-45efe2e23a1a", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258656, "uuid": "c045ab92-1840-437a-82f9-c0d85292d4ab", "value": "3072:N6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:NoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258656, "uuid": "0dabee4d-2473-4ef2-9734-fd2f209e55cf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258656, "uuid": "7536b035-1b60-4117-be51-8879d0644268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258656, "uuid": "5c4736ae-7699-4bd5-97c6-c0c3d56efd88", "value": "12659ef4b6285975e390188db72f0347171062165e7caaa4cc4b015bdc155984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4cd0ab-92b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617258919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258919, "uuid": "e78184e7-39d1-4665-9fde-ac8546ab8b81", "comment": "Malware payload (RedLineStealer)", "value": "a24ecaab4e0e9b568dd8738e590e57bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258919, "uuid": "5b07425a-1456-49c3-b09e-0171c95b7e38", "comment": "Malware payload (RedLineStealer)", "value": "127094ebdef2ba4286949a781d2d756ddc8ae76b42e14b0ba49da4ba6d191444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258919, "uuid": "66736c24-f87f-4a61-b348-8dd62b1c6688", "comment": "Malware payload (RedLineStealer)", "value": "e14f26d17f4418e4300f726796e8df4d66b04ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258919, "uuid": "2db9c5dc-073f-480e-bce5-340af881a064", "comment": "Malware payload (RedLineStealer)", "value": "5a14ad077cc80bc8f4d4c7cdcbf82eab6f5541380dfc6a41046eb618cc583279ce594582805a28b219f17820c99238a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258919, "uuid": "f3863814-aee2-4521-9909-47d2e6d08dcd", "value": "C864DF00B5D5D873D55606340825C7A44A36FCB26B70AACB7B943BBA5F393E1867B383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258919, "uuid": "3adecf0f-a74d-4a8b-bd8f-633511f8e7ec", "value": "584c5603159e17e81307fc57f15dc706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258919, "uuid": "f2ab84b9-8f9e-47e3-ab3b-28e0dee22e6b", "value": "6144:M9iDiVJLJwcLiG2zilsqEZoxOgTjNdHZw89:9DOJNw5G2ssqEeOgTjNd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258919, "uuid": "7b13bc15-f171-4d97-84ed-ab963d7474c9", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258919, "uuid": "8eeea85a-88d1-4e41-a945-08a8aa580e57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258919, "uuid": "55738ff9-2d2f-4952-8ee2-af3e86d66ca8", "value": "a24ecaab4e0e9b568dd8738e590e57bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5592570-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274072, "uuid": "cd51cbf9-b1b4-4d18-9939-a23adf03953b", "comment": "Malware payload (IcedID)", "value": "5e30e5670b77e5bf84e4a696c9060cc6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274072, "uuid": "1cd1f75c-6dee-41e9-aa72-465ca78c0e1c", "comment": "Malware payload (IcedID)", "value": "127507e83c5fb5ffa6083615210d083e82fd10004680981f51640a107ad32dc5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274072, "uuid": "aec3373d-f861-46cd-9cd2-4e806cbd7d61", "comment": "Malware payload (IcedID)", "value": "64dfd73166d48b1ccacffbcef1fe031788511ce7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274072, "uuid": "0e03122b-1167-402f-8838-5eb35155bb0d", "comment": "Malware payload (IcedID)", "value": "141e2ef2fe81fc526accd5d53b75c44a8b0b719941b115f5405b876aa669d76610c1843b33571547ca44af90b2d07878", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274072, "uuid": "5c481d30-b321-4096-977f-876f0990d35d", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274072, "uuid": "1c8e7f94-3788-447f-9ebb-68b9f23b2856", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274072, "uuid": "65d4e106-fe8b-40b5-90f0-3b026dcbdd37", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274072, "uuid": "88eeced5-ccf9-4d62-a48c-2cbda15394c7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274072, "uuid": "3cba1b30-c511-4b83-9c6f-783ad45f4994", "value": "document-131608719.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db4a52d-9314-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617300205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300205, "uuid": "1a724120-4909-40af-9a64-7f2dae7602d1", "comment": "Malware payload (IcedID)", "value": "8c458f1fd11cd19927bf758e405a1470", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300205, "uuid": "24a531a4-cb3c-45fa-a27d-eb4742f958b6", "comment": "Malware payload (IcedID)", "value": "12d0bdc9054a1fcc6573b54f69ad981024ea6da68fe67cb407269110ba57f8f7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300205, "uuid": "b4f8dca5-4c21-48e5-9fb5-535918de6cc0", "comment": "Malware payload (IcedID)", "value": "915585f84cd8ff43f79b4cdf5d27e155fbcf9e4d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300205, "uuid": "96aa2b4b-7157-4ccb-9922-64ea16fe3e36", "comment": "Malware payload (IcedID)", "value": "4104af7db9d5d281cf0f48b99b6ae94f39d31324b8559e190d9df3677e2399befefbdc9d904157269679c0667b72017e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300205, "uuid": "30a26f44-e4d9-4758-877c-9abe2a6289a0", "value": "CB838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300205, "uuid": "8a757146-9265-4929-9764-1e2a02476340", "value": "1536:IB240XZfcaaxf+EQliU2hawK/CAIoo8+BNvMhfv4g:+2d1cBWEQXMK/9o8+nEhH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300205, "uuid": "f4e660de-4e04-42c0-be38-f99e381e4a43", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300205, "uuid": "625c2a25-2675-4531-ab52-8c8b52bcd6bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300205, "uuid": "a133b970-29cc-4c75-b69a-f6017805921c", "value": "3330.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fdb405-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285876, "uuid": "aaffbffd-fb9c-4360-906a-7ceac48b9991", "comment": "Malware payload (IcedID)", "value": "e2f4d7af48a6d67616f5f634fa9fed93", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285876, "uuid": "fbc197a9-a0b9-419c-a5a9-d984c2b5aede", "comment": "Malware payload (IcedID)", "value": "12d5905bf83922b4261e2ab4b92126b76a172a2ee250ef0c86918cbd63026e22", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285876, "uuid": "339be3cd-0a2a-4381-a383-dd68781c6c0f", "comment": "Malware payload (IcedID)", "value": "d13faabc56ef1b5b367c44e6d1af25c3b6592b28", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285876, "uuid": "e8abe821-a933-4854-a241-b7dada975704", "comment": "Malware payload (IcedID)", "value": "07c06c1b215bb169807762b7f07a4fc77342122563d5d8a7f5f8c91819c11edcbbecbf2f15a993ff33866e9715d35802", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285876, "uuid": "7fead5ac-5cd2-47bf-9c6a-82e3d40f287f", "value": "A2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285876, "uuid": "f7683959-e56e-41f2-a10c-a0ae5b88df49", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285876, "uuid": "2652a13b-0239-481b-a55a-805b0e0ed5fb", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285876, "uuid": "6d8d9ba4-4a06-4e4a-9646-ddc07b87f662", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285876, "uuid": "757646d4-71ed-488c-be95-760d7e0cad0a", "value": "document-875856565.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d57e37-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617290440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290440, "uuid": "6654a65b-ee21-4ec7-bb62-bad960957405", "comment": "Malware payload (IcedID)", "value": "6228837fd7d047fa593debe90ac35e40", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290440, "uuid": "52a6a2d1-ac29-4375-9f96-78676b5412e2", "comment": "Malware payload (IcedID)", "value": "13231bb45ca14e03bcdcf5478810b74a756c75dcae95c4de1841a37717ca4211", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290440, "uuid": "a66d0c1f-05cf-42e1-8984-e4e353ff4ad4", "comment": "Malware payload (IcedID)", "value": "839022730c7cd87bfae0f02ea5b2f897a2dd9308", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290440, "uuid": "5739fd94-c3a6-487c-84d9-bef07e0c5fa9", "comment": "Malware payload (IcedID)", "value": "1297cc91125b54b9485c2ab91b6e5faed757997f431cda51f7b365a15edde3d3be11cc5862cb41035a707804ddd21dc9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290440, "uuid": "f2ab77e2-afe0-4bd7-a0cb-a7c1c712eb38", "value": "ED838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E0D42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290440, "uuid": "d745dadb-841b-4545-83c5-b1ee5d361f21", "value": "1536:IB240XZfcaaxf+EQliU2haw5CAIoo8+BNvMhfvw:+2d1cBWEQXM59o8+nEhHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290440, "uuid": "e292156c-5875-4477-b730-4ee5a61ae3e7", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290440, "uuid": "a39397a5-c392-456e-b1fa-3b47d3c7af9a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290440, "uuid": "56a4426e-f8db-44da-9d41-3dec1c63863a", "value": "648.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ed5434-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617259420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259420, "uuid": "723d4b42-477c-46dc-8947-b9f79554eca0", "comment": "Malware payload (Dridex)", "value": "c142de2246a16455225918d2f6aa28a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259420, "uuid": "dcf90a33-bb38-428f-a8da-e9e94b040573", "comment": "Malware payload (Dridex)", "value": "1349a27f267bef560a4874c70e7fc0363310a721ae1d3f6e2397d268b880a89a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259420, "uuid": "1e90a8e1-6003-4009-9c1a-2b630b7b30dd", "comment": "Malware payload (Dridex)", "value": "0625ffe208d11350d72b0dab9b316304ebe02a57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259420, "uuid": "c18dd751-6e47-48ba-90ac-96d07eff85c3", "comment": "Malware payload (Dridex)", "value": "b886867168161ef158c32e1788058104d1729c13500dbc77ebb0b2559cf82c9165f3890d7ca0ef7dbddb26fa5fd1c657", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259420, "uuid": "fbc179ad-0e9f-4828-b3d2-8299bc34ebf1", "value": "B914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259420, "uuid": "873a1ea7-92ee-4de0-bafc-6eb3f6c2deb5", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259420, "uuid": "3492d1bc-7117-412a-9ffd-b5c60a170b16", "value": "3072:yopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:FpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259420, "uuid": "8064ac43-5768-4c69-96e8-83db821739d5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259420, "uuid": "60364a74-3e50-4aeb-883e-b15c752c2855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259420, "uuid": "3589510b-250a-4de3-80a1-1fe9a71d5ff9", "value": "c142de2246a16455225918d2f6aa28a2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cb4a25-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276601, "uuid": "4fd2b1da-56e1-4300-8626-1f47c9ee51a4", "comment": "Malware payload (IcedID)", "value": "7db35f24aa030cba3e4573a7b0e1fc9c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276601, "uuid": "45329ed5-6621-4551-a48e-2848a36c4e45", "comment": "Malware payload (IcedID)", "value": "137477d475fd3130bb1260e0cd86c61177f1a71c4111a58af3e4c378b1c165e1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276601, "uuid": "70826dfe-2867-4bcd-b86f-70f670defb75", "comment": "Malware payload (IcedID)", "value": "48bc9920881cb4b6550fc618694de6c94dfb13d9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276601, "uuid": "6cc82d27-8215-4b61-a622-d97ace913981", "comment": "Malware payload (IcedID)", "value": "cee264b9c7de360878b596dc182016c3e3dd1be7c412c487e3a8b2829e1aa865e8005269de31ca1e44138d34c5de137f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276601, "uuid": "f83809e3-bbec-4b8a-84ca-ac42cf23c3df", "value": "1F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276601, "uuid": "1885b253-5fb1-4260-8152-959c67bc8450", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276601, "uuid": "1ad0a887-00da-4da8-9022-12a618aa1c6c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276601, "uuid": "ba47a218-417c-4351-92dc-71e05f308fca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276601, "uuid": "cd903d35-5098-4d3d-a0b9-56fdf6a490a2", "value": "document-1197793284.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d380fcd1-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617290443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290443, "uuid": "182bd6cb-6d6c-43a2-a599-be1702597214", "comment": "Malware payload (IcedID)", "value": "6ee49b76455e0fc834f4d1c48fcfebb5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290443, "uuid": "7b5aad35-ad7a-4561-b2a7-5bcdf5504467", "comment": "Malware payload (IcedID)", "value": "137537fa5dc5e58c8d355d1892827d8911d3763d604a39a1e8c38e789a3f71af", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290443, "uuid": "41e9ef90-4f10-4ee6-a90d-586b88dfbfda", "comment": "Malware payload (IcedID)", "value": "4810b92776aa00b280d4f07280f263defc78d3ca", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290443, "uuid": "391d4b87-a4eb-4735-af74-4adcb3a8561b", "comment": "Malware payload (IcedID)", "value": "a1bea2a7e55e3ac3c46a1a2f7c8b85584d2a209334f38451feb06ad5f657f74797a3bf6eac52091933a9ec41ab0cdeb7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290443, "uuid": "49760446-508c-4c6a-b322-70eb1df12925", "value": "03838DCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EAA2E0D42FA40A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290443, "uuid": "ab07ab41-a255-4063-bc09-5757fa4af874", "value": "1536:IB240XZfcaaxf+EQliU2haw8pCAIoo8+BNvMhfv5:+2d1cBWEQXM8p9o8+nEhH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290443, "uuid": "e6bdad9f-865f-41a5-bdc3-2e96b219fb05", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290443, "uuid": "5491432a-33fc-4821-95d8-9aba99d2218a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290443, "uuid": "536f4bb8-a479-4d4f-a5be-0a0c5bbe51f1", "value": "212.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0488eda-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288264, "uuid": "79910951-bf77-4a92-88fe-1cf439a4c98f", "comment": "Malware payload (IcedID)", "value": "3c22aef23b09d9766cbdcce82872b279", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "unknown_maldoc", "colour": "#173517", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288264, "uuid": "ef68705d-7c0d-470e-b9d8-6cbaaabb1a73", "comment": "Malware payload (IcedID)", "value": "137fbaa8e83c5860f47a9255c6fed3a2de1c3426b0929feaeecee90f27c3e6a2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "unknown_maldoc", "colour": "#173517", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288264, "uuid": "ce8007fa-679a-446d-b8a2-5e837dad2d22", "comment": "Malware payload (IcedID)", "value": "5e39e48ab22537dcc29c9d10a62298c09ce635b9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "unknown_maldoc", "colour": "#173517", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288264, "uuid": "d8cf66ac-a31f-4c2c-a1fb-74c13c34da0c", "comment": "Malware payload (IcedID)", "value": "9367f7692870592943b7043480b7181ada92354897cfd886ebf2c8fed757a1a0b55c9d08364476d00ae09cef9d75e6a7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "unknown_maldoc", "colour": "#173517", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288264, "uuid": "ba1eebf9-8688-4ddd-8228-c5c593f36665", "value": "AF04123CD06A5C68C2A6543FDC1CC1956C197026ECF8E5AE6688B588BA636F30F5FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288264, "uuid": "426b6387-22c8-4307-8282-caee5027fff5", "value": "3072:AxXvXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGAy:AxXPE5SDvbXAyHbVt15wTQDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288264, "uuid": "266a2abb-8e66-45ae-81db-19a81bffae75", "value": 180376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288264, "uuid": "b2e1161f-60d9-43f8-a69f-e5416176e7c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288264, "uuid": "b4c08fe7-164b-4dc2-af01-2b423f25429d", "value": "Indebtedness-1342425612-03312021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dee317f-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281710, "uuid": "0028c46e-a03e-4eb4-8b05-9f046e91f7f9", "comment": "Malware payload (IcedID)", "value": "ef39991654a3a85240bdb80a3cee4589", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281710, "uuid": "9e841e15-9008-4a24-b902-2c22bf595c29", "comment": "Malware payload (IcedID)", "value": "13a27fbf17910e28cc4b424fd376a86381ef1d7bb36f4df7c141e6758e8b20f7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281710, "uuid": "a06e84de-f55c-4850-ad5f-670927bc2162", "comment": "Malware payload (IcedID)", "value": "95e68355724969617ca0c3ce36367988bcdacc41", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281710, "uuid": "e8f3ff97-a194-45d8-aed2-335373eb0697", "comment": "Malware payload (IcedID)", "value": "3dda93a0981268b2a7f3ddabef0b0ef1f619a0a487bc5c50dde969e0727def727b8465948502342b92c66b52fc817958", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281710, "uuid": "961d97b3-5060-48c6-a1c0-4ecefd988711", "value": "62044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281710, "uuid": "f7f9b58d-2b0b-46ad-9aea-a3000e8028b0", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281710, "uuid": "1e55b8bb-ca86-4319-9241-bd4b51915ae0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281710, "uuid": "e5401387-6b8c-479e-8fb5-4a113a554c17", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281710, "uuid": "5e160434-2708-4727-bd2f-433f475ce9e9", "value": "document-986812161.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a191ea-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286155, "uuid": "cb9fdfc8-f448-4ef8-b4e5-e38080fe6cd1", "comment": "Malware payload (IcedID)", "value": "6ab39105bdbb11d2e3171d273c43063e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286155, "uuid": "39738bd6-a233-4108-a088-fa2c6e6c3ab4", "comment": "Malware payload (IcedID)", "value": "13c241709bdc42dbc770bc5e1cc2db9f041e2288b0e059509d7af03d489cd880", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286155, "uuid": "4aca8404-8c1f-411d-a207-f0fc6722f417", "comment": "Malware payload (IcedID)", "value": "5d1d6e05cd98b29b702ac3d98ed8ab7ef40f66fd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286155, "uuid": "efea2b51-1292-4e28-8ab2-54349e3b3669", "comment": "Malware payload (IcedID)", "value": "efebad9b855b7b820405278add905724b21350c47d4be9add69c434d7b6954a46f31f83e0d26ebb28a7e1e106c97e76c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286155, "uuid": "5bbfccb4-e80c-4cff-ad57-f1e5493092a8", "value": "47838DCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EAA2E4D42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286155, "uuid": "8ce91a76-bfb2-4e86-9df3-d752b537f4cb", "value": "1536:IB240XZfcaaxf+EQliU2hawoCAIoo8+BNvMhfvWe:+2d1cBWEQXMo9o8+nEhHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286155, "uuid": "356a81f8-f459-4918-b295-2172ea7c2f09", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286155, "uuid": "3e476b84-a7fe-4c5d-88b6-e64b73844cce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286155, "uuid": "c9f00d75-ab43-4879-ace8-ceed31507266", "value": "3123.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28cc7a0-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280912, "uuid": "56c58d26-597a-4d52-abe1-b149fd0865af", "comment": "Malware payload (IcedID)", "value": "61ddfca559b5a1fbcb679ae9b7c5b82a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280912, "uuid": "467fea27-84ad-4f8c-8a23-8921ca8f3df8", "comment": "Malware payload (IcedID)", "value": "13d939a7793439d8081c82e0055d30c293fa0d38c437e89eadace0b0c065fa5c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280912, "uuid": "172f6569-05b8-4d78-845b-5880252957ae", "comment": "Malware payload (IcedID)", "value": "aaae4ee14adda9c0c4f059c6b1243f3ea38f7b82", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280912, "uuid": "06b6fd37-32bc-4b04-987d-018485c127ae", "comment": "Malware payload (IcedID)", "value": "b3714996ec435b1eaf613e3e79a265ae35ae2300de7f4ec8549498b3cbae923382586a2bc3633cdcbada084ad75ac31b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280912, "uuid": "e91d62ae-551d-4571-b0a5-d7d30f16c177", "value": "D4044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280912, "uuid": "cb57226c-0560-4273-b8af-23dbab59dbd3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280912, "uuid": "b206bd3b-22cd-49db-97ae-f6daa212e94b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280912, "uuid": "013000bf-0371-4813-9817-016895a906fb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280912, "uuid": "db01c8b3-1fd0-4d7c-b1de-2e6f9f9bdd4e", "value": "document-1822768538.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4733ed6e-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274746, "uuid": "4859af22-751d-4269-b3dd-f6c6c04845fe", "comment": "Malware payload (IcedID)", "value": "a432dd8f4ab5d483201e89c6ee3458d9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274746, "uuid": "fcbd36c3-ed0f-4c2e-86fb-8cae8f209441", "comment": "Malware payload (IcedID)", "value": "14066c1cae9c68445dfd40b807b3ee6e6b390269df88bbfc39107bb701ed24d1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274746, "uuid": "934743b6-a933-4736-b594-fdba05e098f5", "comment": "Malware payload (IcedID)", "value": "62c0ff3cec99f6bfce32c218868c137218484629", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274746, "uuid": "fb31b26b-ce91-454c-8cda-0688bf4a1109", "comment": "Malware payload (IcedID)", "value": "53b4b792a4862112a75d5f458c687998dd82defc9eb5a6a7c2e10611ddaca30a34a7ce5afb0d5e711a138777e67f1100", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274746, "uuid": "02f9927f-d995-48ed-b39d-1e00689c0755", "value": "A0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274746, "uuid": "f3942c33-2ce9-4e1f-bab4-35934ac173f5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274746, "uuid": "2d6cf896-9180-41b9-9f33-c2bf29adcb16", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274746, "uuid": "69406b9a-0e39-4b04-a506-33f2cb4471dd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274746, "uuid": "2dcc32de-0cef-4062-aaec-e3e42d6d3757", "value": "document-1790074759.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c543493-9318-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617301867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301867, "uuid": "2e884c2e-a6b1-4946-a949-819ae20a48c9", "comment": "Malware payload (IcedID)", "value": "2d26d8d47581bcdf0008798c5650df5d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301867, "uuid": "d7ad55d4-25c3-463e-82cd-b1602807a0a2", "comment": "Malware payload (IcedID)", "value": "145440a7c1067bacfcd4d07078040b67c3753e589501bf6f78b970e72c450653", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301867, "uuid": "4bd0cdf6-d041-4e89-b28e-211521db9616", "comment": "Malware payload (IcedID)", "value": "756c08c5b9622f1faa5c089296379ea5cdcb6e83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301867, "uuid": "3a5515c3-9e0c-4e46-9690-bdadec16ffca", "comment": "Malware payload (IcedID)", "value": "c64025397f16f818d75be13bb32c74f0bc71186604344b2a23056fec8c3f4199c7e793c9eae6a8bfff8557a2b1226237", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301867, "uuid": "f3f5a156-0144-4f69-b1d3-1b4fbbb9202b", "value": "CF1408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301867, "uuid": "7b295c22-6ac0-4c8e-adc1-91f42479c056", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301867, "uuid": "91a80ff4-495c-443a-abff-7ececf6c1eb6", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617301867, "uuid": "cc2e124d-4f01-4820-a1e6-22dda10037bc", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617301867, "uuid": "0d6f68f4-8184-4104-a5e3-8aa3a9756527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301867, "uuid": "55cca95a-8839-43ef-9a3b-1135586f8499", "value": "145440a7c1067bacfcd4d07078040b67c3753e589501b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359cc22c-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279011, "uuid": "44fc9dd6-731f-4d20-b2a9-575809490c6e", "comment": "Malware payload (IcedID)", "value": "431ff16f8687b4ad351360cbb70f602e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279011, "uuid": "3d9a4237-dda8-422f-9684-f94e51e7f12b", "comment": "Malware payload (IcedID)", "value": "1462f1569970e8fa9d2a91d33270a28a6a8f1d29810ad7328d7982e7e42050ac", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279011, "uuid": "50360bac-da32-47d4-8494-d15dd9777a05", "comment": "Malware payload (IcedID)", "value": "ee0ad24c0894a91e6e08badf4efe20ca7135a39a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279011, "uuid": "5699375b-b05d-48db-a642-9ac3e9c9b310", "comment": "Malware payload (IcedID)", "value": "df8a8638146fc49542454ddd8a9e8dc2bf4059b0ea31f15c364dec093e7b1780f528e2679ad9fc5b40486934ba9f6064", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279011, "uuid": "44f09599-2067-43f3-bcba-cdda29e0dea7", "value": "72044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279011, "uuid": "4ce3a4af-3474-464a-83a9-b61b6e5ecd58", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279011, "uuid": "c531e305-4f52-444a-8fbf-464e7b466d3e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279011, "uuid": "42abde2d-fc72-4d62-88af-a64d775e3351", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279011, "uuid": "539049ea-9b76-4654-9c07-c68d3ebc0f28", "value": "document-1127829005.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897c97b4-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284306, "uuid": "70339518-ce5c-4ece-8b68-09b5386fb322", "comment": "Malware payload (IcedID)", "value": "e0dcfee1c0ac809a32ae66737e15169f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284306, "uuid": "845d42b6-04bb-4c64-a1f2-c34dfd818613", "comment": "Malware payload (IcedID)", "value": "1480906ff02e031a7c9f80492b6d6ce92b76c01e95fb25eb526da7eeb1508e12", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284306, "uuid": "b5063b33-4583-440e-84b3-db0a3c3ea977", "comment": "Malware payload (IcedID)", "value": "7c53dd048278d9bbe72ccc4a05f79f9986e04e1c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284306, "uuid": "c2ff2966-98e4-46a5-bae6-01e29d84d52c", "comment": "Malware payload (IcedID)", "value": "95b8328fdf11feacc0e0564d933fbb596ad6150172d6e724cdf6ab948774d5c4e89fdf651fcbbe9d9bff18cff2de1c29", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284306, "uuid": "91a95c75-0d3a-4dd2-876b-7a2d17ae9911", "value": "89044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284306, "uuid": "5f76064a-8430-4ac2-b116-5955ccad9521", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284306, "uuid": "de2816ea-9b8c-4013-8405-609477347a41", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284306, "uuid": "d230767c-771b-4af3-9030-50552faa6616", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284306, "uuid": "67751a68-cbf5-4dbf-877e-6dfcae326b42", "value": "document-1782854025.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c7641a-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274366, "uuid": "0c81b8fe-f6cd-4e0a-8ff2-bb3e51c1ede9", "comment": "Malware payload (IcedID)", "value": "481ff9ba287870056da3dcac059e2a80", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274366, "uuid": "e69acee6-1c6b-40d5-a35b-fb1d81462422", "comment": "Malware payload (IcedID)", "value": "148ba25e767edc512ce5505b6edde48a2eb789c4361b4d4b6aaa55f0c8f758e2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274366, "uuid": "c9579477-ce78-4f96-999f-6462a946f95b", "comment": "Malware payload (IcedID)", "value": "7099166c9f0a8f135c5fa26c7fa3981f87706a4e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274366, "uuid": "2a1e04ee-03df-4ede-b652-c6765913b967", "comment": "Malware payload (IcedID)", "value": "2af1f515f73d17ae2b2f4a4be28d026971e6b0b6a77e9da9915092fe7fece49a774170b6a54e5683fe773d7f25117aff", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274366, "uuid": "1d458721-4fae-474a-b0f3-b81d9ff9488d", "value": "62044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274366, "uuid": "03a5698d-50ba-45de-b253-a58a8305023c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274366, "uuid": "a61f391f-f5e4-4313-a4f2-4861b991a5aa", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274366, "uuid": "6fbaf9f4-7df7-4e9a-9eaf-2b98bc28fd85", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274366, "uuid": "c11080e3-e562-407e-a7a9-a26d71de816b", "value": "document-418845275.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e18f46-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275309, "uuid": "5c72c629-ba09-464b-9d5e-5aa9490a9d32", "comment": "Malware payload (IcedID)", "value": "69b2d9b7a7669cbcffd1e5aab2623e68", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275309, "uuid": "354293ed-40be-438a-8ec8-8e3f1bdd829d", "comment": "Malware payload (IcedID)", "value": "1496efc80ab433967382e13eea7a51a58010d2cc268b2aa93500973140712776", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275309, "uuid": "327bf0b2-971a-4c1f-9d54-7a2ee0a41f8c", "comment": "Malware payload (IcedID)", "value": "d2c4090cee0ef632d5c46fda5d1c3f670aa17f79", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275309, "uuid": "eeb97876-2ea4-45bc-a211-3b1e493710bb", "comment": "Malware payload (IcedID)", "value": "f33977849af86d165710554d02dd96671664fa277f2f498bccf1e5906ac8847e43705fd238f784d7952005de121a2571", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275309, "uuid": "d3a50966-dba1-4ac0-83f1-a576e1cd0656", "value": "FE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275309, "uuid": "c6f778db-e813-4cd8-b370-27ef4a13c52a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275309, "uuid": "06fde200-32ac-4bc0-af1a-8521b87c237b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275309, "uuid": "30261eb8-2246-4360-926a-1c0b55d297d3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275309, "uuid": "5f3f7fdb-83d2-4a07-b15d-e58c73f5c408", "value": "document-35357060.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f667a05-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276612, "uuid": "36e3aa9c-6833-474c-ba4a-44a3dee21085", "comment": "Malware payload (IcedID)", "value": "847b3cbb2f0cf8703aa793a4774def5c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276612, "uuid": "e07e0f44-c4f9-4c6a-9451-48cef30d963a", "comment": "Malware payload (IcedID)", "value": "14c0423be710f665b25a8b501514d0dc5ce1d27983fdc8e5e1fae4adce2f6f43", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276612, "uuid": "6d302607-8291-4a08-9b9a-a63e43f9ba06", "comment": "Malware payload (IcedID)", "value": "a36837df9cfaa88c12d3616f4accd59d16ecd904", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276612, "uuid": "6b2ecccf-c33b-4a68-8527-391bc81710da", "comment": "Malware payload (IcedID)", "value": "32558509443ec43d70a6eed072b006317559fc3432d86bda117066dc26cd1fe60225d05481aabfa0fab41c89143f124b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276612, "uuid": "de75dc61-0dfe-48e0-aa70-b0da099cfd09", "value": "90044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276612, "uuid": "aed94d91-a4d0-4082-ae9e-625b9f9abbf6", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276612, "uuid": "b324e973-b256-414a-aef1-87ef8cd9adee", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276612, "uuid": "6bd6114d-b7a4-441c-b253-0459b247cac9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276612, "uuid": "86e4cbbc-27e3-4886-a33d-28891afb4d9c", "value": "document-610507074.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476061e1-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278182, "uuid": "3f662ef1-1639-4bc1-8584-6a301810b45d", "comment": "Malware payload (IcedID)", "value": "3fbbb242bbf1ca3f81fb36ef1a1205e4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278182, "uuid": "e7077340-654f-4ae6-bebf-eff62e83ef69", "comment": "Malware payload (IcedID)", "value": "14c0a9158893519aa677588b5163186fc223de9b9efa4cccf1740066e287e76f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278182, "uuid": "9ca4e07f-ff4e-4d86-99b1-71e3d89281ef", "comment": "Malware payload (IcedID)", "value": "5d834b435ad6b2664fd3937031afc839aebc3713", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278182, "uuid": "8ab219dc-ce12-4845-b2f3-5de1b29d855c", "comment": "Malware payload (IcedID)", "value": "cd9fd99cab80aad4481760b90d17b72e0f40f41b243e857407fd872534ff7f8949f208613fddfd469cdb7b0e71cf12ba", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278182, "uuid": "e22cb379-c2c9-4a01-b2a3-48002b4e5f54", "value": "C4044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278182, "uuid": "77210516-2b56-49a3-9976-3b867654e031", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278182, "uuid": "86fc7f24-f77e-4c31-87b0-1484122e6c9d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278182, "uuid": "993d76cb-4605-4988-ae00-fce8e13ee709", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278182, "uuid": "b584a415-a0b1-4db6-b1ac-b57257322f09", "value": "document-44815407.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec6d7e1-92fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289764, "uuid": "2bbc33b2-7986-41e0-9fe2-1fb87fe7eb31", "comment": "Malware payload (IcedID)", "value": "0f0d5f3b6854b3ca7608d5973e8ec7b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289764, "uuid": "32b063c4-2144-4788-9a4e-0a2d7ec40a50", "comment": "Malware payload (IcedID)", "value": "14ce0cfc21bae66f67e0f73ac2aabd673dc9810508a6945c180eb4c9208ef7da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289764, "uuid": "cd86b0c1-0e82-4ff0-beb4-e3a644f5aa42", "comment": "Malware payload (IcedID)", "value": "31baf82c5bc36e69c9c7a569495d7b126b60a8ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289764, "uuid": "b29f570f-72aa-477d-898c-2c081d5ef628", "comment": "Malware payload (IcedID)", "value": "88080da807c3dcad3356b5cd277afd4c8b21a3aa047ab85488a6f2de4d15363626998936b3c734a625202956324fb637", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289764, "uuid": "368b8775-ee63-40e4-bb58-1649b6ba2934", "value": "2744C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289764, "uuid": "25772797-9fd6-433d-874c-fec0e5498bd6", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289764, "uuid": "fa0b6696-b5d9-4f14-a7f0-18ae3031b485", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289764, "uuid": "26b577e2-2f9d-4df2-9805-e25583e3f305", "value": 266927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289764, "uuid": "e7dc6adb-9f46-49d8-9ad1-510f83dc9bbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289764, "uuid": "08b6fdab-6366-4626-90af-915c506dea47", "value": "0f0d5f3b6854b3ca7608d5973e8ec7b1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ea7590-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285891, "uuid": "3681b250-8072-4222-941b-59a6a5261da7", "comment": "Malware payload (IcedID)", "value": "5d20ec1f69d132589243bfe873485695", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285891, "uuid": "6a209ef0-de64-4204-aff3-e1e535e9c231", "comment": "Malware payload (IcedID)", "value": "14e18ad0af3241869d493d56bd42b63f00b21219820c98fd3d7cb5f7f6154aa9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285891, "uuid": "29362033-ad18-4199-91bf-93f8ff8b1383", "comment": "Malware payload (IcedID)", "value": "6f130313a2924b4f4337563e799969652f227341", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285891, "uuid": "aed63972-2894-4ce9-9cd6-cdf2706e44d5", "comment": "Malware payload (IcedID)", "value": "37781f818028e9f89107b7b43a00d8d59a940729dbe035033f3d135c4e9f408d02ab27459eec621d6904cfeb8b6152bb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285891, "uuid": "c572b996-b8b1-4c28-b90c-1ac9cc61ac09", "value": "48838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B108EAA2E0C42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285891, "uuid": "03999d03-67bf-4c49-aea3-01bd4ea50f5b", "value": "1536:IB240XZfcaaxf+EQliU2hawNCAIoo8+BNvMhfvxu:+2d1cBWEQXMN9o8+nEhHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285891, "uuid": "79b21c32-65a1-4214-b10e-90dfc3509ede", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285891, "uuid": "4bad839a-0ac7-43bd-8154-76af9c1993ae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285891, "uuid": "b0dc6c35-5587-4f72-9949-3567b42aa313", "value": "168.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574c52f4-931b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617303120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303120, "uuid": "cee287e3-c465-45a4-b7d8-d157fd7188a5", "comment": "Malware payload (Dridex)", "value": "781e721f334b7ebe4e52a988c14a7f0e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303120, "uuid": "5625a279-7824-440b-a832-bdd97b949bd7", "comment": "Malware payload (Dridex)", "value": "14f7b90fbd29ce39af3f4bfa5d6c7c839b440f6b3a0585648c3a00ec51f3da8e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303120, "uuid": "359b37de-ba87-4442-8236-89815c22dc82", "comment": "Malware payload (Dridex)", "value": "286fc94fec69dc4cb5f51f88b742f8d05c853369", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303120, "uuid": "d1cad6a7-1afa-4c10-b4dc-1663afeef6ff", "comment": "Malware payload (Dridex)", "value": "93a312de726578288e7af6412221e4e3e12cb0e5b5a4d6de47fb3b3db844d40195d31deff22b3651a177f299ff25c27e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303120, "uuid": "80967f61-091a-4d06-b8c1-ac4ab82e6bc6", "value": "3F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303120, "uuid": "2658f289-4355-466f-a92a-396a0529f50e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303120, "uuid": "e42097cb-f906-467e-977b-dbaba3933fab", "value": "3072:Sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:lpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617303120, "uuid": "88ad683a-4b73-4c9a-b72c-7ab2b11d59bd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617303120, "uuid": "a6a9e3cf-ac96-46b3-bf57-4a8e70507c12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303120, "uuid": "c7234322-e630-4e67-8495-025ce8d4c3de", "value": "14f7b90fbd29ce39af3f4bfa5d6c7c839b440f6b3a0585648c3a00ec51f3da8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d701b211-928b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617241487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241487, "uuid": "8945227a-6d37-4e34-84b2-57a73326e606", "comment": "Malware payload", "value": "66c0dffd8141ba191fed05a522aaed93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241487, "uuid": "74d9cb1a-7046-4fe9-bfc8-930fd7184daf", "comment": "Malware payload", "value": "14fbe92c2bbdff24df2bc9d10748974399956baca08ed8206f33295290951b60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241487, "uuid": "f7c08657-f881-45d5-aad6-d26b064b6475", "comment": "Malware payload", "value": "e2d2dba846dd9df8be11416bc22aed721b51500b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241487, "uuid": "e5c7d493-fbb9-46d2-ab41-be3ec4f8eba5", "comment": "Malware payload", "value": "be69a54d8c548260669321ae710231b0df8076012bbaf3bc53e46a7242b21ff79f08820d01348e59701722279b1aa5f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241487, "uuid": "6ba480c1-93c6-467a-9aec-df9636442c13", "value": "F5C35C577712CFA2D2ADC23009B7C59997E517A622D1E46AB22CDB1C6E3435C2C2FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241487, "uuid": "4c4a784d-e652-40fb-9416-465bf5851386", "value": "1536:Rw5T0YQYPYEfus0/9J6DA1bIJAu9u8i+Sr7hYY8GYFpVbgOK7kcwbF92V2EU+tq3:RwN0Efblu5/8LNbgf7kcwbyDDtqRJjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617241487, "uuid": "9ca9dc81-91a0-4b5d-96fc-d3fe7b8f9427", "value": 121016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617241487, "uuid": "0241b0b5-1e6c-4aa6-ad95-4d6f50247a09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241487, "uuid": "2047dc2f-9a78-48b9-bbd7-4fbd4b62039f", "value": "dmb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40427fab-9317-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617301363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301363, "uuid": "66616f5b-0235-4ad7-b74a-158f539fb81b", "comment": "Malware payload (IcedID)", "value": "910a164605f2dfc06117a9d013913c81", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301363, "uuid": "34c5201e-e80a-4b49-8126-ad2fe472c013", "comment": "Malware payload (IcedID)", "value": "1510e8ee68ab3a2435d8b30f2749e4e7217c466599dd982591a91142f90c6870", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301363, "uuid": "903e2a67-2cb1-403b-8447-8013deddfca9", "comment": "Malware payload (IcedID)", "value": "f298cb07bb10f5fb282aaf8af1d9b8b06f462933", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301363, "uuid": "ac9becec-e958-4606-b550-b407c6bda2c2", "comment": "Malware payload (IcedID)", "value": "7498bde09eb9936ab04b8baa7fc8ceffdd07649497cb5f4f351aec6e08e6a59fde954ee0df32b2756324badcf8ffed24", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301363, "uuid": "6d0a49c8-2ce2-41b9-b16e-6617f9a1d86a", "value": "6604123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301363, "uuid": "dceebe4b-9729-4b00-97f9-943c76a70bc4", "value": "3072:tXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:xE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617301363, "uuid": "fbc7c465-3820-4df6-ae83-d843fcfe1270", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617301363, "uuid": "6c38b7f2-1af9-452f-ac1f-7020d7f8c831", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301363, "uuid": "321d0bb0-4730-417c-8e74-6abfa6c7b323", "value": "91951156645-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ed7c85-930a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295678, "uuid": "df7245f3-eb10-4665-b886-ddfa25f4599d", "comment": "Malware payload (IcedID)", "value": "e3d0cb6ef31e4d445dcf61ba9de01808", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295678, "uuid": "bd91fced-7386-42f5-8178-07d7f92393f9", "comment": "Malware payload (IcedID)", "value": "154a4a4f4963b7be842eb58a4e1da1400fc1d63ddfa27f081f392a38b881571d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295678, "uuid": "b9bc7818-7f09-4bda-a54e-1acedcc51e55", "comment": "Malware payload (IcedID)", "value": "6f01ea75dcb1a38fa40089f4ff6e8920bdec9563", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295678, "uuid": "1aee2350-1a21-43ce-b5f5-b790567599d0", "comment": "Malware payload (IcedID)", "value": "3a37a6eab48f25026c1b0ac7c9f6f016e896d413565a2445f09fb96b4ab19d2eedbf4a70259fbcd63e5d240c2b3eafdc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295678, "uuid": "47edbe48-864a-4ced-a2da-6c9f02c1e7aa", "value": "0C34C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295678, "uuid": "31189843-53da-4fb0-9d8d-7f3f08c9573b", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295678, "uuid": "582809af-0633-439d-a1c4-44e19dd95cb3", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295678, "uuid": "3e5a03cb-dd94-4930-b239-ccf3c7404395", "value": 235949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295678, "uuid": "44609239-cfc3-49af-bd32-c53890cacf3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295678, "uuid": "5f0130ed-3533-4fd8-a4c9-dba7af50b282", "value": "e3d0cb6ef31e4d445dcf61ba9de01808.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904bc965-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276587, "uuid": "810f1ddd-dd25-43bd-b93f-74f8c2593c3d", "comment": "Malware payload (IcedID)", "value": "55804b05c719c83f36dc0447c6902e42", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276587, "uuid": "d0af73c2-1640-44da-9565-42e3ec4369b8", "comment": "Malware payload (IcedID)", "value": "164ad53a746899d453a7a8d5cec418bfdc47e8b9eef7e3d535833b80476d1593", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276587, "uuid": "416d19ad-2389-41c8-b7d5-a1dfa47b5d32", "comment": "Malware payload (IcedID)", "value": "05aa5e6d025730927e251edaf0d5d75090f18261", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276587, "uuid": "2e806692-aa7a-4106-ac81-50e4f3e4e406", "comment": "Malware payload (IcedID)", "value": "901491d2e4906bbddccd2a2ff6c024fd2e18725d954da27e60e5595d16f14d48fc9c72aef69563f70b205315e89e871f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276587, "uuid": "b62c59fa-aa82-45c3-8726-4d095c3fb135", "value": "11044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276587, "uuid": "b45cbc51-ace9-461f-9d80-339786d43930", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276587, "uuid": "46261afc-2eb1-45fb-8de2-0118fc6c1421", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276587, "uuid": "56bb46f4-7f34-49e4-95ff-4ecc1b729a0b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276587, "uuid": "531ad88e-b63a-441b-9113-a2cffea4c089", "value": "document-362799258.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c977f8f-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617282862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282862, "uuid": "2c277ff0-9cbd-4807-82fb-95f358120a1c", "comment": "Malware payload", "value": "e477a96c8f2b18d6b5c27bde49c990bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282862, "uuid": "596a8c72-09a4-4d88-8ba9-e050e6dc115c", "comment": "Malware payload", "value": "16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282862, "uuid": "10caa56b-cd24-4355-9e21-31bd250193a5", "comment": "Malware payload", "value": "e980c9bf41330d1e5bd04556db4646a0210f7409", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282862, "uuid": "26503835-2807-4b6f-a978-9f7edc59ffa5", "comment": "Malware payload", "value": "fa3b108d5785969f49fc23fe1aa8e241f7db71ad286ebc9a53f31eea9d37e049b6e84e8cd345ae3dc8b74c6c0b7bc4e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282862, "uuid": "06166371-8dfe-48d4-8c07-ed6d937337af", "value": "4DD46D44D613D877EC4302B9A647F35B112AEA20D437CFCBA6D82E65DDB39E15A0A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282862, "uuid": "d3693534-b862-42a8-8ace-1f05c6d90bb7", "value": "12baaaec299bc9ff52d20c16e4d0e96a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282862, "uuid": "f8f1fb76-68b9-4e94-b757-b555e71d0003", "value": "12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282862, "uuid": "eb8d1d15-8470-4b85-98ca-c88e3405a4a2", "value": 645592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282862, "uuid": "5de9b6d6-cbb2-41c3-a071-520e9daa9014", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282862, "uuid": "cddc38ac-20ab-4189-924f-4ab4a3bfa74b", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20574f1f-92b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1617258789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258789, "uuid": "841b9340-683b-4117-9265-eb6687ef8b62", "comment": "Malware payload (Smoke Loader)", "value": "3dad2115d11934feab14efcccf10eb6f", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258789, "uuid": "28b6ef0d-ee30-4d57-9b90-06b8c29aae8d", "comment": "Malware payload (Smoke Loader)", "value": "168eada700bc85528f3405b7f4c72c9d565cc28d90e40b05d429c59a2625dd8c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258789, "uuid": "21794c5d-3b8b-4976-ae2e-26d3b888d6f2", "comment": "Malware payload (Smoke Loader)", "value": "2b52abb4fa520dae9ddde5ff4dc2da4f8ad58a05", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258789, "uuid": "0a976c1b-1a1c-463f-9031-6bf40601fd8a", "comment": "Malware payload (Smoke Loader)", "value": "cdbe3819c51ef2978b092e76d23285b8c9c22742bfc9120940a8c6fd6bdfd06f9b68d7221ce8b4ee46be9b9c1436e140", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258789, "uuid": "c6a0ba72-b6ea-4eda-8ff8-96d366c430bb", "value": "02049D00B6D5C073D2520A750821D6B5493AFCB65F34A6CB3BD53F7A5E362E18A3A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258789, "uuid": "7bbd170b-f996-49e4-adce-35e218c830d5", "value": "bf00cd32fb07f9ece1c23ad1ece9b809", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258789, "uuid": "fca1315e-ad4a-45fc-a3cf-11a11b4724fc", "value": "3072:nJh9qxgcuOxAsZWL/MLt48jauhDeVB/7Gp7ZX82i:r9iUOCIL28UkptXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258789, "uuid": "f11ec5ed-3a7d-4e67-a8f5-e76f413a934f", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258789, "uuid": "4eace644-f57b-4795-a373-7d072bbc4c95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258789, "uuid": "3085f4bc-aea1-439e-a13b-18cee9db11d5", "value": "3dad2115d11934feab14efcccf10eb6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49dfcb19-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279904, "uuid": "4e272b01-0d0a-4538-8445-c1b7f6062b57", "comment": "Malware payload (IcedID)", "value": "223230b1e2ffd716654e5a953b924417", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279904, "uuid": "6bf82c66-c4ee-44ac-9bcc-ccb018cfa290", "comment": "Malware payload (IcedID)", "value": "16abfc3d767fa7bfbc0081945d6d7acaf3a80b393eb241a187c14de7958d6ccd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279904, "uuid": "d6256335-5201-4f09-a6e2-051cc2cc8eac", "comment": "Malware payload (IcedID)", "value": "344999d4554ef01b8c51596f7f9acb8f955a21f9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279904, "uuid": "ccc78672-6965-4ada-9a7d-d7439ae568f1", "comment": "Malware payload (IcedID)", "value": "61b45010cfb30b1cd6596ebcc1ffe618375b4ab4c63748a8ca0cf41706fcfa5c723d20967e2f08a32b492125c2a82608", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279904, "uuid": "f257ec8a-a982-4523-a90d-8b0311b017ca", "value": "BB044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279904, "uuid": "5f0dffb6-95ab-483a-b55c-e29807d3864b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279904, "uuid": "cc92ca4d-d8b1-4f63-a11a-f01145267ea1", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279904, "uuid": "0f53f486-aa7d-4d20-969b-926e08fe10b3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279904, "uuid": "c1c7beb5-99a7-46bb-8c8b-42a6cabbf215", "value": "document-1201008736.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a047cf6-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274375, "uuid": "8819acf3-e6d2-4730-9e69-1255407f4ff6", "comment": "Malware payload (IcedID)", "value": "9cfb10087b982dcdfaff5d4ede97768e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274375, "uuid": "abfd1e49-b315-4e57-826a-d556c392a79f", "comment": "Malware payload (IcedID)", "value": "172c7e54d9614c1d6cee01e0ce611af8201ca9bff0e130af951f6bceabec1589", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274375, "uuid": "e7a1fbc4-3018-4be8-825a-08f345313b7f", "comment": "Malware payload (IcedID)", "value": "3d04116f2e0e52929e8fdfc9ec96d4dd40ae91e9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274375, "uuid": "073530b0-75c1-4ac9-a04e-8abe2aad29af", "comment": "Malware payload (IcedID)", "value": "27b251a1025a86f092882feff9c2d6da858c887bf511760a1b1878e1a6d74ba0e678e61ba780f4ab7db6e9d2d1bf2299", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274375, "uuid": "311a0f7b-1a0a-4ec2-9ec2-cf8a38529c63", "value": "B9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274375, "uuid": "fa86dfda-223d-49a6-b9de-149db214500b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274375, "uuid": "a697bfa7-575e-4da4-b111-9be6b62d515c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274375, "uuid": "437668a4-d979-4fae-a070-854ed356cf60", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274375, "uuid": "d090ff18-5498-42d5-97ae-8ecec27e0cec", "value": "document-347722748.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7e0d75-92f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617285068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285068, "uuid": "81e251d7-0c49-490c-bf74-0d79745592d6", "comment": "Malware payload (Gozi)", "value": "4a130791b424df68cc4063e1fe7e09a5", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285068, "uuid": "d4fa679d-47af-4698-ad62-757bcb23ffbf", "comment": "Malware payload (Gozi)", "value": "174bcec3151ce040cf79c7f9f8096b490ca50d58303b50ccad43748b3a31bf8d", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285068, "uuid": "67bfa003-ae40-4c63-b047-912acfd1d1ed", "comment": "Malware payload (Gozi)", "value": "00213fb827b51cc6476e8049fb7572b261a96ff1", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285068, "uuid": "a3f743a0-76be-4abc-8421-21dfd845f127", "comment": "Malware payload (Gozi)", "value": "b85d1b30e333344cff3d9c788cd6bef96c3629fd0e2d5a6fe4485b17563c436f2df7886b11dee94d078f4f6ad1182636", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285068, "uuid": "2f2a606e-f2e2-43a5-894a-e5e1c14bf44b", "value": "C0347C66A2E50A95FDBBD5B5C993C227D7F238091B74D74F13B0CA995F13321B228382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285068, "uuid": "e083577c-3495-4bbc-9ed2-102f682b32e4", "value": "6144:nUnrtJwlhYeKmfPQUkkxvswhJDbuB1yDTadPH:nUrtJwlhBffP/k7whRuB1y4PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285068, "uuid": "870aac19-e37d-49c1-a143-7a5a10ff2c01", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285068, "uuid": "69534036-192a-45e9-af1f-90746c1b48e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285068, "uuid": "eed907dc-7b14-4bda-8646-7b0a1caf5343", "value": "7300000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d876f47f-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276278, "uuid": "633db159-0cbd-4887-b6ac-19cae9cc3c4b", "comment": "Malware payload (IcedID)", "value": "346415430bc9e1c215bd394157081a0f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276278, "uuid": "5411688c-81f4-44cd-a386-2e9ecefb0578", "comment": "Malware payload (IcedID)", "value": "1768a61cd2972d3528a8c809882bedd115e7081d75417d5f0c27dff49e0f2fdf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276278, "uuid": "178f07d3-6791-45be-898a-c18a9b7bca05", "comment": "Malware payload (IcedID)", "value": "2cc535e23ee911957ad01c8a52c5bbe2405721a9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276278, "uuid": "26fbeed3-025f-4493-bd2f-cf2f0ac3fe16", "comment": "Malware payload (IcedID)", "value": "efa035a98149ef81f318ab227c13d6c53ad777f0f8e0575ab26f4ce7c83bdb44b3ee28851620d830a74f7cadc087f36c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276278, "uuid": "345aa43f-bb1f-47e5-a62d-042c4acbd209", "value": "82044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276278, "uuid": "98c11b7a-1f6c-4e5f-b043-4dd7eae1ed7f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276278, "uuid": "5605caaa-fbf4-4b86-af30-302723cf4c0b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276278, "uuid": "d3fbcb2d-80e4-47f3-8b85-0fa8b5e4195e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276278, "uuid": "45ed8ba7-51c7-4cee-a771-e8e265a1a7a5", "value": "document-2013094335.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0690ae5e-9310-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617298260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298260, "uuid": "caa18198-cffb-4067-a9e4-5de45d7de65f", "comment": "Malware payload (NanoCore)", "value": "a638ddf850e376749bfb5b72840c3ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298260, "uuid": "df3b6825-45ee-4bf7-ad4f-d5a827a8c0e2", "comment": "Malware payload (NanoCore)", "value": "17970e5cf19bdce5f04d5fdd4e3d7b624f09ff2a682e7213c1494d484dbc5bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298260, "uuid": "36a39996-e5e1-4c2d-99b9-b1165bee188a", "comment": "Malware payload (NanoCore)", "value": "553a53eb309c6bc20701c4561c47b84bb15380dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298260, "uuid": "1cbe733c-9406-472c-b6b4-aa4515ebd236", "comment": "Malware payload (NanoCore)", "value": "50d3e2dc1df9d22841c6b108d0bc723c5fe22b8d1da74d3a4780def0e44c3b6b2a10faf82ee09de0baf877b364e1796f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298260, "uuid": "2097fa66-1fa6-4d4f-ade7-3625409f1a5b", "value": "D105C4AC70AE209DDEB5AA70F9B55D825FC425320F17FF3B24A312445C5B76AFA0E460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298260, "uuid": "abea0379-6be4-4193-b4be-372cc9dd0fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298260, "uuid": "acc1071e-b2e0-47e1-ac48-fac2e8ae5a01", "value": "12288:Gw/LGFvjngiN18zLImqLiQBX/R3GS8AnukidQe9qCjxMJ7:HLKZtmJKR3GLOuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298260, "uuid": "e4f3763c-ff57-4c83-98f4-0ade98143fd2", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298260, "uuid": "17d29a0d-6a21-46ba-955e-33a6050dd8ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298260, "uuid": "6599e761-4c73-43b5-a6a2-f7b2715e1591", "value": "a638ddf850e376749bfb5b72840c3ddb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04454c50-9310-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617298256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298256, "uuid": "47a864ed-1077-464b-b573-22b3ace3fc42", "comment": "Malware payload (IcedID)", "value": "a6c93832b7340eaba6aa8869eb0ce9c8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298256, "uuid": "08daa7cf-3078-479b-874e-29435a033989", "comment": "Malware payload (IcedID)", "value": "17af1d24c8b0ba21beb64325012adfbc69d7ba72e5a7d72aa3093f6d10c90779", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298256, "uuid": "346c5f31-4f01-4abe-a012-7d269410dd25", "comment": "Malware payload (IcedID)", "value": "018bc2d586fb75c8f6a39a0d7cbf09acd6f92f95", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298256, "uuid": "94c2797c-32bd-4d3c-9812-e979df59c7c8", "comment": "Malware payload (IcedID)", "value": "581e9c928dff8d9a3c70792eb5706d5c94e7d9160fa924a6029c8d781ffda416830675a2b4c4c6261993ee3e645d8eeb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298256, "uuid": "50f6da48-a575-4944-a872-b59883dd6c37", "value": "F504123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298256, "uuid": "509931f9-9174-4d20-a48c-b9c4ef523bf5", "value": "3072:nXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:XE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298256, "uuid": "536baddc-d1f2-4ed9-a7ac-8f8027024428", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298256, "uuid": "40f94c76-2f5f-49b2-bf86-f878a8ef2ab7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298256, "uuid": "c2269f09-f8f5-48a6-a680-58808eb2fea1", "value": "7455147406-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2a0306-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284311, "uuid": "de42b795-a3fc-4ad4-b8ad-3491e6347bf3", "comment": "Malware payload (IcedID)", "value": "5bfdd19afab38a2b8d885b53a43bbc27", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284311, "uuid": "bf6eb1a1-7144-4b3b-93eb-d239c30851af", "comment": "Malware payload (IcedID)", "value": "17c7c989becebd13665588627664649926d60d017f6b79197baa837a7bde7be3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284311, "uuid": "9a1313a6-bfd8-4152-8948-a1ec16e517e6", "comment": "Malware payload (IcedID)", "value": "695ffe6b0aaaa51334a6816acfb4320784bea6bb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284311, "uuid": "f89f6d25-b652-41ef-b7cc-77b44fba9805", "comment": "Malware payload (IcedID)", "value": "d134c7ca8620c0cd5f63f3009caa2283cfb011e8ebbe8ef35b9c10c560e00f8e388c1e38df02ef49f907880543a3fa6f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284311, "uuid": "0a56dfeb-193c-4cca-bce7-6fd786d49ab3", "value": "6B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284311, "uuid": "57a4063c-ba60-49ad-9aa5-c4064f0e3a63", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284311, "uuid": "996bda7b-062b-4421-b738-fe6e1ff29163", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284311, "uuid": "ee1a2876-75b0-4480-97f1-010a9a271e27", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284311, "uuid": "4b28cb0a-dddf-4d14-8305-bc7fafa22fe2", "value": "document-1867453203.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b330933-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282457, "uuid": "3d596e98-dcf1-41fc-83ac-bd2a431fdeb0", "comment": "Malware payload (IcedID)", "value": "028e3b003f8931e63500276e0617c733", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282457, "uuid": "3654edcf-3952-4616-838c-a6b83ad84b9c", "comment": "Malware payload (IcedID)", "value": "182184db9d322e31722594900a34a2708dd1828bce073c713d8dd7887c83d360", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282457, "uuid": "a3a6ea6d-e15f-40e0-9196-ac86956c7bac", "comment": "Malware payload (IcedID)", "value": "af97e6bf259d2b112dcdb371dc02b1403283c11f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282457, "uuid": "d62cf487-d7e0-439e-a81e-c275a654a8c9", "comment": "Malware payload (IcedID)", "value": "b04bdcd67b7739e8de1363bf4e173e90b5d009fd519c78553b6201e15b48b87a26e4ca8db10c83360765a0755d68bd1a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282457, "uuid": "3a6137aa-cc95-49b6-9ab6-f30a3ec80407", "value": "96044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282457, "uuid": "4012f99e-09e3-425c-8930-4444350971c9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282457, "uuid": "08808636-cf9e-43fa-b6d4-38fc74aa1959", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282457, "uuid": "df22391e-15d9-4976-9fa9-35edb968b9a3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282457, "uuid": "a6171882-c8bf-49f3-b7a4-654df14b42e0", "value": "document-1570454889.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fb1618-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277475, "uuid": "871433d2-c61e-4298-ad9a-1eb6258694f3", "comment": "Malware payload (IcedID)", "value": "16ca30a720998a916eae3b83904cb03a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277475, "uuid": "88b020d7-5616-41d7-870f-7a2808eec366", "comment": "Malware payload (IcedID)", "value": "1846b9354d9abb7857cc4b73cf5b7c8de9dc0273e38597244b7db03f8314609e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277475, "uuid": "5d889830-9f31-4eac-bb45-16cbeefc081b", "comment": "Malware payload (IcedID)", "value": "ded71c52128983b7e529e931e73dfcde707a5d28", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277475, "uuid": "09c20d73-34eb-4b86-9ffa-d88ecebfc6bb", "comment": "Malware payload (IcedID)", "value": "1ad52bef045d23ee8533c96051fa6a65d05514bb0b4deeaf34d31e4f24e5f6bf2d865ef2122e45c7e9f498152f437ef4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277475, "uuid": "29f54d11-8f4c-4d47-9080-2a21b5b205b4", "value": "38044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277475, "uuid": "53123839-cc2b-40e9-af41-b1e0cb4f1677", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277475, "uuid": "d3f62851-099d-4e9f-b403-1b4a739eca29", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277475, "uuid": "d104d8d5-b23c-4997-b9ee-a44af99347e3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277475, "uuid": "a8ef62c8-62bd-41f1-8ae1-db316d3d717c", "value": "document-1371357511.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c3809d-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287783, "uuid": "da6b537c-6036-4db4-b442-09d978461875", "comment": "Malware payload (IcedID)", "value": "82749ed3fc883b2767247e8c73332b35", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287783, "uuid": "3f1a0eb5-72bb-45b5-8bd0-56c445595f82", "comment": "Malware payload (IcedID)", "value": "188c6b2687373c93a6a4aeccea88ad5b48c15f7fb57d95d79165a9f4c7819cee", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287783, "uuid": "86be88a9-71f9-4c85-8b3c-166c1f725b67", "comment": "Malware payload (IcedID)", "value": "396af1e1536094d0ec57b67a79caa6be69658eb4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287783, "uuid": "178eebf9-d7e7-4613-9ab1-461941eccfcb", "comment": "Malware payload (IcedID)", "value": "a7a4410c6be419a2084b25a7920371724c9bccb2137438ba120278fb45c03b99ae28cd47c7d658a7600dc5102477f7fe", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287783, "uuid": "9e170b8f-035d-4177-9de8-0a6fbadb676f", "value": "54838CCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B108EA62E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287783, "uuid": "c3162bc5-23f1-4eb5-bdf2-390b6bac1124", "value": "1536:IB240XZfcaaxf+EQliU2hawiCAIoo8+BNvMhfvH5:+2d1cBWEQXMi9o8+nEhHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287783, "uuid": "01fb7034-861a-4dce-8af0-d1c485c6323d", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287783, "uuid": "91d68d16-5d1c-449b-a9f3-655a5cd94c2e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287783, "uuid": "7bf6196d-f906-4cef-812b-e292efd16f30", "value": "3273.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b2e98f-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276614, "uuid": "b98b639c-67a9-4aa3-8ddc-bcb6a6c02240", "comment": "Malware payload (IcedID)", "value": "adb0db5df3a38a722c473d8322d9012c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276614, "uuid": "0d5e760b-b2ed-4cb9-b74e-dc91e76128fa", "comment": "Malware payload (IcedID)", "value": "18aa3ba133bbe7a9d2bc64aabac2b661e930b6b535a5f6c7828776bd03ec28fb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276614, "uuid": "c744fa73-128a-448c-9e99-d06b279f42d6", "comment": "Malware payload (IcedID)", "value": "8ef6bdf1a76ea41b6ca819c55f98435085988762", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276614, "uuid": "89706356-cc8e-48b1-8c1a-ce2088bf9ed1", "comment": "Malware payload (IcedID)", "value": "0d318a98b9c96aa42b21525a12d17df59d18ca31ec2caf733f6a985e1343af25744e8842171f1b990c5f00fdb03aa1e3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276614, "uuid": "1db44a23-5df1-4e6f-8c06-52295764a854", "value": "A9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276614, "uuid": "fe047dc1-7baf-46e2-b886-9555fce28fe6", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276614, "uuid": "d8791fa4-1ee2-4ab4-a666-cbdeaa70d2fa", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276614, "uuid": "b0998db1-2f0b-42a2-82ab-e17cdab2271e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276614, "uuid": "a73cd7c2-794b-4e95-806d-f5795325bcb3", "value": "document-609740740.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf5bdc7-92b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617257118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257118, "uuid": "e25b9922-5f62-47b3-bdc5-6272b037be7a", "comment": "Malware payload (AgentTesla)", "value": "949e03fed550fccec7c4a8350320933b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257118, "uuid": "dffe0853-f69b-438c-9dee-9b4ac9fd8e51", "comment": "Malware payload (AgentTesla)", "value": "18cb3a09008f4a08fdd53c45099eb8b1f5ad053a5817075fb8ea3abcad762bc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257118, "uuid": "aed3c815-c34e-4ce3-aeee-282f3bf7cc7e", "comment": "Malware payload (AgentTesla)", "value": "f2abd19c8037b985f15c590c6c906923f8a98413", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257118, "uuid": "83a02a97-6b5c-4e16-a566-d77f62e3a764", "comment": "Malware payload (AgentTesla)", "value": "4f2717298a1148166ba4f01b0e0575eee76aff53eaaf44ff6a5bbc8fcfe46f591dc3ee8796b3fb3399ac27446babf137", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257118, "uuid": "e4fb1869-01c0-4ade-a8d5-6f28adda6c41", "value": "BEE4BFF875047DE6266F576BDA96ACDC03B6263299CBA4CD4068B7C305A3376FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257118, "uuid": "dd0826fa-bd21-45fb-86a6-f02284b9199a", "value": "12288:0AxOSbCzMlzOTnstsQCH6oy4FScfiRZvFThr5TrXqgnegLkW1i/l5/HGvwiA8zD:0AxOSbCyzOQKHDFSZBNr5TrXqgLQW1i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617257118, "uuid": "b053e02e-db3c-4556-affe-8779c6313404", "value": 662379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617257118, "uuid": "5e05e1d0-ed70-402c-9aa0-419c757a68ad", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257118, "uuid": "997f8cf9-a3e1-428b-a1b7-50ba390a1390", "value": "FORM E.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e0204b-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282934, "uuid": "8d9d6b8e-905c-49e5-9c7f-040ed58c41c3", "comment": "Malware payload (IcedID)", "value": "cb95a14b0ac23b42a2ed88cc71449766", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282934, "uuid": "518b5f7b-72f5-44ad-8bb5-dc811d577207", "comment": "Malware payload (IcedID)", "value": "18f2ce8ce1af0901c9c5bc2012adc14b684512e10a31871edbb36f8711ae5011", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282934, "uuid": "485e7976-2003-444c-895f-e212db121b79", "comment": "Malware payload (IcedID)", "value": "47f2d9f223dc21df6202f3acc83ede88bbfbcc14", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282934, "uuid": "1c82c7ec-2c36-41ef-aef8-eae058ace8cf", "comment": "Malware payload (IcedID)", "value": "be4c87f2919a1697c47afbaa73f529acad3535f64e253035d79ae616e6273e22c5a1400720a3513956017ef86a63701a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282934, "uuid": "1ed32123-cf99-4c94-9f2a-886247798ae0", "value": "F6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282934, "uuid": "f6c6393c-4687-44e4-8707-640b7eb95c4f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282934, "uuid": "0c091bcf-dc6e-40f9-a882-61e53130043d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282934, "uuid": "4d571d69-261f-461c-bf03-026b39cfc8f2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282934, "uuid": "bb23de41-569f-4bba-aa46-f242cf63749d", "value": "document-657328413.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0670d417-930a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295683, "uuid": "b9900f1d-11b3-49c0-9aa5-8597bac0d102", "comment": "Malware payload (IcedID)", "value": "660eb8bb1357a5f5451343075b0a7261", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295683, "uuid": "adca1fcf-aa8e-4f44-a948-065ccd5f021e", "comment": "Malware payload (IcedID)", "value": "18fac565ccca1457b612ee1b99dd07e8940ccb2a14b07c94345b6fc758d2bc1b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295683, "uuid": "fcc2d12b-c0e4-4945-b96b-356fb07dd6c0", "comment": "Malware payload (IcedID)", "value": "3a8aad484934e5c5677d920a7f60d409eb591666", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295683, "uuid": "45b1c230-5d34-461a-96c6-95cd214e1249", "comment": "Malware payload (IcedID)", "value": "1a898699397ac58cd98ace1c97848825f2fbccac9caafeea839a8eccff142155c00d441f2526c180c79fc5102ef5c267", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295683, "uuid": "3e9c35c8-63e4-4c2e-9b2c-1516ab6fc4c4", "value": "06838DCDC913E1D9C2559FBD5A09308112F4E0B7276FF11B148EAA2E4D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295683, "uuid": "bf931a4b-cf90-4681-9c27-c54c2caab9c4", "value": "1536:IB240XZfcaaxf+EQliU2haw+CAIoo8+BNvMhfvJk:+2d1cBWEQXM+9o8+nEhHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295683, "uuid": "02b6e338-d931-467f-a27b-f1caa75b005c", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295683, "uuid": "74d23bc8-8ac8-4ec1-a7ed-e60f2f2332b9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295683, "uuid": "71f39887-2465-433c-bf4e-2d145a16b07a", "value": "2020.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e7c473-9317-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617301368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301368, "uuid": "0bb87e75-6962-4fc1-a41a-77ffd916217c", "comment": "Malware payload (IcedID)", "value": "896c22c33fa05a5c6fe60ae4e524affe", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301368, "uuid": "5911b82f-e7ce-48dd-9113-a9575737b845", "comment": "Malware payload (IcedID)", "value": "1916166f6f182b62771b4a9312b8ea2d11bb186ecdb3ea5e0334782d6809091b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301368, "uuid": "1d513c21-fea0-4045-89f4-edb1b6fa3800", "comment": "Malware payload (IcedID)", "value": "222f934c61085dff2fcd97e9b901cd9394c50f6a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301368, "uuid": "0fce77e2-a925-4191-a2c1-924f07e92e6e", "comment": "Malware payload (IcedID)", "value": "c7ff0cab02e4f8ce4ce7a3ad0d077b52121ca39ba4acfbefe66ee6192bbad836511724d27138311b26afa64da8cf66e8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301368, "uuid": "3f1d0220-deaa-4c9c-9445-5c34fa766119", "value": "A504123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301368, "uuid": "ed662f71-b01b-434f-be2a-745743c64872", "value": "3072:HXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:3E5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617301368, "uuid": "35158e1b-57ab-4256-85c5-5d879c30d0a6", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617301368, "uuid": "13583d1f-f450-4b9f-85f4-2e11e8492a98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301368, "uuid": "60316e75-baae-45b4-9ea8-ed46059c4af6", "value": "7608883648-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefc04cc-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617298972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298972, "uuid": "0af33580-6f14-4df4-b994-2be6b64cdd54", "comment": "Malware payload (IcedID)", "value": "42dea1c947de83c3beb97933bcc142e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298972, "uuid": "2b9d2cea-6969-4990-8abc-746cdaa8e127", "comment": "Malware payload (IcedID)", "value": "191833af4ae4f027d369439438cefd8a6217506fc23c6d919291bde32f77906a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298972, "uuid": "c24269b7-3a66-4370-b1f0-fda1aa26aa63", "comment": "Malware payload (IcedID)", "value": "8defca546577ad1b8ed4dd75a785477dbbebc563", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298972, "uuid": "fdb55995-4ef4-4522-b13c-2eefff9d6b68", "comment": "Malware payload (IcedID)", "value": "df09da23cd44b8036e84527d21dffc3f5a27911fe84a16204ddbaebe3e2bb1eaa32ee096fae48ef6d8c8011f560605c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298972, "uuid": "6c50aba9-6509-400a-89cc-1635e6207135", "value": "4144C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298972, "uuid": "e4fc9b92-16fc-422d-9e21-0090a1f73dc2", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298972, "uuid": "2ed60b07-07d8-47f8-bd34-0ff04dcc67da", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298972, "uuid": "dd2d8f36-cace-47cc-a387-eaa4d50e7122", "value": 274595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298972, "uuid": "ed44f2c8-cb2c-45fc-91cc-2cae1f0c1769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298972, "uuid": "05a6d923-5e3d-4b4f-9a63-b124a0626c09", "value": "42dea1c947de83c3beb97933bcc142e4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079e1064-9343-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617320166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320166, "uuid": "7801a9d5-518f-4e75-9003-02dfd14fb9c5", "comment": "Malware payload", "value": "de2332789f6d5f29d9a112527c9ad4cf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320166, "uuid": "277d962c-b7b4-4353-82b3-4b79389d9a53", "comment": "Malware payload", "value": "195b992778f50c6010472ee314a0902b79a0fa0e6808d8bd0b3f87ac3625b5cd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320166, "uuid": "878c398b-d76d-4ed2-924f-a87c398ae458", "comment": "Malware payload", "value": "bbdf018cffca2feed6b89c73c8802e78096b73aa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320166, "uuid": "413f810f-3280-48a7-bf75-626aa60e704c", "comment": "Malware payload", "value": "fc9eca5e11680aecd89ac2aad09a56b6d7b03e078f769261d81a6f21acc9e3f06b00506d51322fa4f311f875928c78e2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320166, "uuid": "3eac63d1-5b2f-4220-968f-1a1c2743496e", "value": "15248C5FE339E486FAE3CAF44186A72296A39C92436F680DA0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320166, "uuid": "de351063-2477-40fd-a2b1-e755cff8c363", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320166, "uuid": "92a9a7e4-af93-448c-9a74-6901bd872889", "value": "3072:T6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ToMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617320166, "uuid": "ec9470ee-8cf9-4932-a49b-e4a1ca481ae7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617320166, "uuid": "7a69ff8a-8d50-4e28-b491-d8e9b579db92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320166, "uuid": "5f71ce97-11b6-419a-a0f8-32065a31d81e", "value": "195b992778f50c6010472ee314a0902b79a0fa0e6808d8bd0b3f87ac3625b5cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d7cb2c-931f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617304998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617304998, "uuid": "7159c89d-95f5-418f-b763-c7ae7eb43675", "comment": "Malware payload (IcedID)", "value": "e8d0244666daf465e9914a7f56938412", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617304998, "uuid": "f29a2224-0d05-4802-9b0d-807a5e921219", "comment": "Malware payload (IcedID)", "value": "196668480754f95f98c6e59d4776e4f8c756ad3be9fd48a27cfcb50be329567e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617304998, "uuid": "cf31272a-ff8f-4d74-8caa-2afbf4f6bad9", "comment": "Malware payload (IcedID)", "value": "3c5f71752b0cea18b06dfad9a96cdfeb053f45cc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617304998, "uuid": "4280b1bf-fb4a-400c-b9d1-c88d9bb1b422", "comment": "Malware payload (IcedID)", "value": "b015084b46ff3373825f01efe2f29220aa97e44f8c483415fd7f6ce2bd2b819b2362f5f42d4c4bfb5f38c241073bb2b7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617304998, "uuid": "05caaf1f-b8d9-4414-9da7-2dde4a04e86f", "value": "F904123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617304998, "uuid": "63fb0234-b20f-4c43-afe5-fe75e75b8178", "value": "3072:DXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:LE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617304998, "uuid": "6501fd02-4ca7-41db-95de-399667934bbe", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617304998, "uuid": "9d4bfb65-47bb-4f5c-aec6-187f9ac8bb78", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617304998, "uuid": "4f523297-2bf3-45f2-aef6-a2fe976e7ee3", "value": "91476525608-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36e75e1-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274069, "uuid": "b5bf1234-7368-4842-993d-d75b858275fe", "comment": "Malware payload (IcedID)", "value": "9f1c05c4e1cdb25c4f5ae8c68f90e31a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274069, "uuid": "a7d62180-58fd-4c68-a7fb-42d583e9d4ef", "comment": "Malware payload (IcedID)", "value": "1a0161ef86333a14f623b3ebe2c0b5195af423b68301c09471beb9bb2dc33b48", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274069, "uuid": "176b737f-cfe8-46fd-b936-33d17b0736c5", "comment": "Malware payload (IcedID)", "value": "74379738a6b49b023df5fa8f4e792002dca97fc2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274069, "uuid": "f8fb0e1a-8011-4e66-8f81-72d5672d2eb8", "comment": "Malware payload (IcedID)", "value": "4e83813c0e057df85198035bfa1aa864d94242d54a76d4860f624c5c254e793b570fe37b7a05b3dfbae311a37ee135c7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274069, "uuid": "f30d5d92-27fd-402d-a6b6-959abce59120", "value": "A1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274069, "uuid": "68d397ef-aba9-4be6-b032-e78bc526c771", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274069, "uuid": "705ef945-887e-439f-8eeb-05012cb98e2b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274069, "uuid": "6275083e-c0ee-46dc-a090-2d76a753d21c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274069, "uuid": "36b1a1cb-989e-4d2a-94b5-ec3f076189a8", "value": "document-173853785.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ea621d-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292378, "uuid": "93de757b-e44e-4fb5-98f3-5fb7717f337e", "comment": "Malware payload (IcedID)", "value": "78dc970bddd893f564914e6255668848", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292378, "uuid": "f0c386cf-05c8-4975-a607-3ff1f2ca05ae", "comment": "Malware payload (IcedID)", "value": "1a0aa3010817e49b7e39c70be6963dffc92b039ba2b72f869e66d73220bd6e46", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292378, "uuid": "4279718e-a1b0-4cae-9208-0252c6a12d37", "comment": "Malware payload (IcedID)", "value": "4ee69818f317f1ce59318436617734f5c6b0c042", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292378, "uuid": "95a0dd39-f715-4233-bdcb-8432de31df4f", "comment": "Malware payload (IcedID)", "value": "11ee53c96ba12a37c5fd78bcaf42ec2c0981616b40135e95f40f1e117504b4adc9edbb18a331af03ac351eaf956349c1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292378, "uuid": "93dd0074-76d0-4017-b893-71e9d41ce902", "value": "A1838CCDC917E1D9C2559FBD5A0A308512F4E0B6276FF11B108EA62E0D42FA80A5E7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292378, "uuid": "8a13bfad-4369-49a2-8dc6-2b95a875d40a", "value": "1536:IB240XZfcaaxf+EQliU2haw25CAIoo8+BNvMhfvKb:+2d1cBWEQXM259o8+nEhH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292378, "uuid": "c76cf7ac-88c7-46ac-9fa7-f6907208e0fe", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292378, "uuid": "73b4c090-3361-4143-8ec2-3dea03344bbb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292378, "uuid": "09001377-48c5-40a2-872b-ed606f50c94d", "value": "3277.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104e3cdf-92b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617257045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257045, "uuid": "c3ac3700-bb75-4e7c-bcd0-9dcc1f561105", "comment": "Malware payload", "value": "8eec84819bec7e814045158633ca12c5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257045, "uuid": "2e15dca4-8d5d-4d6b-8bc0-2d1f1d66fa17", "comment": "Malware payload", "value": "1a151a7b290fe62f540a4f2ba9e98f231041c7731d14fa243a0d7776fd5a3bd2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257045, "uuid": "dc3ee7c5-6339-4bea-9126-38865f254d59", "comment": "Malware payload", "value": "a87a29d5ad0a5f0b26569b5118443a376957c13a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257045, "uuid": "e4c93070-7602-4475-8df0-da745921548a", "comment": "Malware payload", "value": "d4689d86bf0aa0dc2b4ea1d1a520254183c325b96251d2a893895678aa4e0ebdc8e155d680e2ffe20f02196372e03080", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257045, "uuid": "bb422807-08c0-41e8-9515-7dfff43d5c73", "value": "0D75CFE801B494C1D7044E4BB818BB891637D9ABCED44019F3BAFBFE277F4E0564A895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257045, "uuid": "e14856d6-35ee-41a7-af97-8cada395242a", "value": "6144:gSz6ya1jWi22aK8Z3p3xGrsx3rsx3rsx3rsx3rsx3rsx3rsx3rsx3rsx3rsx3rst:3a1qi2jtZ39x4oD65w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617257045, "uuid": "ec90814e-8c64-4f1e-b302-6e937e2f2533", "value": 1630953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617257045, "uuid": "1e631c2f-7ced-418a-b1f9-60683cacc1e4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257045, "uuid": "2aa2e4d4-633b-4b27-a6b4-3c8ae7ee99e8", "value": "new purchase order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55c4fca-9305-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293936, "uuid": "5ffaf5f5-8b05-4f4d-aa62-11d4dc19fd1e", "comment": "Malware payload (IcedID)", "value": "74a3449e25938f60c82166822a15cd64", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293936, "uuid": "56e8750f-7253-4081-ac93-11b5d02261ce", "comment": "Malware payload (IcedID)", "value": "1a30a14ac6f9e7e33ed6e2c9bfda0df2c0f87af41bdc29966bc222fa35392114", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293936, "uuid": "8aa643ed-e7f9-45b5-b25c-9635ef724c29", "comment": "Malware payload (IcedID)", "value": "ee395b77e54394bb5119d2beaf3b769e0c7b008c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293936, "uuid": "332d9ddb-bf45-419d-8778-93f92ab34fc6", "comment": "Malware payload (IcedID)", "value": "1487ce0cf811f2328dcb0df16f6e31cd67ebec8d1ed03822202a4fbe8bf2ca4ca7d3bbe818883a836af02e7cf92f40bd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293936, "uuid": "f7755933-3c49-4b5d-93c4-32955c01bbfc", "value": "18838CCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293936, "uuid": "ff74c209-08ed-4009-a37c-95ea80acd13f", "value": "1536:IB240XZfcaaxf+EQliU2hawzCAIoo8+BNvMhfv0I:+2d1cBWEQXMz9o8+nEhHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293936, "uuid": "12e497ee-2547-40bf-8342-4afe46f01c4c", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293936, "uuid": "84586d99-03ca-4267-a932-1f2de7781858", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293936, "uuid": "d6d7852a-2f8e-4c4d-ab2b-2686196f7e77", "value": "1892.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9609c7-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275297, "uuid": "a0130732-14b9-4f99-a42d-f9cb9ad69d44", "comment": "Malware payload (IcedID)", "value": "e319c7588254721ab748364d72d473d0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275297, "uuid": "216e742a-ab1f-4542-b16e-68d0eb441117", "comment": "Malware payload (IcedID)", "value": "1a49abfcee272a4b5de5cebb95ef4c7ad2fa70dd9c95f99fd89600ef268174bb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275297, "uuid": "19c2f21f-4712-4634-8055-68791938b8c5", "comment": "Malware payload (IcedID)", "value": "b735f4bd864b35ea98a9db3dd28b5343ee33fc3e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275297, "uuid": "f9f03bdc-1bc4-4341-8a8f-2a37b57ae5a2", "comment": "Malware payload (IcedID)", "value": "84b25c10ac7273d7b80efab62ce789b89a3a3a091df20fbb1dfbeaa2a0a36734f1ec30c7b264f61fc805accf6c0171c7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275297, "uuid": "2bda36a1-2356-4f32-abd6-cdb0400a0139", "value": "C6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275297, "uuid": "84e94fab-29db-4488-9e56-b0d95f10121e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275297, "uuid": "2c7bef59-40b5-4d2b-b1a5-5521719b7970", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275297, "uuid": "a2e621c8-2834-47dc-9e2e-24236b93bfa2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275297, "uuid": "8b235749-6c2a-4761-a240-acc687f04c7c", "value": "document-1814596782.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3543cc4d-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617290178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290178, "uuid": "469e3131-b3c1-4a24-9dac-3cfd26cac2c3", "comment": "Malware payload (Dridex)", "value": "ee51d1f830af9101600ba46d4f5b2bcf", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290178, "uuid": "50be3da0-b737-4b5f-9ff5-cad2a2f09f47", "comment": "Malware payload (Dridex)", "value": "1a8679b02300b9e5c416fd4ba569b4252e52d63a817442649f9f1e9ea71f3be3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290178, "uuid": "186ee866-0242-4aab-a5a1-29ef566b23e2", "comment": "Malware payload (Dridex)", "value": "316755c3ac8647c9869f101cfbdba4b825352fd0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290178, "uuid": "9554039e-ed7f-4892-a68d-c17aa516cf84", "comment": "Malware payload (Dridex)", "value": "1a78f4b29f81b5caf00fe803db243b3a3c3946e0fa66e29e4355ae84a545a9108bef99f2245cb655e818b20adb4638a9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290178, "uuid": "12e73c0b-5ae6-485d-bac2-4d9b47b221d3", "value": "E714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290178, "uuid": "4ced47d0-a851-463d-a672-a27c019189fa", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290178, "uuid": "34e1f8f0-8727-4de6-a858-965f6b4c6396", "value": "3072:hopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:2pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290178, "uuid": "19c0feab-0d15-41d9-b929-89a7e0bc3712", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290178, "uuid": "72af891d-a654-47d3-b453-ac7a24cf2a10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290178, "uuid": "105afbcf-428e-447b-b10b-f7a9a2c96ce5", "value": "1a8679b02300b9e5c416fd4ba569b4252e52d63a817442649f9f1e9ea71f3be3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a16d19-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276924, "uuid": "04781ffb-cd14-49fc-9372-54d09f0643cb", "comment": "Malware payload (IcedID)", "value": "9c0392058e061ec08e159455b9d61dac", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276924, "uuid": "d995ceb6-2458-49d3-97e4-08718fe9d7cf", "comment": "Malware payload (IcedID)", "value": "1ab1f26dfa13935047024a29f6094fcb96e6d61b299f4f82b05d5a08a84f5066", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276924, "uuid": "c67ea18d-53ce-4564-8e80-364c5e1caf3c", "comment": "Malware payload (IcedID)", "value": "3f0a4a6c29f4434ee555a1846e3d350f766a3bec", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276924, "uuid": "3598f8cb-74e7-4bad-818e-5fe643b3ed92", "comment": "Malware payload (IcedID)", "value": "a187c1f1ca418c9bed2c3f92a70fb3da5aed727ef0c797310faa5adfb515070d246cbb1785fedc19008aad6b8e6e90c8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276924, "uuid": "786c9040-fa65-4505-a2f1-a5e557ae4652", "value": "83044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276924, "uuid": "17b913a2-344d-4833-a6bf-4f7ead46a894", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276924, "uuid": "52b20464-aaf2-41ba-bde7-52f7c3f45b71", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276924, "uuid": "8ac08b3d-238e-4c7b-84d9-72de91eaf4d4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276924, "uuid": "327839b4-67ca-42be-8c95-584f1de8ae94", "value": "document-1575995739.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7a30ed-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291452, "uuid": "dae6338d-bc6d-46f5-b682-f275d3c7976e", "comment": "Malware payload (IcedID)", "value": "f6f6820c90e31382baf23ce176f0bafc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291452, "uuid": "1d740e09-b7a2-459d-aa54-6fe8d1621e03", "comment": "Malware payload (IcedID)", "value": "1b20c531998d057ee1432186b5a8a4ac6810d0d5b8eb610a7406dc733d54d3c8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291452, "uuid": "283476d1-2a21-4a88-83fb-21e6ba9d8fa9", "comment": "Malware payload (IcedID)", "value": "8829e0e2c82db094a50ace2ca3205410be402215", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291452, "uuid": "2a833642-c748-439e-a706-8082213d3c45", "comment": "Malware payload (IcedID)", "value": "c6d107357b0c28cadbae2d39b39a5b35cfdec7c10ea90d0aa55567f0079fd39e01697772abb54e40177769b7d97fa46c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291452, "uuid": "2e2d0699-7c91-4b88-9dc4-69faf10173f1", "value": "A3838DCDC913E1DAC2559FBD5A09308111F4E0B6276FF11B148EAA2E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291452, "uuid": "15b94184-c376-40be-8ea9-a5b067bf4b23", "value": "1536:IB240XZfcaaxf+EQliU2hawXCAIoo8+BNvMhfvxyF:+2d1cBWEQXMX9o8+nEhHAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291452, "uuid": "71fde768-502c-49ec-834c-b3a13e8c5eaa", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291452, "uuid": "e71dfb6e-4959-4d61-aca0-acf05f6bfce1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291452, "uuid": "c188e4d2-98ee-4550-8f8d-28c58974af94", "value": "416.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dcc914-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277482, "uuid": "28ce8fb8-85b2-4406-8eb7-052227d503bd", "comment": "Malware payload (IcedID)", "value": "2bd69276f2b3f467d939546ced85dcf4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277482, "uuid": "19bf93dd-668e-458b-85b7-b8fe95418d44", "comment": "Malware payload (IcedID)", "value": "1b6dc5097869f537b8716e4b637708d2d5f8b1c72a228e4afd46da3d3a18c797", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277482, "uuid": "852055ad-f7c3-45b5-a255-41007e3fe75c", "comment": "Malware payload (IcedID)", "value": "cb57c5adcd514d4f93489ef4d7f33ab723248feb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277482, "uuid": "c9e1d1ee-f146-4b63-85fc-ae2d87db41a7", "comment": "Malware payload (IcedID)", "value": "9d41ad151e6d9fc495b46b9091cdcc13988c729d03ea63d132d278de8d5c46f01504a583cf25b2e2fa2e2da9daf57c14", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277482, "uuid": "19635e51-44c7-43cf-820a-d94535c251d3", "value": "82044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277482, "uuid": "a19d6d01-f158-4ae5-b565-935706651871", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277482, "uuid": "4847ce6f-cdd9-44fe-b2a5-353b410c39d9", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277482, "uuid": "23d5687d-b596-4103-8a67-c0c6d364c0ff", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277482, "uuid": "94d943b3-4f76-4950-8030-d9df2529fbf8", "value": "document-1503015001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a87ad55-928a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617240902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240902, "uuid": "c0deb39b-e910-4b8e-bea5-544ca854b009", "comment": "Malware payload", "value": "ddd20e0b0eade667b908971dd412f5de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240902, "uuid": "2be150a6-1985-48da-b724-5bc37d149f4f", "comment": "Malware payload", "value": "1b77461c4b94b464ea21d6aa79a5b8c89ca3d81e0b977b2917faaf6173a0e448", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240902, "uuid": "5eae7e57-aa88-421e-af11-0d3bfffbc002", "comment": "Malware payload", "value": "ad4d69969c85823cc09021c6d7e7d109ce40e453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240902, "uuid": "cafea8be-49d2-4735-8d59-303116f08345", "comment": "Malware payload", "value": "7eec377bd81da2e7af244848cbba9ac3d92540a1d52547a5f089a1765e3314c7d2d39843eb0c9d62c41824a2d11ab93c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240902, "uuid": "147d356d-19d9-4171-b908-70dcdca8fb90", "value": "B1538E01A682D1BEF5974F70063FC62EEC30AC651110BABAB35DBBB06D33D232D19569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240902, "uuid": "3459dee3-b0ad-421d-9e62-7c4caf6f88f9", "value": "1536:ktH6/YgweDfDLdRnB/IFDS10n1eWLOpN6ZTsKNrCQIErI+Oc0ZfHcS4t0Boorg:kmDfXB/z0ApAZoK4QP7F0Zfph7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617240902, "uuid": "8c469ff8-dcd6-4ef0-88c8-ea99c2d59041", "value": 66540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617240902, "uuid": "f9ed7949-aa51-46d4-92d1-3325a44f7509", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240902, "uuid": "44caec5b-982b-48e0-a368-2b8ed80cc1ec", "value": "dx3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c66d48-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617294744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294744, "uuid": "48d41d40-a055-4c0f-90a7-dd467a0e5e71", "comment": "Malware payload (IcedID)", "value": "3b5819b63d2e5a9ff8c7fa7598d3882f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294744, "uuid": "a817209e-a6c6-4218-8879-0c99e953403e", "comment": "Malware payload (IcedID)", "value": "1b86d7bc594f350a858c6daac515f8a93440b55241158bfb3e94243b06d8c633", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294744, "uuid": "e9a11584-9ba8-4b65-94d6-24de8cbc9fe7", "comment": "Malware payload (IcedID)", "value": "5fa4ce26363a37fd24b7b85d747cf3d91baac359", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294744, "uuid": "2fe712a9-a040-4cee-b5a9-90803ed61360", "comment": "Malware payload (IcedID)", "value": "410dc10734c5ca8935babefe16556e08b1d9896b0944d6af363d6446234a210a98fb5d8b8eb9ae296f12fed93efa0968", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294744, "uuid": "4c29cc4d-10ec-4c2c-854b-3928156b9f24", "value": "75838CCDC913E1D9C2559FBD5A09308512F4E0B72B6FF11B108EA62E4D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294744, "uuid": "81911e87-d552-4f0b-a3cf-c0e6e773f884", "value": "1536:IB240XZfcaaxf+EQliU2hawHCAIoo8+BNvMhfvbu:+2d1cBWEQXMH9o8+nEhH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294744, "uuid": "3e54e9fa-4004-4cc9-8085-d84e70918d77", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294744, "uuid": "143a276b-0efc-45d8-8eb6-1c559fa4640c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294744, "uuid": "a72b4e1d-022d-463d-8355-9e8ccf88618d", "value": "2184.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b94abc-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280996, "uuid": "febe5c9d-3ded-4b5d-aa6a-1c4b8bb048b8", "comment": "Malware payload (IcedID)", "value": "69ca2c1cf11ab9be7334a5c62f11d270", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280996, "uuid": "d950b44e-3473-477e-97b0-52adec9ea243", "comment": "Malware payload (IcedID)", "value": "1bd2f738d6276b34bc63a992f3abf579de91a6e30606ddac1c1b729466edc44f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280996, "uuid": "e0c2149b-954c-4a28-9257-dee4c536076a", "comment": "Malware payload (IcedID)", "value": "ae10a6495e1492050dd979af4e757fd912f98a6e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280996, "uuid": "f3851677-56cd-40d8-84c2-fdc744c2f9e4", "comment": "Malware payload (IcedID)", "value": "2a5b5906ac4b79d787414d98d7df2202d2aa60fbc3d0e1a14fb08325a18ff4a86a6fc3d82cdededddf8915c121197cf9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280996, "uuid": "0349728d-eaf3-42f4-9618-6863ad64bde6", "value": "B6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280996, "uuid": "06475bba-7548-4f56-9dcb-9397090e47fb", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280996, "uuid": "fdcad43e-06a8-47bd-bca0-8166de7dc79f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280996, "uuid": "95ea7cbd-46f5-486d-ab8d-579f72e50029", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280996, "uuid": "fd388c98-fd73-4e9c-9930-5b49f26455dd", "value": "document-389451465.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a48d6c-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277473, "uuid": "872b7d08-c907-47ce-b1ae-e203392dd94d", "comment": "Malware payload (IcedID)", "value": "26292eb487c8bb776302b6ff49d52644", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277473, "uuid": "855df76b-ced6-4d10-8105-a5e034bac6ed", "comment": "Malware payload (IcedID)", "value": "1bd43f2538b2bc05558069dcba33405504c439f0df0d9e5deb12674e28642554", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277473, "uuid": "cdcbf447-b6dd-4132-9a75-fc282a795d25", "comment": "Malware payload (IcedID)", "value": "eeb02262d92a5ef135f6bf5f2a5d44a6d8ce1aa8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277473, "uuid": "55657a94-8d70-471c-b238-af552520a7e6", "comment": "Malware payload (IcedID)", "value": "070659c218151dbba78c255a80fe31498522c22a9fd4caefd604f7f9690ae2e7cb60169687616a9a64cb190550dbf11e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277473, "uuid": "c07c3345-d50b-4902-97d6-d527383d69e0", "value": "B3044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277473, "uuid": "20a74c3e-d351-434c-a4f0-bdb47102b91c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277473, "uuid": "39a92132-b863-4b4f-8edb-1ab2f98ca60f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277473, "uuid": "3b8f5155-00d1-4f90-a79c-f5e33738ca1f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277473, "uuid": "42af668b-a7db-4f93-a45a-59e5e9c4ed8e", "value": "document-2037323645.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1c3f34-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277519, "uuid": "2f0b3941-f2af-4802-b3b5-81251de75b39", "comment": "Malware payload (IcedID)", "value": "f743e42390495b454f7c1144071a0658", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277519, "uuid": "69bf5a84-e925-460a-b642-1da70b7d831f", "comment": "Malware payload (IcedID)", "value": "1be1442f728094381fbed51807cc0c9ef3ebbf2507b5f84e513c019b8ccae865", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277519, "uuid": "9c711102-aa25-494b-b102-b7db1efac420", "comment": "Malware payload (IcedID)", "value": "9d921ed9881ddff90c39ef77b2b975f278a92dca", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277519, "uuid": "700f47df-d89d-4955-b544-a55f4e7f44cf", "comment": "Malware payload (IcedID)", "value": "5cdcd47be26811bccf35c606f2c35162787c5d428c26380598c22acafc5af3e5a18e6a154e31266d50cf88333eb04a5a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277519, "uuid": "58ba71a8-369d-4b33-9ad9-a1f1fd00b19e", "value": "E2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277519, "uuid": "dcdb5779-15c7-4a72-a808-065b19917c35", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277519, "uuid": "9ea59897-6f7b-430b-a0cd-fd1e34db3503", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277519, "uuid": "33001e00-7c32-4950-9cb8-e0c4e14a2d0c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277519, "uuid": "10a7fd23-9e9f-4fbc-835d-621aedf2f55e", "value": "document-723249988.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30be1bdb-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278144, "uuid": "f3e1062f-7788-42ae-81bf-4562b847650e", "comment": "Malware payload (IcedID)", "value": "2fd4ef99a24a38cd93f94d06df6302b1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278144, "uuid": "373f512e-1a1e-4227-b667-5aea756193ba", "comment": "Malware payload (IcedID)", "value": "1bfabf4b4e3f532fed68e3bdb6c3dd0bfa74f6a5aa14823be6ac057696b5aed6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278144, "uuid": "c4b6b30f-b644-4360-a618-9442810d2fa8", "comment": "Malware payload (IcedID)", "value": "f406a193f9a4d261a6e9ff3c38f331d8f8485a7f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278144, "uuid": "03cda03f-41f6-49c6-863e-57c8aed24dcd", "comment": "Malware payload (IcedID)", "value": "06574f5a392869975813e34d8b5fd8a52eabe4d22ddb67c986954e308543c78ecbd004e041bfc5979d984ab687863592", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278144, "uuid": "8ab00eeb-5792-486e-a5d4-cb4f954d6208", "value": "9B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278144, "uuid": "69f5b8f2-e25d-4497-bda1-25103d36d356", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278144, "uuid": "f46a1ad0-fb70-4415-8b14-3b0faa5aa7ed", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278144, "uuid": "5b50c170-eb23-4edf-83c4-8e5d334624f1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278144, "uuid": "2e3b5c29-af5e-4026-a34b-b596953afd55", "value": "document-64478607.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fa6f15-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281718, "uuid": "37103eb0-1a7f-40b4-8942-b1d3e916786a", "comment": "Malware payload (IcedID)", "value": "c08659f1f91c920511bd305ca8f91c8b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281718, "uuid": "91f53a7c-b1d0-4ff3-80df-5bc899c51d78", "comment": "Malware payload (IcedID)", "value": "1bfbcb4e91fd98e350fd8c5036c5a214fa729e9a344f0fff84a5bf17a32b3ec3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281718, "uuid": "a2c3d8ea-0ad2-48e5-9690-d9bbb40b4533", "comment": "Malware payload (IcedID)", "value": "733a6c86e6119bbec6905b8ca1af1cf723aab5a0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281718, "uuid": "cfdee085-118f-4790-958f-0f74fe1fdcfc", "comment": "Malware payload (IcedID)", "value": "5456e86adc62b258603bb46449a0960f886b29951d773bd991e9d203b7a5b5f1aa4d82f554c80893d2ee898e6c37973e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281718, "uuid": "d72e6500-304c-43e1-a97e-e25f47ce5eb5", "value": "E9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281718, "uuid": "0bbc3aa8-922b-4274-89e4-aa0eb161f343", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281718, "uuid": "e5ee05e8-29f0-45e2-ab16-ee5ab14efaca", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281718, "uuid": "59038456-fe51-4cc5-94d2-beddf09f1d46", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281718, "uuid": "d017c2aa-70a3-40e8-935a-4d562f970173", "value": "document-1042699213.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eaea192-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275295, "uuid": "2a8a8e69-f3fa-4416-9eb3-15191cbd511e", "comment": "Malware payload (IcedID)", "value": "16b64cf4237ea65ebc414a061de582d9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275295, "uuid": "a2986166-a0df-4843-b7d6-80fe6cae9c10", "comment": "Malware payload (IcedID)", "value": "1c1bdfe674eaba8abf5298c74294421f9978925ff11ac5467a2507186ff47519", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275295, "uuid": "5cd11fce-43e9-4429-b68c-d87637ad2cba", "comment": "Malware payload (IcedID)", "value": "bd9826a91b8181b4221c708722d14b67a52addce", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275295, "uuid": "b7b14de8-6515-4917-86b0-2442f97279b6", "comment": "Malware payload (IcedID)", "value": "cbac97a8ab6dd02f33f3048aab9fc52713b7ccdf92ef271b1951a3c96845859c6a2abd6acae3bb554358002c996b5bc9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275295, "uuid": "f0e5114c-bbfe-44ba-a7f4-2f46c8a1d6e5", "value": "93044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275295, "uuid": "324a75ee-4a9a-45fb-979b-4c461e97ec89", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275295, "uuid": "92c9a665-cb8d-42ea-b0c7-923cefaaa63f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275295, "uuid": "3861622f-d589-4708-90d2-ea4a5671a6e5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275295, "uuid": "b8571c07-0100-4ed3-9409-8b40846df1e9", "value": "document-1714859425.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9463bf1-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280977, "uuid": "3e9d6c04-234d-43ba-99f1-06599e9171fa", "comment": "Malware payload (IcedID)", "value": "c804ebbb81e107a1763bec3afb61feb5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280977, "uuid": "b8b29296-9473-4ff8-acda-786f14e53b2e", "comment": "Malware payload (IcedID)", "value": "1c217d03027b0c7452ba0209dc42012dd022c3efa3426fba4076b2dd8dc20f58", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280977, "uuid": "a90e0082-644f-4699-a0fd-c2eac7ee7ad1", "comment": "Malware payload (IcedID)", "value": "27814f3f401ea2e68ac50ee47952591507adb190", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280977, "uuid": "4414c4a9-ced1-4ee0-a9d3-bbf3bf3ef583", "comment": "Malware payload (IcedID)", "value": "83c85189fbb0c18c1419f224aa796bdb1ff70b16c22ae6962234dfc2eb0d106bcbe32f28f99a34839d282939f9d56371", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280977, "uuid": "ffbfd78d-6a38-4e00-8ae3-07ad11931779", "value": "B5044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280977, "uuid": "c1f49bce-0164-4360-b6cb-d44861ec777f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280977, "uuid": "f695eaae-2831-4d0e-9e9c-4c95e07b908e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280977, "uuid": "c74a78b5-4c4a-4996-8a46-460ae7d219e0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280977, "uuid": "2b4fc616-33b4-4c92-9504-b4988019d838", "value": "document-1272392398.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f64856-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281693, "uuid": "d0508683-e75b-4d8d-b86d-6dd99ed122fc", "comment": "Malware payload (IcedID)", "value": "d28caa5feed26af2575763f14fe5f356", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281693, "uuid": "a497910b-3d04-4923-ad20-9a555c87a992", "comment": "Malware payload (IcedID)", "value": "1c354d0abfe68143d70dfd5074640d6f408a2ee41721829439a70c3d0a00970f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281693, "uuid": "e32c616c-9229-4e3c-a4b1-bb450cb01732", "comment": "Malware payload (IcedID)", "value": "77cbd2e7246852dfdb6a93b91c6588742de26853", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281693, "uuid": "16142a96-1bbe-4d25-818c-9a6fa2cbb77b", "comment": "Malware payload (IcedID)", "value": "e0f2e5779eb16935abe61812ae026d9b349ae6da5847ee873fc86a176ab978b571803ebdffb979bd0a83a465d1cb60f3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281693, "uuid": "5d66c4d3-979c-49e0-9630-7fce3be1d207", "value": "98044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281693, "uuid": "81f9faf7-d320-42b4-8e25-e45c66e034d8", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281693, "uuid": "052adc26-3fb8-469c-a890-162e14e0ced8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281693, "uuid": "23f494d1-3152-4953-807e-e008b15125b0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281693, "uuid": "a7a42163-7409-4876-8266-d306dc5d5c36", "value": "document-1302325198.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5653e0d6-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279925, "uuid": "2f513747-1c72-433d-8a43-2e51cbe46780", "comment": "Malware payload (IcedID)", "value": "f4f073595a37610f84821fd211541a8e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279925, "uuid": "5f83ca86-21a2-4b30-b6fc-465f015d0cc3", "comment": "Malware payload (IcedID)", "value": "1caa7dda0c0b1189623e867722686aadb916d2267527c483bc1e7f8ad4285648", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279925, "uuid": "be228605-2d9b-42c2-a119-ac7adb5b7c70", "comment": "Malware payload (IcedID)", "value": "309a09e33ddd2855c71441a2cb46602e8197fc05", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279925, "uuid": "e52395bf-f3fb-47ee-acc2-793ea2168a11", "comment": "Malware payload (IcedID)", "value": "4a615d473f7419289db5b9f2b61d87b1df12ebabdae99839793ff3e088d65aff4b7d0d261b2c6353a147f363c8da8b4a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279925, "uuid": "ce1384cd-6729-440e-b0ee-983d3f579d71", "value": "73044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279925, "uuid": "742770e9-9df2-4c2c-96f6-c52e971771a3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279925, "uuid": "195ec01c-902a-45ce-b886-e91d59cd4d70", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279925, "uuid": "ecf6c552-ce71-4a5d-9d93-1ad0b6216f9c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279925, "uuid": "23511197-de95-486d-815c-d0d24b5ffa7e", "value": "document-1579869720.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3744d650-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279014, "uuid": "59743298-f8c8-4659-85ce-606909bd70cb", "comment": "Malware payload (IcedID)", "value": "43c1b9686d675a4c29a361c34c8992d7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279014, "uuid": "f6a41c64-1d5e-4b25-b74b-ddf7c65f5114", "comment": "Malware payload (IcedID)", "value": "1cabe562b2f2a2c7cd4e9c1899a6e706d7564c8956e785a5897e8726df204442", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279014, "uuid": "d28bc538-e5fd-48d3-aa9f-9f494d92459e", "comment": "Malware payload (IcedID)", "value": "60cf57c1fe5e13bb755519585c6d52922f9e49f9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279014, "uuid": "fd2858cb-83e1-40fa-a8e1-cdace8178745", "comment": "Malware payload (IcedID)", "value": "d245d10e0c9b91e2172d7575f5071accadf768c655ebc17decc269fae2c96c47488d205695f1831d99fa248ff478abee", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279014, "uuid": "064644bd-de0b-43ab-aede-7e38a435307c", "value": "F8044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279014, "uuid": "e62ddb2d-82ec-4979-8f15-20f63cdf2afb", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279014, "uuid": "e7fb085a-e8a5-4d5e-a745-7285185ab8d9", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279014, "uuid": "01443c44-a57f-4d89-8dcc-ceb9b4856465", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279014, "uuid": "c23bc916-aea8-43aa-8e3b-a91b5f22695b", "value": "document-1026120795.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8013b3-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276929, "uuid": "8f36f0a8-dcdd-40f5-ac0d-6439b9cdacfd", "comment": "Malware payload (IcedID)", "value": "f09438806456da98938c7922ddd2588a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276929, "uuid": "ff519878-7d1e-4861-8798-996f22cf935d", "comment": "Malware payload (IcedID)", "value": "1ce744bc1c6d7b5521969eef8b645cbabb30dfa4081cefcfe076a1848c1b551c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276929, "uuid": "dfbad261-223d-4653-b57d-fa616f1994f4", "comment": "Malware payload (IcedID)", "value": "a5a09fda9b7953f28100b75b1a2dfd189365bbff", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276929, "uuid": "dd1e66ec-1f5c-4bfc-9382-b7a3e54a0eff", "comment": "Malware payload (IcedID)", "value": "fe4722000d9dbc8c43baa28f721ca90d403bf876fbd46f5742a721a5f91d5f699010492f798498a476c43fefa0a91864", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276929, "uuid": "201069fc-14ca-4bc7-bc36-db35baed6ccd", "value": "DA044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276929, "uuid": "dcd09c3e-31d8-430c-b828-ca2a84cfd471", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276929, "uuid": "77d07f26-49b1-464f-818f-15732976fa7c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276929, "uuid": "1135bd24-2624-4f19-bf84-90df39fbefd6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276929, "uuid": "ed7a1f70-bc50-4f12-bc70-8ab44b2e3418", "value": "document-1610255607.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baa2332-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279048, "uuid": "8c7212ea-e128-4b03-a18f-7eff836fc304", "comment": "Malware payload (IcedID)", "value": "91667a0fc86223a7ac74002c1e8be04c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279048, "uuid": "fe2347f2-5db7-4c99-9e56-66bdec3099d9", "comment": "Malware payload (IcedID)", "value": "1cf2079c50cce068fd6d314b19bda5e4a05c05ea9497b0a6680cbe298acef201", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279048, "uuid": "89792e84-f01d-48da-82ac-c161b02160a4", "comment": "Malware payload (IcedID)", "value": "df3097eac079c23845ea6c95f8f3724f47999e4c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279048, "uuid": "05e9ce2b-8661-4212-b036-5f4ee9e43335", "comment": "Malware payload (IcedID)", "value": "7ec01037608b13e8894a28097f4fe33ec88c0556b72fc70c2170df79428cd249d84ce007956ef5a9bb27fe0cb8266d67", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279048, "uuid": "4f848c25-2f11-4543-b105-e0a4039a68da", "value": "B9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279048, "uuid": "004d9567-ec72-480b-b72f-3a958d992f32", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279048, "uuid": "0279e9a7-d481-49ed-b928-5b3568317739", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279048, "uuid": "b317e208-f96c-498d-9242-dbb88102e026", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279048, "uuid": "30f496ae-f8af-4487-a62d-db141635a4ea", "value": "document-1879644087.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad7dfd6-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285892, "uuid": "75e85b17-e659-48d8-95ff-7a4d8cab1425", "comment": "Malware payload (IcedID)", "value": "b4550f111361d432164f627ee418e0c2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285892, "uuid": "276780e8-a9e6-44cf-93a4-34fffcfd9322", "comment": "Malware payload (IcedID)", "value": "1d1312ab933ca3b2eefb839ec8dd84f98f0dff3877d6ac1321e608c5047a7129", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285892, "uuid": "cbd4dd5d-7fea-4e10-8e4b-185a584fcdc8", "comment": "Malware payload (IcedID)", "value": "76d06694b414a828eca6d30db3501142e4224343", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285892, "uuid": "3dcb65cf-ddb6-49c1-aa7e-717a7ca8e3d4", "comment": "Malware payload (IcedID)", "value": "08f8c2f16198658f8bdbfacb9acc038ab087414951541ff546359236b9831a888c283ff883e3ce6d76219a7df08ce32b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285892, "uuid": "8ee16f28-39db-442b-a039-c1a9184d2738", "value": "FB838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285892, "uuid": "f59216cc-9a40-4eec-9e5d-bdf1591f731a", "value": "1536:IB240XZfcaaxf+EQliU2haw6zCAIoo8+BNvMhfv4yp:+2d1cBWEQXM6z9o8+nEhHlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285892, "uuid": "3deb748e-145e-4a7b-9e04-e05d1e69eeba", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285892, "uuid": "8688113a-c52a-4c7a-95d9-4756da64d445", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285892, "uuid": "ee331587-2e02-42a9-b876-32c6bc51693a", "value": "1768.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4069dd98-92fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289767, "uuid": "d26d2ee8-a8ab-481c-a806-6adc92cc9d98", "comment": "Malware payload (IcedID)", "value": "2fe4a4812569055657fa53f5ab912d8d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289767, "uuid": "62c0d7e7-bcc5-411f-8ded-57ccaf71e9fd", "comment": "Malware payload (IcedID)", "value": "1d646101358012ed7e7745c403d7c26e2cb268224ba50143cdc8bdb6f10c1272", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289767, "uuid": "fe3ee7c8-8f0c-4d13-b750-ae25b489bfd5", "comment": "Malware payload (IcedID)", "value": "fa24337ba52687f7e72e6778f2a0568fd3f12ef6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289767, "uuid": "a8afcf83-2b0b-457a-8b0e-36bb17f51e35", "comment": "Malware payload (IcedID)", "value": "7e131fe6a318773c09b36adf0cb4f6d9a983cfd60e76c28b4600896003b6bab79edc1dd310c4a0f82a64923c11fcf292", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289767, "uuid": "f19d6ea0-770d-41d4-9c44-9560328580cc", "value": "F8838CCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289767, "uuid": "0ecf7cb0-4f68-4542-97cc-f0e93b844b8c", "value": "1536:IB240XZfcaaxf+EQliU2hawtCAIoo8+BNvMhfvOi:+2d1cBWEQXMt9o8+nEhHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289767, "uuid": "201e1562-2e57-4601-b644-c87d7492828f", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289767, "uuid": "037db464-2a74-4d4b-98c1-031981dffcf2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289767, "uuid": "1a6b3fd9-6d5b-4b96-812a-f909557ec19d", "value": "2316.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a7d954-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291445, "uuid": "38b5dd43-4f3e-4bf7-a1a9-721abd30b620", "comment": "Malware payload (IcedID)", "value": "05507bf29f922f9ef6451e02c0cd647e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291445, "uuid": "ce0c34da-0496-4fba-8431-701fd26df193", "comment": "Malware payload (IcedID)", "value": "1d687b427c10fb767c4de42a22c06b88f95916c3a2db9a1c1527011960eb5285", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291445, "uuid": "e258df45-36f5-416a-8667-2cedc0c61442", "comment": "Malware payload (IcedID)", "value": "6cbed90f20068ca806f82f40d6bc2704ed2be9e6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291445, "uuid": "ed681fdc-e5a9-4c81-ba7b-3304b9cf0085", "comment": "Malware payload (IcedID)", "value": "f6fded56c3ef81dbdbcc39796c33f752c476a6e7be3f3df568bb3b20c6ab51bda8476ee8833cb74ddf975084519ee287", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291445, "uuid": "c22a7057-036b-4334-bc57-d326be65517a", "value": "3A838DCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EA62E0C42FA80A5E7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291445, "uuid": "c2dbea4b-b8e7-46b7-9ca6-537b7ba6d448", "value": "1536:IB240XZfcaaxf+EQliU2hawBCAIoo8+BNvMhfv24:+2d1cBWEQXMB9o8+nEhHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291445, "uuid": "86993199-c7cd-4664-99ea-bf45e0a75f45", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291445, "uuid": "6893eb5c-0eaa-4c84-ba21-436ce8c8f415", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291445, "uuid": "943299cf-d0e2-4d36-8af6-3c32ad4a8119", "value": "3091.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d79ef5-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276274, "uuid": "f2870a34-ef25-4bec-ace5-820ef4b0d163", "comment": "Malware payload (IcedID)", "value": "c3ec904fadb8dcbeca7b371448e50a01", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276274, "uuid": "1be5cabf-a1a4-45c5-a483-52dc4b6e4caf", "comment": "Malware payload (IcedID)", "value": "1d8476245cf1d53a6b4fae537e2cbee6e72a10efbd96af33be945d514bd8008a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276274, "uuid": "db2a015b-a390-4bbe-afd3-c8f1a5d3337b", "comment": "Malware payload (IcedID)", "value": "5b6e19a41971414ceaa22ae5b1cc2922de626f15", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276274, "uuid": "9d3aab90-56d6-4246-8069-1a10cab4ca69", "comment": "Malware payload (IcedID)", "value": "2f892c39800f80006a4263dbde05f54f6b19a81f913d2b96afed364f919847e3245820c4d2c4c33dc811dca9199a7b41", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276274, "uuid": "0ed468a7-48cc-45a0-bbaa-9115ea9a1d3e", "value": "9D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276274, "uuid": "b99c3c94-75b3-4bb6-928a-0d7682d689a6", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276274, "uuid": "9976d4ff-0e32-4da1-bb85-af8b2fc95677", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276274, "uuid": "508be14d-7cec-45d4-bce7-3dd458680232", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276274, "uuid": "0cedbcd5-814d-4d8d-8009-4001d878ba9c", "value": "document-865046966.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f7248a-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275898, "uuid": "800c1913-deb5-4e19-be03-4c19b357a04e", "comment": "Malware payload (IcedID)", "value": "e1e3971532a74103a6413b7fb56fdae2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275898, "uuid": "5a001587-fd21-4fd6-8f69-1dbd4856359a", "comment": "Malware payload (IcedID)", "value": "1d92a4d6dd61ff850849fe8ec8efd4beb893feea3b123f155759ae51080c7929", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275898, "uuid": "f20ea835-6629-4cf7-92e8-3064511d1f6a", "comment": "Malware payload (IcedID)", "value": "98354a236e855818fa7b400ed3c836bd53ddea07", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275898, "uuid": "3d148cbd-3394-4b27-9695-39fb5831dae3", "comment": "Malware payload (IcedID)", "value": "c916b683e288e98417dbba5b530b768d93394cfc7f4a173d9e6489e19aec73f7ab9987f99b6cc31c74a0e75f18caa245", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275898, "uuid": "a1f39d55-bb2d-4d8f-ab5b-f03eb32c7c97", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275898, "uuid": "a980258d-2377-4ddc-a055-4c8153a6b7f3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275898, "uuid": "5fffcc80-0175-47c2-9cf6-9bb35041c753", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275898, "uuid": "3aa057b8-c245-4a62-b4b1-b021e2f9ac66", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275898, "uuid": "a62a80f1-1e0d-4ed3-9bfe-bc61004a5360", "value": "document-767643424.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adc6d17-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275289, "uuid": "9e588770-16fc-488b-bca3-892dc83900e0", "comment": "Malware payload (IcedID)", "value": "e307176fb0d2198c60fe83dd39faf109", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275289, "uuid": "18a77d35-4d8d-4249-a37b-ed14e330073e", "comment": "Malware payload (IcedID)", "value": "1d9c74a5d862938d6c7a64164297e471bea8bb762f57bf37b96c1e39e63bf6fd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275289, "uuid": "03ae1c8f-4d03-47aa-b713-3dc7c3aa8623", "comment": "Malware payload (IcedID)", "value": "2b5ec0011edbaccf85a62b5b5473035a1ef34b10", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275289, "uuid": "b5963990-d342-4a31-bc0b-87d5fbc15784", "comment": "Malware payload (IcedID)", "value": "743a778a2d3047c4d033139735f9b0a911f0aa5b9fbb4457c77b0c515810c24c907f00c60542ab45056ce9b6f7265014", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275289, "uuid": "bbea95ca-d392-4ea4-a9ab-c00db63dbdeb", "value": "E7044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275289, "uuid": "3edc7be4-4378-434d-8538-aa804e3f9fd9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275289, "uuid": "1f76d390-3792-4de1-b597-b658f625652c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275289, "uuid": "b9c4eda2-bae7-41eb-89ad-b40b6a509237", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275289, "uuid": "eb3a7239-cf43-4652-a649-99922fc3fe77", "value": "document-981856187.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920b37bd-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281744, "uuid": "a4deccc9-f599-427f-a639-e1dfa936b3c1", "comment": "Malware payload (IcedID)", "value": "eac3d021fb0bafe1b80cb4fcb2d85c5f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281744, "uuid": "a59e7649-0b16-4caa-8ea8-5919e6ca5660", "comment": "Malware payload (IcedID)", "value": "1dd894950ea1d7564b284aaa7127b988933cc2d6441bf631f0490c4fffe7d464", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281744, "uuid": "45674be3-3ee6-44be-8029-ea5c578b9c68", "comment": "Malware payload (IcedID)", "value": "ef5a364581fa2d87bdf37a880378b58bc3fd99f5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281744, "uuid": "e71a02e9-e7cb-4372-982d-c3b495d6ae6a", "comment": "Malware payload (IcedID)", "value": "c2d0fdaea7ffe559cd01ac31abc9f95232387fc00610112d113c484ed35e118a32eb14c8f6a7823cf00b630f5d7d553c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281744, "uuid": "6d802796-41ef-46c7-9e7d-2fc34063689b", "value": "26044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281744, "uuid": "1d56542d-f674-4c20-9e98-3ca530bcb970", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281744, "uuid": "64c95f57-e783-4b03-8cdc-2a4b1330679b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281744, "uuid": "c748f9ad-cab7-4ed4-9506-f280246244b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281744, "uuid": "1700a097-6c63-4a5e-b816-15f94da34f68", "value": "document-1641473761.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2140ee-9292-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617244500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617244500, "uuid": "e953b3c1-a558-436c-8be6-cacfc5f549d4", "comment": "Malware payload (Dridex)", "value": "4920ad0a9905724317e84b09b24f4c45", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617244500, "uuid": "6dfbf14b-d55c-4b3c-82ca-6b3a8dc89ade", "comment": "Malware payload (Dridex)", "value": "1e19d25d3ef51f2b3ddd8b86e36e09cc736da46d0b5272f86d778aa64b3097ed", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617244500, "uuid": "a3d20724-4822-47df-9440-dd9fa388fd05", "comment": "Malware payload (Dridex)", "value": "1be9a7ea40e8d02c8925fca08f2566518ed0ae15", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617244500, "uuid": "7ba82dd7-c58a-41fe-9bba-a2d99a9d9604", "comment": "Malware payload (Dridex)", "value": "9946b12d6d484c0bb7d556a031804277635f41f5099ba38f15206e9888f612f41f7803993e40531289ff0612a16917f9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617244500, "uuid": "e41ec258-117e-4b72-9c28-ee576df22d2a", "value": "E6248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617244500, "uuid": "911e2bfe-2f5b-4a7f-8d1a-406450bebca1", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617244500, "uuid": "64f0cc7e-8e74-4671-944a-8496ee26b8c3", "value": "3072:N6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:NoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617244500, "uuid": "95e9aa74-6539-49fd-9bb7-12b3d0bd919a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617244500, "uuid": "a5d59702-de5d-44c3-8c9a-917bea62c3b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617244500, "uuid": "7b9d34a2-f343-44f7-aebf-a223018bb343", "value": "1e19d25d3ef51f2b3ddd8b86e36e09cc736da46d0b5272f86d778aa64b3097ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac6473c-92aa-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617254700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254700, "uuid": "3bda4420-04ac-4aad-b8bb-b7568a2439af", "comment": "Malware payload (SnakeKeylogger)", "value": "291916f2b956fc9eecd011d753423141", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254700, "uuid": "72ce6992-71a1-4204-94ec-b043025fe668", "comment": "Malware payload (SnakeKeylogger)", "value": "1e5d4dfd192a0b6f0331eef416d427e09540df64bdd26f377eecf00d6be3e5fa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254700, "uuid": "c7311207-e517-451a-a22e-4c44fc155df8", "comment": "Malware payload (SnakeKeylogger)", "value": "63361932adaa9f1808a55bd8a35628e22905a4c8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254700, "uuid": "1759ac6b-b877-46c5-be3e-2b352bea7826", "comment": "Malware payload (SnakeKeylogger)", "value": "36ffdedb881c6064cad4563e0e137d0c83d9142eb0da4338c1c29efc80b43e37df65d85ca1336e1e40a777551a051223", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254700, "uuid": "3c3ad3bc-298c-4baa-b3d2-3afd8ede61aa", "value": "CBC4237ED2F16173DA138695905075794056B8F22C7AABD85BBABB4BDB043C23CA0373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254700, "uuid": "2ecbb950-b219-4aeb-bca7-9274913bd872", "value": "12288:bG5yrcV61u+FI74IQ2DecwSN72lrfKTSb/501tXE:14NtQSM/yTSb/W1tXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617254700, "uuid": "d2dc0eee-f77b-4023-8733-fdaf07074481", "value": 561077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617254700, "uuid": "136e38a5-1a4a-4f02-ad83-b8684c4a8df1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254700, "uuid": "dcfcaf2f-4756-4e90-a37f-90d375bd4ac4", "value": "ASB Swift Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7de7b59-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (ModiLoader)", "timestamp": 1617262104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262104, "uuid": "ba942392-a2a2-48e8-811e-1433b68c89d3", "comment": "Malware payload (ModiLoader)", "value": "511d7c7698bb3ca5f22326828bbd314a", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262104, "uuid": "4a94565f-6ac0-44bf-a560-39111a4b828a", "comment": "Malware payload (ModiLoader)", "value": "1e5d6b0ee06ea48950a4c8b9ae187bdae33e6d12b01458af9aeeb5f0b8c521fb", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262104, "uuid": "1f80f14c-5ffb-4384-aab2-20fde962e8ce", "comment": "Malware payload (ModiLoader)", "value": "f4cfa54b2d15395039ba8f0a9d05064a68177ddb", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262104, "uuid": "bda1f569-ed88-48fc-9725-7dadf9c7c6c6", "comment": "Malware payload (ModiLoader)", "value": "3f1be756b0433cd16cbd1ed403d8dd649e1db53e131514fffc2f9da4b8e8e114726a1061b3d356841ef9141e0b75fec9", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262104, "uuid": "de61a328-0280-47a8-b226-8fe019e236a0", "value": "F2459E26B3E14476D1B3257C8C1BB7A59825BE513EE438463BF42E4C9B3E3A0B92C157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262104, "uuid": "82b99242-9d96-444d-a230-1b6fc6e7ce58", "value": "12288:64E6Ax8b3EAWv/re0t//WxpMLmYXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXi:6xu3EAaD3gWLdXiL4Ujp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262104, "uuid": "7e3e9ee8-3371-4141-a36b-24be948b76ac", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262104, "uuid": "8bcede78-9928-4019-ab0a-c359fd56f1f8", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262104, "uuid": "3bbb8941-14f7-4e48-b5b1-5de9ee81f24e", "value": "Payment.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceeba884-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617262089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262089, "uuid": "10b07ecd-e0e0-4aa8-a532-dc688b446474", "comment": "Malware payload (Formbook)", "value": "345180ef81f710d13f3d7b716e122af0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262089, "uuid": "7b09dfb0-16b5-43b2-8f9b-3796bbed91fa", "comment": "Malware payload (Formbook)", "value": "1e611229c8134da9ad73355d1fd35e32274764adabd0abeef797c70127831164", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262089, "uuid": "44e2cf53-37ce-4044-b990-38dfebf1f0b4", "comment": "Malware payload (Formbook)", "value": "964d0ed00aeee5fc91a88d0757afe076f447e56e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262089, "uuid": "5c84f4cb-c3bb-433c-ac70-1f38d4bbdde4", "comment": "Malware payload (Formbook)", "value": "fbbafbb758c2b301d00fb40be87fc17028e071b0876366c42c8697dea92afbab08794fc898b84272a25b11cac703ffbb", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262089, "uuid": "89e41d1c-77d9-4200-a810-636ce8df33c5", "value": "CF94232826EE4F6217617F3EEE90B9B4D1584731F61992C510774323A3CAEC289D3BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262089, "uuid": "2f04e99e-bfed-4e56-8483-1fb4c4d4a49d", "value": "12288:HhhXkiqXS+F1oLfXWAzXorIxtfQeYiDfwfJLVI:HUi3Q1oLt7orsfdYwww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262089, "uuid": "af8b0847-bdc4-4477-8aa7-7f9ec5164326", "value": 427652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262089, "uuid": "90e41882-a5c2-4aa1-a034-fdb035346b7c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262089, "uuid": "8a500736-7076-462f-8d73-e0fec756a788", "value": "QUOTATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19651c80-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291420, "uuid": "fa9f09b6-1e35-4645-8e79-30aba65963c4", "comment": "Malware payload (IcedID)", "value": "039e247234c07b324a9084b4a52ffea1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291420, "uuid": "a2535657-9e68-4e54-9c21-7d0c22a1aa3b", "comment": "Malware payload (IcedID)", "value": "1eb3d6922a41a9b43fc46b8b37077f016b823fd4763f824cb5ff2e1e4e8f8232", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291420, "uuid": "8a7b3a19-55d0-4626-89ea-0de6235b3bfc", "comment": "Malware payload (IcedID)", "value": "7f85d640996bf15e3df81db5be91aa9b056ba0a9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291420, "uuid": "e40ddd59-72a3-4af0-83ed-27f14321f6e2", "comment": "Malware payload (IcedID)", "value": "d23b035a5622ba0b702da25d14acf4e2fe3e64414ff44ab2cc13a6c18f8e0b1dffb810d12c60611bb8091a9d00ae04e7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291420, "uuid": "38a6f8cd-f8bc-41be-b8d0-176a62f42a81", "value": "F5838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E0D42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291420, "uuid": "a1c00062-a2cc-44cc-8e25-288a14edb934", "value": "1536:IB240XZfcaaxf+EQliU2hawrCAIoo8+BNvMhfvC:+2d1cBWEQXMr9o8+nEhHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291420, "uuid": "041107fd-052f-4d59-8301-30954c425104", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291420, "uuid": "3a284b4c-50b5-4a63-9901-26407e9fd5c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291420, "uuid": "fbf2bfc9-bd57-4883-8076-64417c23de08", "value": "654.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacb2c8c-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277517, "uuid": "0af2a198-ee23-4727-81eb-ea03d3856a2f", "comment": "Malware payload (IcedID)", "value": "b37bf167e6127ba557e82c9ad4f38fbe", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277517, "uuid": "ad1e9671-68cb-406a-a4c8-bd69e1ea2690", "comment": "Malware payload (IcedID)", "value": "1eba6c15082796fce2661a7050d855358a44e066f1b011177a3193e00ee01f98", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277517, "uuid": "3053e0ff-21dd-41ab-affe-9d81afe82a80", "comment": "Malware payload (IcedID)", "value": "4276938dfa56c698619aade3736adea8afda2d9b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277517, "uuid": "bebfa38b-3c9f-41ad-b714-40fb6c207846", "comment": "Malware payload (IcedID)", "value": "23652e0933b23d1e291c80f8c9801b64d74d72f436e0fb8f0fd77f9c9e66cfa969c4fabe5a40263fc6c2c510e258c5a8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277517, "uuid": "9fcd502f-02fa-452b-9cf7-1860fa75263d", "value": "C8044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277517, "uuid": "71d81ac3-f8c3-4971-ba91-584a53517ddc", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277517, "uuid": "5d583a34-dbe4-4e99-90b9-297633651584", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277517, "uuid": "c7713eb6-8811-4293-b67e-c683ff1a2b5c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277517, "uuid": "a27fbf58-fd42-441f-b4ab-e88c22a62c4a", "value": "document-966893371.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f01b421-92cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617269551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617269551, "uuid": "571ce6d2-9ef3-478c-8edf-f0532e922371", "comment": "Malware payload (Dridex)", "value": "590db0a37e288cb42236a77414b089f6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617269551, "uuid": "4f7d1ab7-8e29-4f92-b1ad-dccb0f81cd84", "comment": "Malware payload (Dridex)", "value": "1ee0d5aa52a1e7046bf2d4c4aaaa5d7a35379167c7f696ff564d8f66420271b7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617269551, "uuid": "b0146d6e-45d4-4041-be9a-52aadb44f053", "comment": "Malware payload (Dridex)", "value": "3bbdc7d62687aa29a7bd49bfc1ffc1d1584d697d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617269551, "uuid": "b68e8c3d-aed0-4d40-8b1c-43b988982250", "comment": "Malware payload (Dridex)", "value": "9af4258b18e0fa099826b6422307d323fb58ef59670b1537492c6e523b733ef7194718fa0d43712dc24322645440399b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617269551, "uuid": "1a6f1731-aaee-427b-8eed-d0057a098724", "value": "67248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617269551, "uuid": "5092dc17-901e-48d9-9f96-ddbf83b4eefb", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617269551, "uuid": "b87f6a57-5081-48f2-830e-1126713a8784", "value": "3072:C6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:CoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617269551, "uuid": "c7bc082c-af79-498f-9a75-28fa2b832b1d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617269551, "uuid": "392d59e8-5524-49c8-96e1-80d330f80d8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617269551, "uuid": "89eb6aea-8ca1-4372-9b0c-6029c2cab66f", "value": "1ee0d5aa52a1e7046bf2d4c4aaaa5d7a35379167c7f696ff564d8f66420271b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0c0916-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276289, "uuid": "d35edafe-5235-41f3-8636-22cc877b5ce9", "comment": "Malware payload (IcedID)", "value": "e14aea34e3099484fc826b428a3a7fba", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276289, "uuid": "a7951ca4-9ce1-4e2b-a2c1-7a2437fbe350", "comment": "Malware payload (IcedID)", "value": "1f1fa361249fa5ecff8481df383bd45091fbf421d43a9a13a08a7ed7176ad356", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276289, "uuid": "7f2f2886-c185-4b8f-90b7-a46503ead300", "comment": "Malware payload (IcedID)", "value": "10687ea77cda02f1ae961db277a38773823ab555", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276289, "uuid": "fb46fc64-f791-4e2a-a273-21fc16ed0662", "comment": "Malware payload (IcedID)", "value": "63b254dbe787d57735c22985ec835960f393b3a1aea24b6e647e5d29ec7f45173ff43ea2ba809a3cafe5e70e19932f05", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276289, "uuid": "aed153af-1669-48a6-a6c9-471b4f8733e9", "value": "41044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276289, "uuid": "421da70c-7ccf-4736-81a6-15862250d727", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276289, "uuid": "02dd7f36-caa0-4642-a25d-d8d98eae9bba", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276289, "uuid": "10a9eb2e-bbe6-4732-9507-6b23fd4f0aec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276289, "uuid": "4eacd2b7-de73-4d0b-b38d-6090c39fa043", "value": "document-1465421967.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8643de6b-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281724, "uuid": "87219fda-71bf-4892-963f-e817fd067e7e", "comment": "Malware payload (IcedID)", "value": "151b8d1cf97b56812fbd57b80158d927", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281724, "uuid": "b69b095c-675f-436d-868d-d499c2b99573", "comment": "Malware payload (IcedID)", "value": "1f252c8f32ce2729aecd66909cbc96d4e6e413efc7e5d00fc175637df91dd183", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281724, "uuid": "0a765b0f-86da-4f95-88eb-316b6ae639b3", "comment": "Malware payload (IcedID)", "value": "395e760aa69ee459a48236d411e4d09187b01265", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281724, "uuid": "7852978c-2ded-431d-8dff-bdd9f55661db", "comment": "Malware payload (IcedID)", "value": "af100965d50223ba7d0bef9553e386ff312e3bb20f2f61f691624371b0e59ba70b0867209a926bd61b801eed0a5edffc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281724, "uuid": "4cf87c7e-7e9a-487a-8e2f-86e185e24a31", "value": "FE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281724, "uuid": "f4e47b90-eb70-4b9d-8d79-9e3ba2741c5e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281724, "uuid": "482866cd-3bac-43e0-929a-03e0f39a7f62", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281724, "uuid": "7bf485e8-550d-43a3-9c8b-9cb9b78bb1c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281724, "uuid": "52c5359e-8ee1-440c-855f-57db5a03406b", "value": "document-980795635.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e5f7a8-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287781, "uuid": "81e77267-c32f-4c9f-9aa0-320276992bf2", "comment": "Malware payload (IcedID)", "value": "0bc642ebe8088b3a932de1da62933bd9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287781, "uuid": "083846bf-0ac1-4104-8b8c-9a1d6d65b327", "comment": "Malware payload (IcedID)", "value": "1f7b8b881f7006c86e177d7d16d659755184cc858b02a2a4b0c57e432ea505b1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287781, "uuid": "29ed97f6-ebdf-4a96-8459-9bac43ccf8c8", "comment": "Malware payload (IcedID)", "value": "17e68037758a16712581013ece8946647675a28c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287781, "uuid": "0adb82b4-c240-4acf-8437-e3e731723265", "comment": "Malware payload (IcedID)", "value": "1f0b76f58fe99f1d7f3ef4e4cd91de8494f1d65bd19786196ad5fd59213e9e22a6075252257d227ee798ab1c2b6cec72", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287781, "uuid": "9d1508b2-ec58-4ce0-9b2f-1a1db08dc9d6", "value": "09838CCDC913E1D9C2559FBD5A09308112F4E0B62B6FF11B148EA62E0D42FA90A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287781, "uuid": "63e9944a-5b97-47a6-8931-01e41e46e310", "value": "1536:IB240XZfcaaxf+EQliU2hawuCAIoo8+BNvMhfv+L:+2d1cBWEQXMu9o8+nEhHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287781, "uuid": "865ecb1b-c0e5-4758-8b36-0944ae5beda9", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287781, "uuid": "3caf0d1b-1aa2-4f28-943e-94e623a5f737", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287781, "uuid": "657d845c-e14e-4dd7-b7a1-9d3b9f8d1525", "value": "1670.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17576260-9345-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617321051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321051, "uuid": "2dbaa490-8aa3-49d6-a820-87456d6df48c", "comment": "Malware payload", "value": "9dc1cdba6d5838f7984de89521f18ae8", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321051, "uuid": "79113403-704c-4357-88ec-73c53696e39d", "comment": "Malware payload", "value": "1f9ff969479ae43d47a109712d05a084490c1d7ad38aa50bef2b1cd20f5037be", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321051, "uuid": "db5bcfff-8238-432a-a6ce-c4d3ca5c5821", "comment": "Malware payload", "value": "80d00bcd9ab9be3054ebfa20eb22cef9aadfcc49", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321051, "uuid": "7ff8f9d3-7b1e-4b14-b865-abd6ff582e15", "comment": "Malware payload", "value": "d97619e0bfbf2eb5817d9a79b4d9efb6e8dd9c111edd8e50ec5c0ef7656a2c6a2073cfabd6821ee7eac37ba79497fc86", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321051, "uuid": "e0dcd50f-78ab-47f0-830d-a4c9c9bdecce", "value": "08B321941389419DD26E3521369B7D282F13FAEB5FCA1F218E6DF53A0F696133408A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321051, "uuid": "a5efce23-b7ff-4794-8e67-aee7c7b504bd", "value": "1536:eaYLIqS6NgJusLUjPYpQ+ZLrLGxdTfgVs3NkpKzLhHroqdahR4GEacIVnj3BZ:eLwUSPSx8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617321051, "uuid": "f4abc9ac-fcb9-49eb-b51b-7a3063226ffd", "value": 110677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617321051, "uuid": "12055c4a-96ed-4fe1-a046-ff5a86d00031", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321051, "uuid": "c06d5427-5ec0-4c0f-9f1e-8cee4309a73e", "value": "1f9ff969479ae43d47a109712d05a084490c1d7ad38aa50bef2b1cd20f5037be.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b7ef77-92ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617255681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255681, "uuid": "b29053c9-d662-4995-bff3-dbaa7241645e", "comment": "Malware payload (AgentTesla)", "value": "a33517d8043c2d2a2148f24cbd2d071a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255681, "uuid": "35715f95-91ae-4d04-a1d3-eeb00e8c6b24", "comment": "Malware payload (AgentTesla)", "value": "201c8a1f8828c90701be1bb3a775985d99f339a9a3b60174a77f590f0a885741", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255681, "uuid": "64bd2fa4-c33b-42e7-9997-40f01e720af9", "comment": "Malware payload (AgentTesla)", "value": "cd778a8c51140ec0fad47ccfd5ce08d1ed22813c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255681, "uuid": "fb8e7103-b4a8-43c4-acc3-d72a82744b42", "comment": "Malware payload (AgentTesla)", "value": "d3b491374471d20d2cb74e2d607ad083d40e03ab20d82a33c824183fd0a9c4b5bc37d55415494ff1f072132897881efe", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255681, "uuid": "af730cf4-d1b2-4e9d-a030-c08070f1ad75", "value": "49A423F232657F84D1E9636FC2C50E6B943125BBE2B39A13B9FF4803A526850317817E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255681, "uuid": "827963f7-a59e-4255-959e-c16b32773af5", "value": "12288:tT5rDV/PrsTCVCeBXKDIsPpgeXpVcz8Mx2ogrs:PrDpPrsTCVPaRKsSh2Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617255681, "uuid": "8f27f697-5716-4c56-8613-738f9b6ff0be", "value": 459026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617255681, "uuid": "fa8d6803-6708-496b-bc2a-ea265293973d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255681, "uuid": "cd525738-a465-4bf6-8d0e-45bbf0ea660e", "value": "April New Order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a758b976-9337-11eb-abe1-42010a9c0039", "comment": "Malware payload (TaurusStealer)", "timestamp": 1617315280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617315280, "uuid": "6338703d-5873-4df4-8b43-f54f57fac104", "comment": "Malware payload (TaurusStealer)", "value": "11145759cde6765a10fc4fd104b5fcfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617315280, "uuid": "1ed5dec5-aafb-4f84-b470-96bf019cf138", "comment": "Malware payload (TaurusStealer)", "value": "20aa2a4abbebdb069726b69a4d9a2041599de56f167de9a64b7996433c5b33ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617315280, "uuid": "560a27a1-6067-493d-9ac4-091ca9edf7cb", "comment": "Malware payload (TaurusStealer)", "value": "4c1154aa48abcc86481de49d5a869c0c7087a0d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617315280, "uuid": "e267e3c0-76c9-4933-b431-62d949ee4c16", "comment": "Malware payload (TaurusStealer)", "value": "7daedcb8515e752d6f7f60770b100228a3cab1d5818b7502c9823044d425ca8fa30d40ec99664974c3a66dcb24121e2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617315280, "uuid": "61117c96-db07-41c6-bed9-49d608cf1a35", "value": "63256BBEE712E401F4AF2BB093C74F54252B68943A210206D6E12F9D7DBB3E47E5A744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617315280, "uuid": "47e1a7f4-31f6-4d1f-8e58-45334e7d80ea", "value": "1304b90aa218dd98d62bfffc520fee8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617315280, "uuid": "98fe213f-641a-472e-a6db-60a65b576e7b", "value": "6144:9lkjxUbdW8vmUSWPBsuozsBfao10WHhYkC9JKSaRewYF/I:rkjxUbA8vmpWPBsuJBfao11HKwqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617315280, "uuid": "e9b71f74-9479-470d-86f1-014fd01407ae", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617315280, "uuid": "0e9e0446-1ca9-4062-9375-fe98e843738d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617315280, "uuid": "f6028946-081d-4eda-89d6-3d233058df30", "value": "11145759CDE6765A10FC4FD104B5FCFB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b423cf1-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281732, "uuid": "24eda765-fe91-4a40-a0c1-05563d21cff0", "comment": "Malware payload (IcedID)", "value": "70ea0829e10c41b517bf8af023015bdc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281732, "uuid": "05e6cf0b-6928-4a1e-a24c-f4a9b51d9935", "comment": "Malware payload (IcedID)", "value": "20ca90c096a5e50ed43b42e430f2b34138c162767d03f8497428658298c29e4b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281732, "uuid": "373f224f-678b-4833-86ca-118cbf21fb33", "comment": "Malware payload (IcedID)", "value": "c7c8825809b0edb1f1a13b79c5b2da56b67a2036", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281732, "uuid": "d8abb2a6-d42b-4f69-a816-b3b1d01a2efa", "comment": "Malware payload (IcedID)", "value": "5aeec4003f32190cfb1d5ec8c3038adabdf3cfe489d1bdfe1e811c15728ab2f41e0237274fc9931e414630cc49de3084", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281732, "uuid": "c088528d-9491-4886-8c4f-4598a5beec81", "value": "11044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281732, "uuid": "e17abf67-71c0-403f-a7f7-ade290578ec4", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281732, "uuid": "03bac86e-d37d-4708-a251-4b10aa890a43", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281732, "uuid": "45d08700-fa0c-4bf8-bfcd-e5b261be9c27", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281732, "uuid": "da903eb2-26e5-40c3-9686-b1055f7fac81", "value": "document-1500258943.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c83b79-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279929, "uuid": "ee4ef98f-497b-467b-8e2a-3b6d8ef35ed5", "comment": "Malware payload (IcedID)", "value": "9816c2c9e33a69ff12af23943cb42d0a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279929, "uuid": "fd8c8187-8989-49f1-8503-f410cd2beadd", "comment": "Malware payload (IcedID)", "value": "2197837ab4f750fb89df6162556cd74996d3a6c70b7d53512b55bfadb80549f2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279929, "uuid": "41002453-3985-4fdf-8c7b-7c9380b23ea6", "comment": "Malware payload (IcedID)", "value": "4cedea3859de55adc354e682b0b5d90126378792", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279929, "uuid": "16a500e2-b387-4cd1-97b8-98e9d3922bf5", "comment": "Malware payload (IcedID)", "value": "ea425223045f770247c19dc06060282faa15fbd8acef3bcbe79ddc6a6a70e31d9490d592a70a14002d2fe48ebefab95c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279929, "uuid": "85005532-85ff-472d-bec5-31a4d44fb558", "value": "26044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279929, "uuid": "ab2f898a-4444-4e60-bf56-7994c0029839", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279929, "uuid": "2788730a-ed8e-4cbf-a836-3d25545a620b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279929, "uuid": "ee600fc1-aac4-4251-892f-08d5ea711a3b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279929, "uuid": "ceb9d5aa-115a-4d96-ac93-0794de4c031d", "value": "document-369962700.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5059bc-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284796, "uuid": "7b270d76-5280-4921-b77f-b876a329d4e4", "comment": "Malware payload (IcedID)", "value": "8b11c5272863a4a0455820383dd14ea1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284796, "uuid": "125e4723-ae75-4642-89fd-1377155a9dcc", "comment": "Malware payload (IcedID)", "value": "225c5176ae352eaa4208daa0506f0f84bd4271f9bcfde99bb11108251d29d22c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284796, "uuid": "b3f0f731-c339-4318-a95d-ff8cee93b09b", "comment": "Malware payload (IcedID)", "value": "7f0523faaa9686d3f00acb43a529f9d870310afd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284796, "uuid": "3c4307a7-c5e0-4b35-aad6-281358acaca9", "comment": "Malware payload (IcedID)", "value": "80107730a50e806c238c20041c9a8bd79711a1e9983424a6f65f68940612adabab48c6ce9510174d557697cf9c69ff15", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284796, "uuid": "a398fc76-670a-4e8c-ba0c-4c74e09289b7", "value": "D0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284796, "uuid": "ed046d27-b751-4510-ac34-e3cf3b38520a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284796, "uuid": "c4d3e15a-bd1a-4e8d-ad9d-5f433ed47c10", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284796, "uuid": "e79f3f53-bf15-4ecf-9404-3849d234dd80", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284796, "uuid": "5c5e0123-523c-48fc-adc3-2d6c0663453a", "value": "document-1137036824.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64364e8b-9319-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617302282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302282, "uuid": "e6019b65-8150-4297-92af-254dbe24976b", "comment": "Malware payload", "value": "4d12c506fa725a289f757113fb8e0779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302282, "uuid": "4f44baef-c80d-4a00-b62f-2b2a4b65f29e", "comment": "Malware payload", "value": "22916cd876516df90c959904823fbc25a331cd7f8e70343cc05f4674128f07e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302282, "uuid": "b4e02251-2455-45da-b886-1451b21cfd2c", "comment": "Malware payload", "value": "7d92f2871555652a3a4465c681ffecf4546c786e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302282, "uuid": "567a6f36-03e7-440a-9e8e-f3b6ff97a2b0", "comment": "Malware payload", "value": "57e39eefd536a0e218c3990354c957a03c6c48fbbfa30165aed4214838e8bed897037035b9965c75186c02168fb62f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302282, "uuid": "00f2b66c-e561-496d-bb9e-e0b049ef5644", "value": "B475236BB28C3B4ED25F0AF27E754A718B07CFA342546B56B6C4FCAE907114D6A060F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302282, "uuid": "b6cd3753-9df9-4854-aa2b-ce864565d18f", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302282, "uuid": "74d81db5-0811-427d-a6ef-7f5c6be5d81a", "value": "24576:27xlXp3EB3mTElq5wOoy3lLt1HnYaXbvS0VA/JRjUH2i3Ocp5OQqxqYpp/:CbWbwoy354aXbX4J9Un35pcQ9+p/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302282, "uuid": "2c2d46e6-940d-4e51-803a-e1ea077e9018", "value": 1681458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302282, "uuid": "c717cf4c-aa2e-4915-a940-a2de9c33a96e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302282, "uuid": "0be0a3f1-8511-4d25-b353-5fdca8b326b3", "value": "OUTSTANDING INVOICE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69cddb2-9305-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293938, "uuid": "97bfaf15-4e2a-4212-ad61-06afc341d217", "comment": "Malware payload (IcedID)", "value": "2d82017befdbfbdb19e29b28c577cbfe", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293938, "uuid": "47bcb919-7ae3-426d-94cc-994ae15d8e1c", "comment": "Malware payload (IcedID)", "value": "22c4b89c7759c57e2bf7b436fd50db27e6dd79bf3b8f12752c1fdc96cce6359c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293938, "uuid": "29a5fef2-9a0f-4738-9ae3-7eec0230ec79", "comment": "Malware payload (IcedID)", "value": "b73260f98fb1c43e558bc50d5f564406fd4e70fd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293938, "uuid": "305fb6ef-c031-4228-a8d7-dfeccaf0d583", "comment": "Malware payload (IcedID)", "value": "60230990b1a26d6bc9405a2a46d6c816d5939511bd9c45d76f4cad1141690439f3cad0daea6d80848f6756f0b89bbd5f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293938, "uuid": "fbc4b296-13fe-4798-ba46-7da5fcbe2f86", "value": "C7838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293938, "uuid": "527f5641-a773-4b69-8dd2-7ac29c8c3b67", "value": "1536:IB240XZfcaaxf+EQliU2haw+LCAIoo8+BNvMhfv0h:+2d1cBWEQXM+L9o8+nEhHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293938, "uuid": "e9048738-c011-4fc8-845b-8ccf322f36c7", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293938, "uuid": "8a24f88e-79fa-46e9-88b4-babe2f6b8c1d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293938, "uuid": "80036356-a11a-4838-a396-5f57cb0557d0", "value": "2057.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca278696-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617294723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294723, "uuid": "39312d6e-3624-4adf-ab11-931e85db7127", "comment": "Malware payload (IcedID)", "value": "0aadab8bc776b95c208e47b03a023c8c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294723, "uuid": "5276934d-f7b3-4b5e-9dfb-e831a2e1a2a7", "comment": "Malware payload (IcedID)", "value": "2300cdb66f994f521399157b534c8564f9fe750fd48a8226749071a651ac826c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294723, "uuid": "36cc5b5b-9047-4510-8a3f-d0bb7121da53", "comment": "Malware payload (IcedID)", "value": "05a32aef4f4723fe8dcd43522f5d8cf0ce66be80", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294723, "uuid": "7ab45360-f085-43bd-8e47-b0cc1316cefb", "comment": "Malware payload (IcedID)", "value": "6e77d20342611add43f16f7ec43772af2087170c74bd42e22e204421814d8fd784be3332a4a4b1bb1189a6ff5ef262a4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294723, "uuid": "f79b589c-78c5-4ba4-8d11-37d3d1c310b1", "value": "A3838CCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294723, "uuid": "44cd1184-2071-48ec-bac4-b3783ebe8b5e", "value": "1536:IB240XZfcaaxf+EQliU2hawyCAIoo8+BNvMhfvEN:+2d1cBWEQXMy9o8+nEhH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294723, "uuid": "57eaa0bd-16ff-4b51-85e6-93db2690f459", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294723, "uuid": "0baa4d79-0f92-45b0-80a6-77308bb1a4d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294723, "uuid": "0fb0bcdf-e936-49e0-a5c4-60daade9c634", "value": "1436.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8637012-92cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617269326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617269326, "uuid": "aa014083-f909-44f6-8fcb-6d1396c73357", "comment": "Malware payload (AgentTesla)", "value": "5bbfe9c80d2b288223672a3638b62a92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617269326, "uuid": "9e310c21-162b-468a-b3a4-0f930de394fa", "comment": "Malware payload (AgentTesla)", "value": "230c735113b353cfb84136e474e2a4c6bfe21af92e84fc16397b84496b050676", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617269326, "uuid": "a47d3613-038c-41af-a79a-42a1e3b25f61", "comment": "Malware payload (AgentTesla)", "value": "906cdf5bdd3f9ea45f7858c19bcbbc3074ca01e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617269326, "uuid": "1788f0c1-ee3c-4820-b532-8695a930c228", "comment": "Malware payload (AgentTesla)", "value": "74cf2f847deba283c244c0b0f6da42b6eada86cba68f877849dc8f743731369a0977bf85fd1dc2366dc173316d173d10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617269326, "uuid": "b6500295-097d-49e7-a4c7-b3e7271f8f9c", "value": "ACE401F02D90CFE1EA7C46FA569530451BB4E3E60143DF899A99E8F5394AF0E0EC5683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617269326, "uuid": "c06d5303-fcfd-43ef-8b02-9e558b1caf8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617269326, "uuid": "8cb28f20-8516-44a6-b704-b83ff94bc8f7", "value": "12288:T35QFCkMz1Q9db8eCSoYa1yxI5/KqFt/rCSro2iNx:NQsj+bZoDj1/y1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617269326, "uuid": "8335dc86-611a-43f9-abde-895a8b19dd55", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617269326, "uuid": "f818a395-e65e-4ab8-a7c8-70d05eae0572", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617269326, "uuid": "60cc4bce-48e1-410a-8092-56155ed1c2f3", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a059a-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277499, "uuid": "678010e9-3adc-4fa3-9b15-1fc80f8d6d9f", "comment": "Malware payload (IcedID)", "value": "bbacdb34177c633295de1c51f9bc4ebc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277499, "uuid": "57d649b2-62f6-4fe5-9d33-324403fe9a26", "comment": "Malware payload (IcedID)", "value": "231fceb05720d9bcb0c4b5af2025513a5a03c9f598b33607a93f606010aeee73", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277499, "uuid": "67c90826-74e5-4e85-911a-9bbe306825b7", "comment": "Malware payload (IcedID)", "value": "437ec2dd20eefafc035689a2b5ba53cf342c3da0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277499, "uuid": "0458543e-d995-49c8-92e9-8d2560c98730", "comment": "Malware payload (IcedID)", "value": "a111cb0d3f2276154fee18199d28a12a9f2a11eb31371237dd9e4b09c0c2a0d209c136c162917029a8a5cf97913a5379", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277499, "uuid": "c7862205-18b3-4c20-a7e9-9ae08b7a3a91", "value": "93044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277499, "uuid": "90ad33f8-5133-499e-9ec6-a35aa87c2901", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277499, "uuid": "5579df32-5d0e-4873-8dc8-156235eaecd6", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277499, "uuid": "70328abb-8e8f-4d81-b513-06cf52be242e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277499, "uuid": "7ac0296b-1ae7-487c-84be-c6b424b2f243", "value": "document-2069271791.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcc4944-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617262063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262063, "uuid": "78a25928-0578-404a-a8ab-a6fade967b02", "comment": "Malware payload (IcedID)", "value": "4d8f8a316fe5681a5f8eeffade2244ac", "object_relation": "md5", "Tag": [ { "name": "Hetzner", "colour": "#C70A75", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262063, "uuid": "296d77ea-5411-4112-bfab-20820ea952b9", "comment": "Malware payload (IcedID)", "value": "2374fa7a9291362dc4ba5f8ad9639b36f2ed11563bb0b5b666c8e4061d20a476", "object_relation": "sha256", "Tag": [ { "name": "Hetzner", "colour": "#C70A75", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262063, "uuid": "a9a48638-e374-45f3-95bb-8b52ef32a99c", "comment": "Malware payload (IcedID)", "value": "4bd6435b392254fae72a6777992a44c5da2522dc", "object_relation": "sha1", "Tag": [ { "name": "Hetzner", "colour": "#C70A75", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262063, "uuid": "199ab948-ac9d-4e1d-b673-119319c608bb", "comment": "Malware payload (IcedID)", "value": "4945546f6be517deb6b69b0415b28a43d72e419e99804804f676151b618064b7fc7cea209adab1afd11579ed16326195", "object_relation": "sha3-384", "Tag": [ { "name": "Hetzner", "colour": "#C70A75", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262063, "uuid": "7669c7b6-b9ba-4e9c-9673-2a07d16e4c72", "value": "0BB3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262063, "uuid": "18fddf79-b5df-479f-8907-9f876e5eb608", "value": "3072:O2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:OqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262063, "uuid": "7ea28dfb-633e-46e3-b016-beb606765a34", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262063, "uuid": "2b91e12f-1745-466e-8c54-fe2f70749bec", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262063, "uuid": "0d6ca91f-3b5d-415d-a2ac-930b602bc982", "value": "document-1977942244.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842065c4-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284297, "uuid": "bbdfc91f-e7c1-4f33-917a-36232e73c623", "comment": "Malware payload (IcedID)", "value": "41db7ca806cb49668105cdbe13247d04", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284297, "uuid": "e48026e6-3e13-4e04-aa80-e3ddfcc2a10c", "comment": "Malware payload (IcedID)", "value": "23778866046ae8c9b4b469744994aad68f6023a14bfa5f95bf3140315061b25a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284297, "uuid": "2f1b595e-fc75-456b-9f69-babc7bf2093b", "comment": "Malware payload (IcedID)", "value": "f063ce70dbcc359cc45f5f8e34ca5a5a72c34f87", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284297, "uuid": "63995b98-bc9d-4c10-b2df-70ac07177293", "comment": "Malware payload (IcedID)", "value": "e6b91f02fc888f0d64c662f048738569b2032bed2dd5b48c01bbb0f7916fc811c1f71ab6a8221abe84a6ba88c0de797c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284297, "uuid": "ca7de275-affb-4c87-9eee-608c5d74499a", "value": "EE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284297, "uuid": "9e2e1f58-4bae-48ba-841d-eb987114f15b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284297, "uuid": "b486aa49-7ab5-4c2e-85e2-b5be16c4a14c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284297, "uuid": "57ab5e36-8357-44a9-94aa-978cf39b3d2d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284297, "uuid": "646acb47-7e30-4b88-bc27-289ca172fd8d", "value": "document-1628798377.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087b4e5e-9304-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293109, "uuid": "81aeab12-85ed-4e98-85c2-b1d8affbe73f", "comment": "Malware payload (IcedID)", "value": "e07574aa2ebd7884252f887e5c46668b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293109, "uuid": "231a020e-6f49-4d8e-b8b3-7637905bca73", "comment": "Malware payload (IcedID)", "value": "238f09292db2c47f35e372ae039d533beea3e3c387b2fe7a68ca61a87bc21c90", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293109, "uuid": "2987a87b-a8ab-4e72-a247-bfbda79dd826", "comment": "Malware payload (IcedID)", "value": "88075e3b881e9e987e6befeb2dc7508bf99568f3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293109, "uuid": "8a4a3d40-cd68-43a1-a91a-ce35d42a4b77", "comment": "Malware payload (IcedID)", "value": "3958787de0b74c80e5fa5ea9b6eda2498c596881910ac44cdee1ab238544f6cc216ad2ba4ceba653c1ad0c2689244007", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293109, "uuid": "c94c3b69-19b4-4a08-9c0c-9eadccbeb015", "value": "C2838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E0D42FA84A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293109, "uuid": "04b8990b-b40b-4aa9-bcf7-653f2ae96852", "value": "1536:IB240XZfcaaxf+EQliU2hawbCAIoo8+BNvMhfv/VE:+2d1cBWEQXMb9o8+nEhH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293109, "uuid": "4f4181a6-4d23-4ce7-82ff-4b3bdd6b8dac", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293109, "uuid": "cc34e79b-afb9-421e-a2c0-f934b62074e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293109, "uuid": "52bcfb95-f66d-4951-9477-718d19191d32", "value": "985.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e455ed-92aa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617254772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254772, "uuid": "1d35bde2-42ec-4720-8ba2-be81ded187d9", "comment": "Malware payload (Loki)", "value": "54ed8835c5ab4a97f41f7d9271f65e1a", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254772, "uuid": "dafbd912-366e-4f8f-aa5e-21d274ca457c", "comment": "Malware payload (Loki)", "value": "23a553a1fff246672600080db7ad07a14ab8667a6d23dee4e4c93b8ae661171d", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254772, "uuid": "41e5202e-db39-477d-8765-002165d056cf", "comment": "Malware payload (Loki)", "value": "4fe98a19d91cd13c8d71fb2e9b3b20bd382fc6db", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254772, "uuid": "036f10d8-6c87-4f82-b33a-ccc8f0829741", "comment": "Malware payload (Loki)", "value": "d9ea40e953bf46e097e28dcc4a161238f8f9eafb704a5fe68b8997b20a936024fadc7a78e94ed85742f52ad53813406b", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254772, "uuid": "ee6b9041-b63d-4093-93b6-f2581fb0a870", "value": "A7D312FD2664A19F5E10937211147C1989DB8A43F33D3DAB2E6EA6C95304DCF2C58772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254772, "uuid": "0a13a5c4-3db9-45dd-85bd-17a69577be92", "value": "3072:BdkRNPdeFM70f1xccT0GinfIWmd1okk8rX5gBebsi/DbkT:BdkRNPAu70bccTxEw5c0GeweK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617254772, "uuid": "4ade1638-5013-42ab-a954-e536fa458284", "value": 136169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617254772, "uuid": "7a78c18f-8800-4451-a0a8-239732b1a0dc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254772, "uuid": "ff06a189-ee46-4bad-bfd0-1647cea46a12", "value": "Remittance slip.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaeddf0-9305-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293923, "uuid": "31e544bb-96bf-4eb8-b2a0-11334558d197", "comment": "Malware payload (IcedID)", "value": "1b6c2986e63af8f31445481c3f585bfc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293923, "uuid": "c954ef82-24a8-450a-8573-46f98e729ebc", "comment": "Malware payload (IcedID)", "value": "23d885793a0e4ee1ee218aaf7a29ac8525ddb7c42060da3fea4992c392c1ea28", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293923, "uuid": "412879f6-3f7d-4a5d-84be-3d93edfc03b2", "comment": "Malware payload (IcedID)", "value": "b0895b4af714874e37cdfc85a34b66f9ffe3491d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293923, "uuid": "11ceec21-038e-451f-a51d-6b7f81582568", "comment": "Malware payload (IcedID)", "value": "929dfd10d5e537057f953c8ee0a12fcedddce2a6ebfd8663c043f83885eb2be4942f1766d502c4a06ea4ed8983e7036e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293923, "uuid": "78cef5ac-6b7e-44d7-9060-3c4f62841dd4", "value": "AF838CCDC913E1DAC2559FBD5A09308512F4E0B6276FF11B148EA62E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293923, "uuid": "152a58a9-92cc-4416-8ef6-6328dc1c418f", "value": "1536:IB240XZfcaaxf+EQliU2hawnCAIoo8+BNvMhfvxw:+2d1cBWEQXMn9o8+nEhHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293923, "uuid": "9a63d5ed-4166-4635-b251-3e96df5c7d07", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293923, "uuid": "d62f4b87-598f-445f-a9ed-5559f3395559", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293923, "uuid": "0c3d3e2d-ba10-47ab-8b9c-f43410645127", "value": "169.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f1323d-930f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617298229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298229, "uuid": "26d7d8e1-1497-4c3b-a8d5-2ca8ac012a2b", "comment": "Malware payload (IcedID)", "value": "74d9cbcfdf63e0d6d70ebe7a199226e8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298229, "uuid": "375edddd-32e4-4535-9713-b111392d9d2a", "comment": "Malware payload (IcedID)", "value": "242112f0da3572c70abf5f9dc31d09f231b9f20b62665b5545a2b97b7c2205dc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298229, "uuid": "a42846b5-0e3d-47d9-818d-0e6591eb6b64", "comment": "Malware payload (IcedID)", "value": "59e26639bf9e0de9d786f48948cae5f145f1d32e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298229, "uuid": "08544e52-45af-4a97-8a45-4c2f116b4fc2", "comment": "Malware payload (IcedID)", "value": "c6f87816e2a886e0afd39e456fb22e00e0c0b23fdd7aefd333f838b79434ccb358c8e7190754c8e9b6356faa3dad05a9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298229, "uuid": "b3fa161f-5638-4e07-8b70-1f3eb36f7a41", "value": "CB838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E4C42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298229, "uuid": "b9364ea0-6499-4915-8a51-640953d3a7ba", "value": "1536:IB240XZfcaaxf+EQliU2hawMCAIoo8+BNvMhfvsY:+2d1cBWEQXMM9o8+nEhHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298229, "uuid": "07542823-c4d7-457e-8676-d53b0168856f", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298229, "uuid": "73037f65-baf9-48ae-86e8-a291adb3b88e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298229, "uuid": "ba3e583c-c126-46de-aa76-b401db1c2462", "value": "2080.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189eca29-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617261353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261353, "uuid": "cd9d5f18-77f9-46a3-b2c7-4fb6bdd2a12d", "comment": "Malware payload (AsyncRAT)", "value": "1233d19b0789a7c1287925828918d44f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261353, "uuid": "fa248dce-a2a8-4a84-a026-1420e9dea204", "comment": "Malware payload (AsyncRAT)", "value": "24846b5909d31e83e7b2f74cbc95f403d51b8377aca1b7e0184408b6d1670dca", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261353, "uuid": "9e1db03e-f6c9-4541-88dd-de5acd77bd22", "comment": "Malware payload (AsyncRAT)", "value": "867d8197b4147618e1fc207853b522a164faba1e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261353, "uuid": "bdaaec8a-54d4-446f-bf4b-51690a92d574", "comment": "Malware payload (AsyncRAT)", "value": "97a46341fef28f2894ff9553d0ed6ae740c577a021f8a7e7ba55b0c10861a6c208ad41c81e72016d7980367789b962d9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261353, "uuid": "e71efc99-a1be-496b-8099-2ffc720cdb81", "value": "94D02B92516FB410384BB59104DD60C8F7516F571234ACFA08B06C9486185101E15123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261353, "uuid": "5822d116-81e0-4e10-ad61-f84710eb22a9", "value": "6:ZDlzq9NqlqDG3uHarRRel1Eab3WDse0FXezmSF5Ld:LzqaIDGuqRRMEaefgXezFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261353, "uuid": "a3bf5a1e-2027-4232-8020-d1884d7f2fd5", "value": 277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261353, "uuid": "c5b332ff-dabf-4456-b1e6-19b7b49ab353", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261353, "uuid": "3e869460-e055-416d-98d3-7a26ea5637ef", "value": "NR52.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c99fb21-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279023, "uuid": "4c8af592-5063-4280-a2db-78d1bc1f7358", "comment": "Malware payload (IcedID)", "value": "e8b3ea9ddcc90a7481cab871f0c3a8d4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279023, "uuid": "4cb3528c-d5f7-4c60-8dd3-2525ca598595", "comment": "Malware payload (IcedID)", "value": "24bf67eb0a8a4d82682f1cb3f40b3e81448458c5b918fbeb3a39e764f76f26f9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279023, "uuid": "cb1fb798-2001-470e-9e83-642b37068134", "comment": "Malware payload (IcedID)", "value": "34ca6cee1d0377c4190a983c2183dfef5106c7b5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279023, "uuid": "fb03cebf-7fb4-47c0-a2a3-3e62bb2520bd", "comment": "Malware payload (IcedID)", "value": "ac541c3b27d880076e7a720e9f2041f4c199fd1ad51324b5ef1005bcb782082c15e8fe21219c7c59f57ea457bda628a6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279023, "uuid": "a0ae3f8d-03c5-48e5-86d9-86d2ff8f94cc", "value": "D0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279023, "uuid": "37f4ed09-009f-4996-be62-52c7db983b9d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279023, "uuid": "1cd84ad0-09ce-4e64-ac1e-7f09e5148431", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279023, "uuid": "4ad9d630-b6d4-4669-aa80-18ab5a3086c3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279023, "uuid": "858f87c6-20cc-4179-b6e3-283e273d2294", "value": "document-1092501017.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f689e8ea-92f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285348, "uuid": "cd86c268-2491-49cf-9c11-3824f7715c29", "comment": "Malware payload (IcedID)", "value": "6312c71d918f2575aeaf2b7173bc2f45", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285348, "uuid": "75f3cd85-fb8a-4df7-8ec8-09b45f6e7e51", "comment": "Malware payload (IcedID)", "value": "250beef2ff0a40d5d48223d6ade0d7939e4a12f0907a124432930171009ad42c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285348, "uuid": "cf8ec76e-0962-4817-804d-58e491c7c9d8", "comment": "Malware payload (IcedID)", "value": "88c613a9473c9b4eea94ec89fe2d3c85d97e130a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285348, "uuid": "ba0d187e-8db6-47c8-8b8d-7b1ba6b873bc", "comment": "Malware payload (IcedID)", "value": "52ccd9c7f92dba586aae704da67c364947381eeca12b6cd3f7618a78dc04d663fa78df31d1e33ad5de74079629f35004", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285348, "uuid": "4b522c90-b75d-42ea-9249-d7eaf195e3fb", "value": "B9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285348, "uuid": "2e39bcd7-4b55-4a97-aeb7-00f7d36c6f36", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285348, "uuid": "503afb6d-df94-4520-915a-f296d64c6ea4", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285348, "uuid": "a91761cf-d907-42cb-9cf5-8deceeeef655", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285348, "uuid": "375295c8-5b07-408f-9ee6-c8f51b40a2b9", "value": "document-714318173.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31ad1c5-930d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297234, "uuid": "067ada82-2693-4fd0-8845-6341f406db86", "comment": "Malware payload (IcedID)", "value": "7fef567185657f65aca6d19149d7c882", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297234, "uuid": "a1ef1604-cd5a-4a23-9c91-21f27a2dfe78", "comment": "Malware payload (IcedID)", "value": "252f76df5eccfc43dcec7214fdd5a72d38ecad8e74ebf42e7565eccf9b29fe04", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297234, "uuid": "46c3847d-3c00-451b-a2a2-76b10f491197", "comment": "Malware payload (IcedID)", "value": "2b20c7b8f9270b9227df5c0550a3c111d69f4b7f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297234, "uuid": "8af37e54-00c3-41c6-91ca-9b4a40d54daf", "comment": "Malware payload (IcedID)", "value": "327ce785bce9732dd4636879ac79abb14fe3e05a57c7dffdc8fd1b4e6eb7e7ed7828adf3125a93868a7e02acf602fde5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297234, "uuid": "fa702ec5-70c0-4584-b14c-f02316aa4835", "value": "E4838CCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297234, "uuid": "beac4203-a0cd-413c-8710-6f275368ab3d", "value": "1536:IB240XZfcaaxf+EQliU2hawmzCAIoo8+BNvMhfvA7:+2d1cBWEQXMmz9o8+nEhHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297234, "uuid": "17868f5f-816a-47cd-82f9-f98e9deb0ce8", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297234, "uuid": "9beff3b7-001b-44dd-9ea5-283a397e15b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297234, "uuid": "1619ccc1-49aa-4319-909c-c2c364379e6e", "value": "2348.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fa03e2-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282477, "uuid": "405c9cb4-c2dc-49b4-9d0f-2f0b9407b4df", "comment": "Malware payload (IcedID)", "value": "15a7db6fa02c0dff82499f7896939151", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282477, "uuid": "5215a652-332d-4421-b94e-6db61eb2f0e7", "comment": "Malware payload (IcedID)", "value": "2531aeb88bcbb6e77751f07ccbd5bc35af090ef9e0d6670e6a34f77da5c6989b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282477, "uuid": "9d5717b3-0847-4e9a-81f2-d217ab1f33a6", "comment": "Malware payload (IcedID)", "value": "db2b057894dd1aecf2825a731ebd03cdd55fe3f7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282477, "uuid": "a15a0530-75e8-4bed-96b7-bab379bd8844", "comment": "Malware payload (IcedID)", "value": "97a21f7769dcc201e4c8993a097aa2071893e864040b74dda56ad29e64495fce5c24b1f7198656fa3a32a65c539aade8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282477, "uuid": "2fbd497a-b169-406c-8c5f-0fc38e22e30d", "value": "D0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282477, "uuid": "afd6ef20-07a7-452c-88f7-e96cbd7c8cc1", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282477, "uuid": "87ecbe49-f9c9-4322-bea8-bbda1bbcfd89", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282477, "uuid": "42c0efa2-29fe-48db-af59-5ce09e71b863", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282477, "uuid": "7b4c6005-b359-4b23-bc7d-2073abab2efa", "value": "document-1857611883.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f591d7f1-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261724, "uuid": "2c9001fb-796a-48ef-a701-c4e2a29d328f", "comment": "Malware payload (Formbook)", "value": "275a87bf834cbd8e9c308ff72f8fbba3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261724, "uuid": "6fde2c7a-7c0a-4ef3-9cb2-009faf1c3d6a", "comment": "Malware payload (Formbook)", "value": "255008609396fe2a40a097e7267a6d73cae83d9f215bfa5ead78e066530fc312", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261724, "uuid": "97b0159d-e3d2-4a9c-984a-23097acb5c54", "comment": "Malware payload (Formbook)", "value": "34d2c60541538fe9b77a5c7e38e6da5999f4e22b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261724, "uuid": "eced1dbc-57d5-4668-bbff-da8a96b9f32f", "comment": "Malware payload (Formbook)", "value": "026ec5c402e2d876b3538ea3a6b3f2d7a138de35000b5f4e7f097069c4b50a3c22577bea608d110430d8fa62ff3b54f4", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261724, "uuid": "89926050-e184-4d78-b1d5-a61a677d5d6b", "value": "439423D9EE147CE4B64DA63A3A8088BE98459723FF325335C0F676EE0D28C5D52D40B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261724, "uuid": "2429f2cd-19bd-4c07-aa77-2d948b003d32", "value": "12288:sNmTb6TQb+QOddec96IU1h4fV11jHdQnvHq:sNyb6Mb+QYAc9kCfV11peK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261724, "uuid": "eec8aca9-4e70-4e39-a9b7-2ff1085c527e", "value": 415652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261724, "uuid": "b73dc075-bb4c-4d58-b463-dad369bb35ab", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261724, "uuid": "550af8e7-4907-4e2f-bef2-c620fa0127a9", "value": "PO PL.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3967cc3-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1617299007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299007, "uuid": "f188e739-3862-4990-974d-04de6f4da644", "comment": "Malware payload (BazaLoader)", "value": "81e6dcf2510ffc2400743e912448013f", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299007, "uuid": "ceac5ea0-b467-4e0f-9139-d0d4b5454c30", "comment": "Malware payload (BazaLoader)", "value": "258ad65c676c26e608f331bc538a985fd4ac019c6ca4229e4e197acaa93d82c4", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299007, "uuid": "98715fd8-6f67-4e87-89c2-af9a7ade53dd", "comment": "Malware payload (BazaLoader)", "value": "b1b29fff6348b805851513ce8812990a2f5a4e39", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299007, "uuid": "f6a380d5-1334-4daa-b19c-2adf33027917", "comment": "Malware payload (BazaLoader)", "value": "f1f85220505b1504b2c92caafaa721fa5b969ca76a55fb378a25483e27256d44b9d8c04d1a71ceb7b93c910e57446aa0", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299007, "uuid": "2b8541fb-5fa6-46aa-829c-1908da48211b", "value": "EE648C4A735154B8E35A83358842F5D697A1BC3D4AA0E34FD238BA365E332939D3721F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299007, "uuid": "2a6c8aaa-de6d-46b5-af14-693bf9b930c6", "value": "bb3b7b74ba5cf43655fdbba213daa5ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299007, "uuid": "318b046d-714a-421f-9427-f89bbaa474db", "value": "6144:4hzyPKlU/jriw3T2ZWAz7aFnFLbUkMHEdlFzMKVEyMWAF:AOCqZU81i9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617299007, "uuid": "07289e99-f619-48e3-9db7-764d8e474e3a", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617299007, "uuid": "7416a9d2-b3ca-45ca-a173-7aec30bf1f7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299007, "uuid": "b2f6521e-4fa1-4a3b-9d6e-787da36d75c9", "value": "81e6dcf2510ffc2400743e912448013f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb628f22-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275907, "uuid": "54712439-eb8f-4320-a73c-f97dd9d2a74e", "comment": "Malware payload (IcedID)", "value": "24a1224960152c72dbca5eaadaef0a77", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275907, "uuid": "f0a0ed74-2d01-428e-9038-4d83c4bb0671", "comment": "Malware payload (IcedID)", "value": "25d4b134c6c4484bba53fb7cce8964ee74ccebe7a0b91b46bd9b1fce29be717a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275907, "uuid": "f4df5bf1-eccf-4fc9-b285-8ca6568ae9d7", "comment": "Malware payload (IcedID)", "value": "ff81f1dda41c141917968d6f0090043fb1c77ed1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275907, "uuid": "748543c8-9b13-4862-80e4-13b2b1694663", "comment": "Malware payload (IcedID)", "value": "ab3c71c521536f2830cd755bfee7a86b61936a48e8fb04f8634c570383a8d2cd6a69fadd68c2817f760effbdc2e993f5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275907, "uuid": "3bc3d2a9-016b-48f0-8027-b7b618dd224d", "value": "86044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275907, "uuid": "24030686-748e-4c09-890a-c7ba5940a1a5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275907, "uuid": "3bb17f06-a4ee-4ac2-9898-a2940985aac8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275907, "uuid": "b99641f5-3456-4dad-bb42-8d24bd65859d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275907, "uuid": "8fa5e483-c676-432b-b9b0-2791158c16a2", "value": "document-1040030393.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3049b7d-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617262015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262015, "uuid": "d3346570-20f0-4c12-bd8c-3bf17c3476cd", "comment": "Malware payload (Formbook)", "value": "b93306710a842ba25a6798d870ecf80d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262015, "uuid": "b78abb66-b94d-4187-80e2-de0dac589475", "comment": "Malware payload (Formbook)", "value": "26056178e6fa24a828e57c46421c787153d3c48eac760bdf027c64df280abffe", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262015, "uuid": "b0eb48b9-02df-404d-b13c-26a7fd53892f", "comment": "Malware payload (Formbook)", "value": "ddf1be178e9595f39b1d90968167c92dca37b72d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262015, "uuid": "52d07454-8bb4-4a27-a0bb-a5edd26c222b", "comment": "Malware payload (Formbook)", "value": "5bd371c506e2cb7c49a63f951704d4a7cbbd1f991fccba3a6bbc7ab195e6b18744950d6a99e5ae4b8e1fd44dd431a855", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262015, "uuid": "b91ee70b-9c30-48e3-9c67-97798e37a772", "value": "76742394465FC4E72B1D06AD1699B07CCA562DC7CB8428B9DD4D82F4C3B2B0ABDB9073", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262015, "uuid": "55441f88-9a44-4cde-9d58-04bf46c96980", "value": "6144:/L0Lh4qO0R6eYzn+X9uY9JUnzCdFVZhGb5h8z2kerc8oHsTF7LbD7S:/Ls4qh6RznAp94CtGbvE+c8oMTNbvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262015, "uuid": "ade6b612-d49c-466c-9777-7965d9c9f2bb", "value": 361713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262015, "uuid": "a82fa29d-c8a5-4f49-b02f-79f877a7d2aa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262015, "uuid": "4c42769c-105f-4753-95f3-d87d08705c11", "value": "bank details.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4e7a43-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617294753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294753, "uuid": "825d7f01-c4bc-4eaf-bf0b-79e1d325d3f7", "comment": "Malware payload (IcedID)", "value": "500047708ba38d2cff0f1b543c4cc26b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294753, "uuid": "bea08b12-34cb-42a7-94da-f15945ac0ab6", "comment": "Malware payload (IcedID)", "value": "26530fc68c25bbce392055f6936415bf5b927366de7b1b412142671c43359641", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294753, "uuid": "476a784d-5892-403a-b774-b3e3dc332964", "comment": "Malware payload (IcedID)", "value": "0025cf82536473c2eae021faff1604dbf187d20f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294753, "uuid": "7f87534e-aa8d-47e7-8003-99428cfaf952", "comment": "Malware payload (IcedID)", "value": "acf05f544f1c160595e1be920da5cb110d409c0b82a1d066615f5ae7f0681ee9425fab6560737ed435ca6940811ab2eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294753, "uuid": "063284ed-6f0d-4651-b3d1-754e9573dda5", "value": "4F1408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294753, "uuid": "5003801e-b3b0-469e-80fd-a89e796c91af", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294753, "uuid": "86c5ee72-9840-438b-94ba-f66a56d3f45a", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294753, "uuid": "818de258-87e7-45f3-b009-69e172d4db11", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294753, "uuid": "11ff7f4e-1dc4-46a1-a27a-68a6a7c3faf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294753, "uuid": "3a9cbaec-9230-4f82-91f8-6ced8d18dbd5", "value": "26530fc68c25bbce392055f6936415bf5b927366de7b1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28ddb85-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617294710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294710, "uuid": "564a7add-68b2-4169-8970-0fe4d18300ee", "comment": "Malware payload (IcedID)", "value": "2e0a92a30d3f60b9719adb8721adbc97", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294710, "uuid": "fa5ba721-dc88-49b5-ac1d-11a8597a2d4c", "comment": "Malware payload (IcedID)", "value": "265efa5299c97763749cdb9ab534dd392379a45caad6bab86200411b1659b190", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294710, "uuid": "15b2eef1-ffb8-4a1f-b9b9-f0223cf1c5ec", "comment": "Malware payload (IcedID)", "value": "66e3ba1fc5b9e63bb5238fa7db7a0b8daae90971", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294710, "uuid": "d04e9f7d-5b8b-4f51-83eb-4b824ea020e7", "comment": "Malware payload (IcedID)", "value": "ea37125e1275045231818d0e7161716e308198ed967a967d3a66974f6cf37ab47c6a8e9d8dfc59cfe2c61bd4437e4829", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294710, "uuid": "b2dddada-5e7e-4c2b-84c7-468bd3c3f5fd", "value": "BB838DCDC913E1D9C2549FBD5A09308512F4E0B7276FF11B148EAA2E4C42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294710, "uuid": "34380d86-00dd-47c2-b24a-922524e6fb5d", "value": "1536:IB240XZfcaaxf+EQliU2hawofCAIoo8+BNvMhfv+R:+2d1cBWEQXMof9o8+nEhHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294710, "uuid": "576d74f3-6b2f-4b5b-8f6f-04c3a4ad2e9a", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294710, "uuid": "9319b41a-b994-4b1c-bdc5-877bfaa48538", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294710, "uuid": "f64a66ee-51b4-4edb-bf9c-50f55804120b", "value": "1901.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84433cf5-92a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617253374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617253374, "uuid": "dc7ef1ef-c5f0-4019-b035-efe619190117", "comment": "Malware payload (RedLineStealer)", "value": "934d2b9ee4b5af8bd53ab861226476f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617253374, "uuid": "dc99be0e-b03d-4925-a9c7-d951513f43f7", "comment": "Malware payload (RedLineStealer)", "value": "2678fa4d8a8650f8ce4b24880eaf89c49cffa228a419b8e5cf26972a959d87cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617253374, "uuid": "11909c32-4c88-4260-91e8-4f6e14c1f08b", "comment": "Malware payload (RedLineStealer)", "value": "4c12e98491d449fc3fb6f056adc3c6b90496654f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617253374, "uuid": "d1174c5a-5edb-4cbb-9315-b8bf8fad6c40", "comment": "Malware payload (RedLineStealer)", "value": "1bc9cb021dae2d4ade0727cb51cdcc225085807e7f456374ebce210b6a4a92198eab9a397ea5b0eadcce09ab861fcc29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617253374, "uuid": "0b8dafd6-3a82-4d18-b040-338c1d5be3fc", "value": "076623812D808EE9C5761DF23494E5CBF583B56C3E0EC0EA965D16398CF4261EF46FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617253374, "uuid": "755eb36b-4a04-4ed6-adda-426fd376aee0", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617253374, "uuid": "00146188-dccd-4be3-950f-9c3ae83e893f", "value": "98304:75aFAmpi+WcVr7jxElrqy9EHsf6IVbLXe5P+Wq4rw1ST2mk0RHw0XFIHDLW8WAg3:75aFAmXV/+lmefLXegG8mo2zAgW92x7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617253374, "uuid": "3dcede28-c046-423f-8baf-179137d5ad34", "value": 6657726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617253374, "uuid": "954e7de2-6c65-4d22-b5ba-4c08a3d53879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617253374, "uuid": "7585fc7e-7e2b-4187-b7eb-946358dc2af5", "value": "934D2B9EE4B5AF8BD53AB861226476F9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e7457b-930c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617296618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296618, "uuid": "3d88e88d-443b-4d68-abe3-f49476d396d5", "comment": "Malware payload (IcedID)", "value": "bc1364115883ac285ec423e166cca01b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296618, "uuid": "789bec57-ab30-4624-84af-97407c05c383", "comment": "Malware payload (IcedID)", "value": "26b984ce5044bb78e5b6f8e9247143a48820865a648461608e7cf844ecbdf2e2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296618, "uuid": "0c8a1546-3520-46d2-b01f-65fae2cf6437", "comment": "Malware payload (IcedID)", "value": "a077750faf64c167e7f440934068d1e50b1441ae", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296618, "uuid": "cfbed1af-5571-441a-b402-3f7fec7afc6e", "comment": "Malware payload (IcedID)", "value": "893fc90e8c2319de6a4fc60341a811dcf36f10fdb2c26041cff412143a111b1cc2a74d4a83cb78faa47aa697249fb6e2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296618, "uuid": "78a34d03-f9ff-4a7c-a347-76602a802b70", "value": "58838CCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B108EA62E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296618, "uuid": "ae74ed2b-ccbf-44d7-8ffb-345848178476", "value": "1536:IB240XZfcaaxf+EQliU2hawbCAIoo8+BNvMhfvHX:+2d1cBWEQXMb9o8+nEhH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617296618, "uuid": "bb0df6da-2702-4874-ab28-24b4368631f2", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617296618, "uuid": "1af6f3f2-e890-4e3e-90ea-35c722ada97d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296618, "uuid": "8298c3e7-a055-4a24-97ca-a99b82ffe1d4", "value": "3272.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6352750-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288273, "uuid": "8726e041-770f-4fea-be4c-037af436a4ea", "comment": "Malware payload (IcedID)", "value": "d51dea81bd1006a970eed8a0e92a0da0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288273, "uuid": "29237b40-3c3e-44ed-8f2a-e8be209acf01", "comment": "Malware payload (IcedID)", "value": "26ddfef4201589d0913da5edda3f0874f9f8683db8f2e13c18e9daf1d9a88c2d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288273, "uuid": "9df7233a-7065-4df7-937e-e277beab5421", "comment": "Malware payload (IcedID)", "value": "3565463a9506ae5635f14bdc2d1b9d20efa9c24b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288273, "uuid": "4297d925-70d1-43a8-8322-dc4f8acd5cb9", "comment": "Malware payload (IcedID)", "value": "e501fedba38479e264c96361e65f9961acb313d7748473e76bff5e375679d27b4c6c8f2a2c1ef24226634e2cbe8eecad", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288273, "uuid": "056cf077-1ce1-4f09-8ab1-7572da7fe775", "value": "FF838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0C42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288273, "uuid": "cac30e37-88eb-4133-8668-8e7d1a9e8e7d", "value": "1536:IB240XZfcaaxf+EQliU2haw5CAIoo8+BNvMhfv7:+2d1cBWEQXM59o8+nEhH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288273, "uuid": "f09d2e13-7345-4bbb-a4bf-f50dd945e066", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288273, "uuid": "518e8f34-b003-4ac2-a2c2-75a8a9c4dea6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288273, "uuid": "68ec1e43-0da6-4f05-a61a-c84b6fe788cd", "value": "2289.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e0d7cc-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284275, "uuid": "e00d3cb4-ba54-4359-bd85-ac83d59ceaa9", "comment": "Malware payload (IcedID)", "value": "a08dbe870c59103a642680bdc0bfb929", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284275, "uuid": "31f680e0-3d0a-4d65-8642-8f01167948e3", "comment": "Malware payload (IcedID)", "value": "27139193c58407303c7372b8a31c89f29446249d8469723133fe75e98d2d8c2c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284275, "uuid": "68045582-39ef-4c40-bb27-453d49c9f10c", "comment": "Malware payload (IcedID)", "value": "5755fa6f22d4baf57a9ea8f3b82f5319a20393c6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284275, "uuid": "bb04f000-eafa-46d1-8bfa-804629d79513", "comment": "Malware payload (IcedID)", "value": "56beeb27e07a03387c60c2088c098e0f11d239039bd17d08031804c62392c4b8aa269f8fe4bf660ed70b502c6483cf80", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284275, "uuid": "3b692139-e4f9-4fa0-9490-0afa20281826", "value": "82044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284275, "uuid": "6a4526b8-8ba6-4cb6-ad0e-d7ff1acb2785", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284275, "uuid": "7577ec40-a6f6-42da-94b8-16ae71afb4ab", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284275, "uuid": "b732c041-7d65-4e52-b576-87ed315f0eb9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284275, "uuid": "42f40884-805c-4d86-af82-767d7026510f", "value": "document-94683192.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea76f40e-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261706, "uuid": "b0d60970-1bf7-47e6-8361-18f9034c234c", "comment": "Malware payload (Formbook)", "value": "39831d904fe50bb3fe0afbd426aa1c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261706, "uuid": "239150b0-0161-4b23-97f9-f5cfb74f98cf", "comment": "Malware payload (Formbook)", "value": "271feaa759994fcda8d8727778c8ce54aaffdacc52ed398e8cb296023cfb47f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261706, "uuid": "c1e2b260-dc0e-41c2-b7d5-8b192fd5404f", "comment": "Malware payload (Formbook)", "value": "4147dcfff626c53abcca0429cba82610e4b5ecda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261706, "uuid": "99595ce7-4f7e-462d-a019-40dd33e79527", "comment": "Malware payload (Formbook)", "value": "398aa886a3bf24d73a85369f7d517c6d116cb8baad74621b9a67a7d44c4324025e784057b7d812d98ccd09ab0ac701d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261706, "uuid": "665e0315-6fad-4f20-a882-055b9b3c087f", "value": "86E4692337477BAEDD7853B62452440032B0AD35EB6AD50CAD65738C4F7B6C08BEE662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261706, "uuid": "45188982-817b-4e5a-ba62-bfd90edb6387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261706, "uuid": "5d987463-22de-4eb0-bbbd-6cba0a26dc0e", "value": "12288:sUf898rnjf/sdDhRHRYZinlnZSrNXKNbDzy9a0D/:sOXH+jx1nf8Nsbi9a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261706, "uuid": "836e388a-ab8d-4624-b2c7-7ddff70944cd", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261706, "uuid": "9f6c4f86-317f-42e7-a92f-c80658d7ff30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261706, "uuid": "deb2a6bc-ebbc-4832-9cd9-e898370cfc15", "value": "ORDER_ #42683.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730ccb78-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275679, "uuid": "afe09009-e942-4e36-883e-36452a6e3fea", "comment": "Malware payload (IcedID)", "value": "75dd2ddefbdb1405a37e21d9a4907f86", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275679, "uuid": "b6c73d63-b3a1-4c23-9d84-731435141c72", "comment": "Malware payload (IcedID)", "value": "2722247f3c1b1c73da2569a6dbb154e35632dd44b5e19ad70ac448f5d5ff2eee", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275679, "uuid": "f5138acc-34da-4a71-86da-36b13700b264", "comment": "Malware payload (IcedID)", "value": "98037e2ab313a83fe67a4cc5b76ef0c83cc5f3d5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275679, "uuid": "86387a41-303f-47f6-a451-de4aac467146", "comment": "Malware payload (IcedID)", "value": "5940ed34268b6ea15855a3999644dc71e09c25a4575069897509d1c7677a98c10fd9c54437f266ee9c76454d61271472", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275679, "uuid": "220b4da0-16d3-418f-b4a4-55c4be828a93", "value": "42044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275679, "uuid": "2ff4dd57-0d0d-4a41-b233-c0300b05e0e1", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275679, "uuid": "464707d7-c56a-44af-aff1-ce503a731c86", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275679, "uuid": "f774039d-7d7e-4109-a2f7-8792d44b86bb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275679, "uuid": "850c3756-0f33-4add-94a8-a794225dcfab", "value": "document-1355662065.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c1b95c-932a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617309528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309528, "uuid": "9801602e-d927-4ff0-b5d4-01ef19725b1e", "comment": "Malware payload", "value": "dee0b37140c78a520797cac11954a336", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309528, "uuid": "2d1bde64-8400-40e5-b5b7-6106f324118e", "comment": "Malware payload", "value": "279670a4fbf02fb2351811d9d02e1fcbaf6b071f4acd6e3daf6005c3edbaf4db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309528, "uuid": "177e9d30-bcbc-421a-b8c2-28acacd2c797", "comment": "Malware payload", "value": "a26a1ceb076267b8a73f653c314447405be22538", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309528, "uuid": "d1a21e56-3f3d-4a31-80f8-d4300db5c530", "comment": "Malware payload", "value": "38d01c90dccd6fcb6868594433319fc34484135574afb4bc673dc885704b5afcb9caf55945c77ee1a2772fbb77004d48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309528, "uuid": "85d24d74-8998-454a-ae04-f812ecab2d94", "value": "81C33B0AED525FE7C41ECD300239421A16DC95EE62E6733BF5BCEA6CB56D28548E3C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309528, "uuid": "50310e85-2c0b-4411-a4c0-3834420f36eb", "value": "1536:d2wjNkFvsqSeSlY9/8w2gDCQLSsERw7+93gEItPWKdWu2XlwjckcS4t0Bi4rUd:d28GSqSeSlY9mQLM6+93j2lrPhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617309528, "uuid": "e347ce83-10d7-4a17-870a-2152dd573b97", "value": 121048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617309528, "uuid": "198f7588-c2f0-4f42-9bc7-b3dca55cc1bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309528, "uuid": "9299ea32-8e7a-4cc0-aca5-2fdf707d3984", "value": "dml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18966b09-92b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617258776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258776, "uuid": "1add1aa1-c80a-4de1-add7-ac2d5f6a8e55", "comment": "Malware payload (AgentTesla)", "value": "8b29029bac808942d9576595450b4ebb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258776, "uuid": "b003f156-f410-4c6e-a678-28b0141c76e8", "comment": "Malware payload (AgentTesla)", "value": "27bfd9afe378e51fd22cf91cb2fa77cef33bf303f35db5f41c35dd12e650b233", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258776, "uuid": "bdea58c4-7bb6-410c-bd4c-f9317328a2e8", "comment": "Malware payload (AgentTesla)", "value": "a7914ea708edac2248d8adc3f39c9580c52c1c88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258776, "uuid": "c521e6ed-fa42-4cf4-aec4-eafcb08a163b", "comment": "Malware payload (AgentTesla)", "value": "f744e704f2b99034b4543965fe0a4ee485e0e37c4d8d4230b8a92928eee182b4b73b8c33101a2b4cba3fdc898993d42a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258776, "uuid": "7dedd911-75c2-43bb-9c22-5ab3e3455a2c", "value": "E2D4ADE625889A01D97B53F50C52D72033FEBC1ED666C5097DABF18C8D66AC3CA63243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258776, "uuid": "7da85913-4925-4376-8142-ccdb9d3d687b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258776, "uuid": "ed6a4b99-ac9a-4b88-ae07-c58c42b9cacf", "value": "12288:7blF8dKjJ7hqrpKOwHJ6e4ytfubz4o37w9lf+x:7bXAQPHJF4vvw9lf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258776, "uuid": "2d37e255-7afa-4cbc-8e30-d52dce1d628f", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258776, "uuid": "e3999150-63c5-4c65-8222-9846c9fdfcec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258776, "uuid": "af60aa19-07e6-4745-9c43-e5c7fbaef25e", "value": "8b29029bac808942d9576595450b4ebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d30704-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288291, "uuid": "e3cefbc6-6ded-48b6-908c-4c83d0954e25", "comment": "Malware payload (IcedID)", "value": "89a7c56b71588ff239c28ad68c6b71e7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288291, "uuid": "7ac50b4b-7964-445b-bc3f-4882cdce3085", "comment": "Malware payload (IcedID)", "value": "27e16a11396d7ca076f0dea09cabad3307660366e93cc4956b0849460ef0771d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288291, "uuid": "99683379-eea7-4548-9154-a2c3d8a6ac93", "comment": "Malware payload (IcedID)", "value": "ce9d71973bb605851e7b59b36bd9b70f95aa6fc7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288291, "uuid": "f93d2f38-73c2-4123-9ca6-7e14e0d8eb51", "comment": "Malware payload (IcedID)", "value": "f549314a1e8850b746970ffbedae630f2ed553641835d1e0242176b36264b6bce261e7eda36e9a957993bfc8e74171df", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288291, "uuid": "35472f55-9486-47f5-a55f-a48d6ae535c1", "value": "D5838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288291, "uuid": "66faa895-484e-4699-829c-f6595dac8ce7", "value": "1536:IB240XZfcaaxf+EQliU2hawITCAIoo8+BNvMhfvkq:+2d1cBWEQXMIT9o8+nEhHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288291, "uuid": "c318d9d6-9920-4be2-9f11-a0e693422c39", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288291, "uuid": "a14c402c-f750-4fc9-8f76-654c7fe9a8d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288291, "uuid": "9ac545f6-cabd-4aab-9a9a-7176012730fd", "value": "1193.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298535e4-92b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1617259664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259664, "uuid": "8dfad795-0011-4b6a-b9b7-3963643ef3a5", "comment": "Malware payload (ParallaxRAT)", "value": "e59dc7d6a3529d9f0a380189343dee4c", "object_relation": "md5", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259664, "uuid": "3402633d-0e1f-4a54-84c2-7b27da811689", "comment": "Malware payload (ParallaxRAT)", "value": "27fa5f7ee78f7288fa292412f77940a2a2baac93caad5214099f52bc6bcb3218", "object_relation": "sha256", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259664, "uuid": "e0642d45-c93c-462c-8f42-6fe4151eb1d9", "comment": "Malware payload (ParallaxRAT)", "value": "205d1c4cc30bfbc37de4d168e3bc1b489ca87629", "object_relation": "sha1", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259664, "uuid": "0d5b6ddd-7608-4072-97d4-a5951157e239", "comment": "Malware payload (ParallaxRAT)", "value": "3ecabe629e65baba6445c7c6dda23bc8cb0c68ee7c0ca60fab9773ed86843340063096aadeeedce98c85fc49d4e122ff", "object_relation": "sha3-384", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259664, "uuid": "d79fd7cc-6378-4caa-b7b3-45132635d7cf", "value": "8557D03136E4C073E4A32A380D64D7749EBDBC726A35C14BABD146A9AE307E1DE15393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259664, "uuid": "95905fc0-6e91-43cd-ad80-3e5260d5169e", "value": "425c54b6507d90a6e2c9eaf3ecf04a80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259664, "uuid": "0425f06c-f140-48f1-ab85-00ea4241e8e3", "value": "12288:4qFIlDHGjf9HdadGizzfaHEDSUnFiO6FP4uV8P3E:lWsjf9LizzCku8iO6FPrV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259664, "uuid": "3748ac37-006e-45bd-8cd8-673bd9e74cbb", "value": 27691032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259664, "uuid": "ee13ebd6-48ac-4a3c-9b85-6d68a20bf910", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259664, "uuid": "241ffff4-34bc-4b45-8753-97b92304ac93", "value": "27fa5f7ee78f7288fa292412f77940a2a2baac93caad5214099f52bc6bcb3218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1c185e-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274751, "uuid": "da922808-0fa6-4aba-a962-154fc77c1ad4", "comment": "Malware payload (IcedID)", "value": "dd44c678c18bb5eb6fa5c902eaf991ef", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274751, "uuid": "8c7fd3c8-876e-4eb5-a084-555bf710c15b", "comment": "Malware payload (IcedID)", "value": "285076f041fbce64a3655473bd9aa69e8f319c4dcfd1ef446b27bb4ca6ab75b5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274751, "uuid": "f06afd7c-2364-49e6-b1f3-ddf75dc72299", "comment": "Malware payload (IcedID)", "value": "ab4300d5ec4de226d52622b1b5a948eb52c36de3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274751, "uuid": "128f8c8a-bc01-4d9c-90e1-eebd30c28984", "comment": "Malware payload (IcedID)", "value": "63ed6d7a690b3cb39e39afa5db066734c2152b20f53481321bf073d8cda2b196dd99ea8677380a4e454743c64746d954", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274751, "uuid": "37dbd464-36d8-40c9-b97e-43564280095b", "value": "9D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274751, "uuid": "bcab9a7f-f3c0-49e3-ab63-a5bd4952b10a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274751, "uuid": "f48d8523-0791-4939-923e-9834e61f1696", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274751, "uuid": "89899483-a054-4db1-99ac-ef12bb01eb51", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274751, "uuid": "9f740f27-e6f2-4c94-8854-67ddc2d3e6a0", "value": "document-585933208.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872bf224-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275283, "uuid": "fcdd5d47-d5f3-40a6-9d89-9c5995b93a60", "comment": "Malware payload (IcedID)", "value": "a608123884aaf8c5f9ae5ced30a9b554", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275283, "uuid": "e2c8350a-6808-49e4-8c0c-86db7bb2c3e8", "comment": "Malware payload (IcedID)", "value": "2859737020a2752ca5aac971d9d253c0aae98f3cb7c3c323c35a09b546d93d0a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275283, "uuid": "a51c8322-df85-441c-9492-3088867fb95a", "comment": "Malware payload (IcedID)", "value": "19b18d9059aa90c25e831d28fc9592b988659b94", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275283, "uuid": "7143eddc-ebea-458a-b78e-109c6ea09430", "comment": "Malware payload (IcedID)", "value": "3d69617b1973cdf5e041f987ca751ec51740117984632a190986d216414b7c8e221d686b0c6c0bf30df32bf1c2f8acea", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275283, "uuid": "d13cfe1b-a72b-466a-be21-36c1787fc0af", "value": "C1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275283, "uuid": "10174433-e3a3-43b3-8ba2-39ff228ca2e2", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275283, "uuid": "97963a16-107d-4f39-8571-acae180147dc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275283, "uuid": "3bca78cc-41c5-4941-803b-6e70f13e8efa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275283, "uuid": "3ff37be8-ad64-4449-89cd-31e199bdbf64", "value": "document-1725299537.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe0905f-930c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617296745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296745, "uuid": "8c01174b-9602-42d4-9749-dd9a8967df14", "comment": "Malware payload (Formbook)", "value": "09955d6ed9afdb9ad72a59c4f92d7944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296745, "uuid": "13c28cc0-3240-4834-ac81-8ca8e442061e", "comment": "Malware payload (Formbook)", "value": "288224402f29f97e92aa6633bd3183c149f0d467e93481a3b77a34927999521e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296745, "uuid": "543149bd-a0ff-458b-8094-2b249908873d", "comment": "Malware payload (Formbook)", "value": "2f80189aa0e9e5dfcacdda951a810e134b63a8d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296745, "uuid": "0868b041-c7b9-4339-a12d-f17509b6635a", "comment": "Malware payload (Formbook)", "value": "78992d90a8e243f4f31989464030f1bd95edee2abf170f08c5c2a332ae81002cd2a3ce8676ec969df617dcc5a55cd40b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296745, "uuid": "2e59a411-e2a5-4bd7-9060-1eaaaccd1cca", "value": "CDD4D07223E89F64D13DE73958A5440013F0EC07E312E749BEA875DE9A71B884677BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296745, "uuid": "c7efb872-ea71-45d6-974e-0ddc0303646f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296745, "uuid": "107528c7-ab0c-4235-8779-0499e4329c7c", "value": "12288:vJOG67sbgYZrkN8w8sxJbWA5x9vnetC+t5GRS3KbGIy9ro8rruP:vJOGmYZrkNL88TetrqQInaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617296745, "uuid": "f9149d56-9fb9-42e4-b69a-a2c9f9abd6c9", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617296745, "uuid": "cc38977e-a2be-4670-a028-1c4d236d7972", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296745, "uuid": "daa494d1-ae9c-4811-9255-8a220904a116", "value": "MV WAF PASSION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352af23e-930c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617296620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296620, "uuid": "9b5eb4c7-c7b2-4355-9eac-d1558d25a07f", "comment": "Malware payload (IcedID)", "value": "1ec6aae1b2f57a87f2d100be5359af6c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296620, "uuid": "f7291b32-ad5e-498b-8331-a5b60ec06082", "comment": "Malware payload (IcedID)", "value": "2887938599e328d3ad47b445dafc9b7db78496b938125afaf428f93be7b6a079", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296620, "uuid": "ee114999-724f-418f-9f55-6920d427752d", "comment": "Malware payload (IcedID)", "value": "073812b6bccb1055afc716af021b72a4eae86542", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296620, "uuid": "4b60ec44-33b3-4684-a742-6e0da991fe7d", "comment": "Malware payload (IcedID)", "value": "5a3f4736f2b03ca86a697afc0ef31955e18971642be9a27c8208ac906c08af4396c844ffd1e94a5573b8b9821cb0a3a2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296620, "uuid": "84296aa3-f8bb-4812-bea3-1e1a523701ce", "value": "86838DCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E4C42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296620, "uuid": "c58cfac1-81c8-4a64-973b-85cb6f5a0433", "value": "1536:IB240XZfcaaxf+EQliU2hawnCAIoo8+BNvMhfvmP:+2d1cBWEQXMn9o8+nEhHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617296620, "uuid": "2f6311ae-988e-42f1-bf22-95a3cf1d23a7", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617296620, "uuid": "7bb1b336-e7e2-43c6-a4b7-23e1c546d354", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296620, "uuid": "98acd9c0-e5df-4594-a4bd-6468038e23f0", "value": "2580.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17911b69-92af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617256627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256627, "uuid": "12a5aa84-5d22-415b-a6d4-c5e01c41faa6", "comment": "Malware payload", "value": "c7d45138710ef663b3c2cccfe1a4e0b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256627, "uuid": "7550c292-36d8-4a02-86e7-99725cd50172", "comment": "Malware payload", "value": "28bad07588864892a48ae72dbc2355ca19aa48d3854a29800f83131ee04e1023", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256627, "uuid": "9713f8d7-b150-4499-9cf7-4af3e05566cb", "comment": "Malware payload", "value": "ab8639fef1614fda5fc6e2cfa52d9d60adec27b9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256627, "uuid": "36db2801-a6c9-4c25-93f9-d14c977c44aa", "comment": "Malware payload", "value": "b0f4f2882b0a71a06e5d31705d0f5dcdfe361a1db48acdaacefa3f6da0d978bb438f0384e68bb637f4806608850c1a64", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256627, "uuid": "555357ea-1b26-49e0-ae70-aa47738ce273", "value": "DF942320FEE4920C5DC054FF8218BC8A8CE4877BE45A7879DE76B546A074713E5E37A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256627, "uuid": "dceb5c29-45c0-46a9-9fee-5e2c791f1b74", "value": "12288:NeQTU6RfqsOGX5FNLMPScQ1SMr8TWhvQa0JpEQ+AzgM:NeQPf5OMFNLMPT4SMr8KCbbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256627, "uuid": "a34df925-04c4-4aaa-8439-10a7b91989d3", "value": 415789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256627, "uuid": "fa5bdc83-6826-47e6-9690-c2da25c673e0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256627, "uuid": "3cf77a68-226b-4b4b-88b7-ff162049e7d4", "value": "Documentos de DHL..PDF.....gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029cdc74-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617278926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278926, "uuid": "a7f18c49-4c5d-410f-b806-0c525cc907bc", "comment": "Malware payload (Dridex)", "value": "ac1f6be52ba71fda419a32196bad9553", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278926, "uuid": "d2517771-e150-4e36-a931-8f3aa42af3e8", "comment": "Malware payload (Dridex)", "value": "28eec4c8c8d0c1c932c829138678e9413c9f46173a81ada54dee3bed199e46a7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278926, "uuid": "5a9409ab-53ad-4c5b-b21a-e199807ac6c3", "comment": "Malware payload (Dridex)", "value": "86d5a11a8f17995fd27e5cf15f6cd12ae1f4015c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278926, "uuid": "41651f06-c391-4e6e-9246-491add3cddd7", "comment": "Malware payload (Dridex)", "value": "b22c05781542a2758f2793c40821c9296bfad70063af89bf79cffb508aa3488e57ebdbd3819aec046c7b1805906ff573", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278926, "uuid": "e0282451-0d54-470f-809d-878c17d996ce", "value": "D314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278926, "uuid": "fda56ab6-0716-4134-9906-38ca734bc1c8", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278926, "uuid": "38121078-a442-4388-9a0b-5aaa6ab2a1bc", "value": "3072:0opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:rpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278926, "uuid": "bd6d64d5-5518-4dc9-815b-2c9d4094da2e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278926, "uuid": "f3ce624e-ec1f-42ec-9718-09d53d2e916f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278926, "uuid": "e8b9f236-ad61-457e-b6a0-2cf7d60540b9", "value": "28eec4c8c8d0c1c932c829138678e9413c9f46173a81ada54dee3bed199e46a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904eedeb-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281741, "uuid": "ac43fd09-9363-4220-bd11-f17b5f4d5489", "comment": "Malware payload (IcedID)", "value": "47e4497f3e9655a2f41c89c8589a0838", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281741, "uuid": "3b553495-9ecb-45d0-a468-50ed45fc9c1d", "comment": "Malware payload (IcedID)", "value": "293b557d8c26ee1d4db3e510c5c172082c8ffd771f3cc5185b6d97372e4c30b1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281741, "uuid": "ee1d7025-a280-40de-9f29-954b546b4bb7", "comment": "Malware payload (IcedID)", "value": "a05b12523027764b7cf2f94b7082902b3eca9dd3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281741, "uuid": "949767c1-95f8-4d7f-9f65-9dfd8c60b1d9", "comment": "Malware payload (IcedID)", "value": "325f9d8a1f31cabfc8974d4fc0d89a0bf049d2200d2d6a2cf53074ed401bf4764ca4e14a388728829abf823aabd38368", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281741, "uuid": "ac2a75e9-f0ff-4436-a332-baa39546c36f", "value": "B0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281741, "uuid": "ed94d471-9efa-48fb-ac9f-66b014066bae", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281741, "uuid": "d2f1f0f2-88fb-463c-b8dc-aee177c7ce34", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281741, "uuid": "652f14ca-8eeb-4d5b-99b6-1ebba3137845", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281741, "uuid": "d4f213d3-f97f-4cee-a9dc-a2cf73ed5eb7", "value": "document-103083228.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e89bbc4-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276959, "uuid": "5b1ba65c-5558-4cbe-a14d-4037c7ff32a0", "comment": "Malware payload (IcedID)", "value": "f49ec3526daa9eaf696f645148458d58", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276959, "uuid": "0ff804fd-8f4c-4a0d-9432-a2cf6881d5ef", "comment": "Malware payload (IcedID)", "value": "294aa96fe02abf63f69f3bd0f99ce3fd25bf2417bef7acca8877083ca12818b4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276959, "uuid": "894884c9-a884-41c7-960a-81086ce5a48a", "comment": "Malware payload (IcedID)", "value": "4abc93760734b266dc0cbe9a31b67f48cc84c38c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276959, "uuid": "e7c27b2d-f482-4d27-a115-a7a9afbdee32", "comment": "Malware payload (IcedID)", "value": "e5d006bf4ce7b771cbf952e20390fc052d31c3e40c1dd575cf1ca325a90c0095f427ff049f741c2470e183ff9ae7cf88", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276959, "uuid": "623e518e-af69-4bbd-89a7-a37e434dada4", "value": "4C044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276959, "uuid": "53f5c715-8e1a-43ac-9890-97f6ef18daa5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276959, "uuid": "7979551a-818f-4d2d-bab2-7d347fc5a719", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276959, "uuid": "8ad0e46e-0db5-40a7-ad91-9f35ae48faf9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276959, "uuid": "ffebf466-7125-4375-a36e-198c04ea2513", "value": "document-1367088180.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96649cd-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617290426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290426, "uuid": "73592677-0d75-42ad-bf34-b18ff1e94fbf", "comment": "Malware payload (IcedID)", "value": "58830929863501a9541770d18bdde049", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290426, "uuid": "5669a4a4-f352-42a0-9b36-65b060c1f23b", "comment": "Malware payload (IcedID)", "value": "2984667bf0395b9dee2a890a60f916847cb465199d896c93abb85004b750a8f6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290426, "uuid": "f90742ea-22ca-4ba2-8d07-3692dd2af9d2", "comment": "Malware payload (IcedID)", "value": "cdeccd04211396f3cd5897595c8b8e33de5ca34a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290426, "uuid": "4df1646c-64e8-4cff-b710-dd03aa46df6e", "comment": "Malware payload (IcedID)", "value": "93718d1c3aef364f92a7f69d92bc72df8ad79b963e5da73cf1dd9dc72648e483f685c83f3c8a7b5eece12587aabda9a7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290426, "uuid": "8fea66b0-24d9-4aff-9ca4-2f8d444c644e", "value": "1C838DCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290426, "uuid": "cb5b16b6-698b-4cae-81ea-752483973809", "value": "1536:IB240XZfcaaxf+EQliU2haw5CAIoo8+BNvMhfvI0:+2d1cBWEQXM59o8+nEhHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290426, "uuid": "92c23524-2cca-4182-b8f9-051b367e53bf", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290426, "uuid": "d04d6798-dbff-47ab-b019-af06341dd2ef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290426, "uuid": "6442f86e-1a91-40c0-a1b5-0b103252fd2c", "value": "2889.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78438ec-92f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286531, "uuid": "d8c2392c-9103-4b3a-bc61-d7f259fc157b", "comment": "Malware payload (IcedID)", "value": "192cbe1ffd6fb61c144a457b9fc72c92", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286531, "uuid": "f7f69bc8-54d9-4a58-860b-e77382d93597", "comment": "Malware payload (IcedID)", "value": "2a0eb77df47681e6fceeae10449648a5adf81156c0742313a14d377653b0ecc8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286531, "uuid": "d6a50b10-d680-4785-82d5-89525f379028", "comment": "Malware payload (IcedID)", "value": "f6a082616bb7abe299cc9ef98404e535d590c533", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286531, "uuid": "55b99d33-c757-4de1-9d11-656ab3299632", "comment": "Malware payload (IcedID)", "value": "ab2c429da282e42e676ed2a93aedc926d1ef67ed7020ff2c899cf6597b9382cc8b515e74f1c24bc3ea0260f028d87533", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286531, "uuid": "12fbf2b2-a2c0-4dc2-9cdb-ad1094aafeb8", "value": "C3838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E0D42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286531, "uuid": "ab7513f5-02d9-49a8-a8cc-dd68acd0f802", "value": "1536:IB240XZfcaaxf+EQliU2hawpCAIoo8+BNvMhfvNTG:+2d1cBWEQXMp9o8+nEhHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286531, "uuid": "69644b55-715a-4325-ab9b-92a930bf81d9", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286531, "uuid": "1dd47464-13fe-46b6-99b3-412e20ce7fe3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286531, "uuid": "888d74c1-59fe-4f8e-b742-5ae687fef10e", "value": "996.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8a2ff0-92ae-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617256560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256560, "uuid": "741e5e10-5729-43fe-a182-9d6939c22575", "comment": "Malware payload (IcedID)", "value": "49aa1eb24a469e2854d0cf0f036c65e2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256560, "uuid": "96ef7ab5-035f-4b9c-b044-11272e12db76", "comment": "Malware payload (IcedID)", "value": "2aefbd5d90b7e321ada6ca4177b64903714287dd72308b234928dd2339ce3a95", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256560, "uuid": "fd5f4789-9a9b-4ece-b7b4-fdb7ce95963d", "comment": "Malware payload (IcedID)", "value": "fdf8f53165f5dab9b1c125c4dd78e61611011bdb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256560, "uuid": "4cad8db1-f217-4270-8d59-1d42f7b1f26b", "comment": "Malware payload (IcedID)", "value": "0b8cc137fb940d1c137bf281f6b3a59356a78a550c8c3d4a8bc78a01c88ec851dec87bce923eea10c372cdeb3bfe3a3e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256560, "uuid": "cc8ba46c-218e-493f-80b2-5e27cb1c5136", "value": "3104123CD47A5C68C3A6543BD82CC1956C592022ACF8E5AE3588B598BA637F30F5FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256560, "uuid": "bd66ea51-8800-4aae-b183-266860b3424f", "value": "3072:QxXvXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGCr9MA:QxXPE5SDvbXAyHbVt15wTQD/ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256560, "uuid": "0ce1f877-5c33-47db-8a15-64d1691164d0", "value": 180623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256560, "uuid": "86858a36-3b85-46aa-b474-0a168e3f0c0f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256560, "uuid": "709889c5-903e-4344-8b98-e685293f2c5f", "value": "Indebtedness-1861756753-03312021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ddc055-930d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297232, "uuid": "85dddc5f-3e19-4603-8090-e1e248d34e02", "comment": "Malware payload (IcedID)", "value": "c5f0d70ddeb0cdfe6cff2652b5bbd9ec", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297232, "uuid": "a3bd36e8-9d57-49e3-be36-993e80f1a536", "comment": "Malware payload (IcedID)", "value": "2b308aeddfa8a4b35fc6f1a61cad18b03b4cb832e4f3b42d455718bf9ed40209", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297232, "uuid": "59d5d326-97fc-43c9-918e-c80e6b1f151f", "comment": "Malware payload (IcedID)", "value": "254fb4f6023460d708511725069cd8e5bd0d1d9a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297232, "uuid": "d713bc5b-2201-4611-9c05-3a4774778fc4", "comment": "Malware payload (IcedID)", "value": "8f1c988e7d0551350bdd3c4d3677e04fd65321c8010f72a7e8f4d527e3924a8a8b12bb6146a5bbd632292ef89183f53f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297232, "uuid": "6849b633-6e0f-481e-a936-7dcadc4256a3", "value": "69838CCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EAA2E0D42FA40A5E7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297232, "uuid": "438858d9-e46c-4962-ac78-1d03f0883e27", "value": "1536:IB240XZfcaaxf+EQliU2hawnDCAIoo8+BNvMhfvJC:+2d1cBWEQXMnD9o8+nEhHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297232, "uuid": "a0947082-bd96-4c04-8a4f-7b8f9fd61d6c", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297232, "uuid": "cc872266-5cae-4d3f-91e4-83a7390fc002", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297232, "uuid": "fa90de24-af2e-4f1f-9863-2d74c968f563", "value": "3302.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f2fe4a-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278160, "uuid": "f577ce5f-bb99-463c-9db3-e16d561b04a6", "comment": "Malware payload (IcedID)", "value": "8ffe5ae58ef3620203606fb60570d25c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278160, "uuid": "d2c3c70f-f67d-4428-92f4-fb7db3022df4", "comment": "Malware payload (IcedID)", "value": "2b33d3768bc92f6205a3ca5b0781ed87b1a1266e7ffe28ff57f00019634a0c87", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278160, "uuid": "7e6de87c-ebd9-452a-84a8-037855ec2f3d", "comment": "Malware payload (IcedID)", "value": "9de6860e6cebfeb1ec904de10698e014381e246c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278160, "uuid": "85d34d41-9fc6-4bd9-8d2c-371ffbe14309", "comment": "Malware payload (IcedID)", "value": "a1c14939d3157ab0c584e35746524278e38ec3e88233f4358ae1d6d4200cc94fd07f525b454143291b81521ee7d00962", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278160, "uuid": "5d29d230-a5c1-4ca9-a88e-9eede4d566eb", "value": "19044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278160, "uuid": "04f286a7-b94d-4d94-a163-0ded671f3cd9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278160, "uuid": "40043f97-fce4-468b-ace8-2e7f1369e9ee", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278160, "uuid": "26d02aaa-0c06-4b61-8068-3d36e9127208", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278160, "uuid": "aa702203-b533-495d-998d-f974aee0ce73", "value": "document-1943582489.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8152ab57-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281715, "uuid": "cc8f7204-7179-4251-834f-0f4965ee34cc", "comment": "Malware payload (IcedID)", "value": "4ef0f19cc0c1168b64ce19ff5612b060", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281715, "uuid": "5ea6af43-3871-4d54-9c34-097ca9d1e81a", "comment": "Malware payload (IcedID)", "value": "2b386b4967098b1db6a3d26b622ad780a659835bd3f5a873a01300cef68057c7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281715, "uuid": "2c67aa6a-2fae-4e43-bffc-594dff743915", "comment": "Malware payload (IcedID)", "value": "c985b0265cc508f59a2666cf4157153dde9e179c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281715, "uuid": "acd00393-042f-4cf2-9c13-a2b111dc3a77", "comment": "Malware payload (IcedID)", "value": "2e9be57aaa66ea5375f3692d0ae3e3af097198b5b5dfca1dd7fda1dcbbba6469e7e8e78476ff9c64bf9954a3405286b6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281715, "uuid": "4c0f87b1-9698-4599-99a6-079f4ccda3d6", "value": "90044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281715, "uuid": "e93aca7a-ee0e-4223-9f3d-72dc657b3cfc", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281715, "uuid": "bd748e8a-df27-4fac-9274-258cd9c2262e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281715, "uuid": "78e4cfb5-a880-4389-99b0-291d66b72ae2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281715, "uuid": "3df1108f-9919-4bfd-847d-23ee5c5e48e5", "value": "document-550881172.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fcca16-92b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617258341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258341, "uuid": "84f02a38-2964-4fea-a05e-f3ffed7d0fba", "comment": "Malware payload", "value": "d06c58fc3707bfb81ea568ed29b0bd90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258341, "uuid": "ce8a9b2f-9d0d-4f43-97a9-ae018331d3e6", "comment": "Malware payload", "value": "2b3bc3acd3db0ead8fef46a88b397b7a12f84e1f884cabf61c47ea0dae990ec9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258341, "uuid": "91f96487-0f8a-4f18-84fc-4ded7d3d160e", "comment": "Malware payload", "value": "3822fda1546a125ea13f0fbaf84079ab078eddf8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258341, "uuid": "34b36036-90ec-48a7-a30c-ce8d3d5303f0", "comment": "Malware payload", "value": "9c204eec6ee9d4cd3be1f5c8efe1c57d7e0a9b208ac4d60986748c93b1f16164c501c9a4e8e99cf28b3b692e9b4beda6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258341, "uuid": "3211251d-e782-48ef-b766-438d5fb7183a", "value": "5DC4235672C99FF4D7A148995D0123C88BB3FB76E0F815B70EF6F85F55808EA21192E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258341, "uuid": "ba51843e-a320-4a87-9576-8a70c93f5dbe", "value": "12288:llQA/0sPKJGtSH/tGL32bHwSpNma4gBbtubTHTr:llQABsT/cLawSpZbwzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258341, "uuid": "bc8e7f96-ceb4-4071-b345-9451a8f0ddf0", "value": 546150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258341, "uuid": "08bee1d3-ad34-4d6b-861b-18e561a805ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258341, "uuid": "6391bc78-0fb5-48d1-8ca6-99aaaf34cecb", "value": "SNQW09000.R12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5e37a5-930d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297228, "uuid": "04b7f19d-bdd2-4ad4-9374-2304cf998dde", "comment": "Malware payload (IcedID)", "value": "52da7ec46c59ad5b8fc2b4385cfe1678", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297228, "uuid": "0aaef3d7-0593-46fb-b717-de21e2519212", "comment": "Malware payload (IcedID)", "value": "2b3ee4b39508a2bc58a7010ec86bf9c0b9dc297a64f0fcf1ad5a7d9b70e06f33", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297228, "uuid": "781c8d73-f97b-4c96-981d-8e6f09712ee1", "comment": "Malware payload (IcedID)", "value": "c3cddff750492f4b254aec7d742a08bcfad9777d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297228, "uuid": "b511aebe-8ac9-4a86-8fd4-0906ccc59e8b", "comment": "Malware payload (IcedID)", "value": "e1d605b6e3903dfcb59f956f1803cf76404b6289ae4d29be2cbd07b82f196476d5c55eab5d6c51132dcf6de0477fa084", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297228, "uuid": "ca8d19b8-e334-44f6-930f-331001c59df7", "value": "B5838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EA62E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297228, "uuid": "9291c418-b715-44b1-901b-6265e98e60c8", "value": "1536:IB240XZfcaaxf+EQliU2hawvCAIoo8+BNvMhfvG6:+2d1cBWEQXMv9o8+nEhHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297228, "uuid": "ffbee0ea-2219-43d9-84e5-1936242d89ad", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297228, "uuid": "ba43c362-0908-4427-969f-9f354fa73e2d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297228, "uuid": "526fc4d0-50b7-456d-98e3-7035317a1798", "value": "1658.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3014b202-933c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617317227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617317227, "uuid": "4a01ae8b-b999-42b7-83d6-3698dfcc84b4", "comment": "Malware payload", "value": "fd68532cde02916ef827a7e29259b0cd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617317227, "uuid": "6a3f091f-1976-49a6-a574-7e6eca210897", "comment": "Malware payload", "value": "2b4140322981da4110a9c6c3a4e25079e9a09177bd953480f8c8ecb36a3db803", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617317227, "uuid": "49cefcc6-339e-4393-b585-322aa23b8677", "comment": "Malware payload", "value": "17e1f3d5d48e13aa5b8647f1e1ec914b365d1062", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617317227, "uuid": "274ede0a-8d01-45e7-b673-5c6ecec4cf0d", "comment": "Malware payload", "value": "12dbab0c5ebd8bf3f17cdba5959fe58ccb9aa4e6415ab283e3068867e79af1bf20bae6fdd377b6f4d29052a3d09f6b1e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617317227, "uuid": "807a9f4b-23f4-4e5a-ad02-e1c6ac49f3a1", "value": "FD14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617317227, "uuid": "ded67107-e771-418a-b43c-2019bb600998", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617317227, "uuid": "f328c3cf-2e45-44c4-8650-d2cd7677a138", "value": "3072:Kopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:tpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617317227, "uuid": "fab17bbc-f045-4ddc-8dca-18c47d3b31a4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617317227, "uuid": "56aafb9f-c0da-4e00-87ed-c8be5d4dcbef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617317227, "uuid": "682a4e8d-31a2-4e7a-b876-91424f6d19a2", "value": "2b4140322981da4110a9c6c3a4e25079e9a09177bd953480f8c8ecb36a3db803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c229d3-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278185, "uuid": "8842103f-60ad-4170-9ddd-fb491691c875", "comment": "Malware payload (IcedID)", "value": "b95fdec673c722e24540a805d6281c04", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278185, "uuid": "c6bba303-960e-43d8-9e2b-f19ecc73c481", "comment": "Malware payload (IcedID)", "value": "2b571b868700ea2098f78664851feb87ed73c9ca90bb516bcc3ad3c407c3b4d7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278185, "uuid": "74bfbda8-b540-4a51-8e7b-be421589df57", "comment": "Malware payload (IcedID)", "value": "ce09beb9540a29e08737be8daeff90e28097012f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278185, "uuid": "d59d5935-c685-431c-a935-6174db5cf6ac", "comment": "Malware payload (IcedID)", "value": "0ea467ceacb385f286bad2aca7e68390f052a7fbd0b748349681a205f22e7fe8f708c2a452416eca3374172bed43bacf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278185, "uuid": "328ebae9-5a99-4dc1-9347-480488dc2282", "value": "35044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278185, "uuid": "d4a3a8ce-b935-4e7e-9bd6-b19bc32416d5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278185, "uuid": "e3340391-4ea2-4546-84e4-aa3995417503", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278185, "uuid": "b077ea5d-b789-47e8-9939-2437455c16f8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278185, "uuid": "f99be6fd-de12-4efd-8224-3bc91c3d906d", "value": "document-641718704.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eda146d-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279913, "uuid": "5cde266a-2f37-44ed-9701-de4450ad6be6", "comment": "Malware payload (IcedID)", "value": "414ec2a0c5a6b6a722edd2430167c260", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279913, "uuid": "0b01e069-5d74-439d-924a-3d3bba97f1ef", "comment": "Malware payload (IcedID)", "value": "2b6355362a24c78e37c7ddabfac2a81af734d66b1489259dabdfa25cecbcd184", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279913, "uuid": "8ceaa211-c9c8-45a0-a6d0-8513b55c01f5", "comment": "Malware payload (IcedID)", "value": "890d84f32904fb9b3f643fe07bae25cfff8102dd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279913, "uuid": "59067080-04c4-4c7d-8543-1fc7ab020fbf", "comment": "Malware payload (IcedID)", "value": "8b84adeabdc2864a26f3dcd5df87d18071df584ad34d42c546427ed2677615459778b293ef9f1726bce7454d2404e75b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279913, "uuid": "923ab5d5-7058-4582-8572-8f6fa50991d6", "value": "8C044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279913, "uuid": "e1299d39-0def-4ad5-a8ff-f4e848342da3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279913, "uuid": "519614c9-6b24-4abd-a52e-7cf9b0b8869e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279913, "uuid": "4222b202-736c-4959-a235-42e60ba47ddc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279913, "uuid": "8bbd9277-c5a4-4199-a46d-f8ebe8dd0464", "value": "document-800254041.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536c5364-9314-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617300107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300107, "uuid": "1bd35daa-9706-42bc-974b-64b8bb53feec", "comment": "Malware payload", "value": "9967d8bdc2636819a7b5ce6df1067c63", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300107, "uuid": "43283453-93c8-4d5d-8225-21c8a1ff8a89", "comment": "Malware payload", "value": "2bb2ac1afe8ba7e811d9d45af93ce5fdd953706a69767cd5d51da576bddb2e42", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300107, "uuid": "e0bb0a62-a813-4305-b012-7ef7916428c2", "comment": "Malware payload", "value": "0cbcbeafe91821f93a11cbea26e457da574110c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300107, "uuid": "a8cca529-50b1-4120-9676-188d7fbdc040", "comment": "Malware payload", "value": "7da7ae4282b3629ff173e8b3dd0f76d6d293c8112acbd18d4ab3c4909c736bd82382e3a966d3a43306f1192f87d51fe4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300107, "uuid": "8cef3bd6-ebcb-4f89-923f-9300b7ca4fca", "value": "DA21DB9997A24D3BC0151AFBC4075AA5BEFFC46CEE0C5318C5913748DB77959144F90C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300107, "uuid": "18fe742e-f2c2-4ab5-b852-f9ccbbb5c7f2", "value": "24:3tSyg6qt0cvX2lhsieu8+l+A9Dr2RB0pPtNjDdj2DBfVt3KIaSOwzUSBE:9SygxCWUN2QPTjW1VtaHZwzUSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300107, "uuid": "7f4ed1fa-69e5-4003-a03a-6f0f8892e028", "value": 1408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300107, "uuid": "67948b75-c880-4555-b945-c4399a73a1f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300107, "uuid": "4673ab6a-8911-4367-9e91-7d3b568d5c01", "value": "SecuriteInfo.com.Backdoor.Linux.fkxe.9029.16385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4be980-92aa-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617254654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254654, "uuid": "b10ac185-d2fc-4b4c-972c-223d1eb3dd3e", "comment": "Malware payload (GuLoader)", "value": "f2fa3c87de32858f1244fb352873f399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254654, "uuid": "7922ecee-4c79-48aa-890d-43473f9bb980", "comment": "Malware payload (GuLoader)", "value": "2beda3caff1f808814294dca346cbe62ad229272d54696fe75e99388a73ff3cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254654, "uuid": "4eeb9006-9005-412e-9c75-1bfb37d9e4d2", "comment": "Malware payload (GuLoader)", "value": "3d6f6d635639c689a8e4709ccb379500b4e76096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254654, "uuid": "79439f45-c7a3-405f-9b0e-5670ceedcd4d", "comment": "Malware payload (GuLoader)", "value": "ea80c28f01c6823f22af518413a56619f4074d7711061c53a356dce61b7a45dca8dfae19b9fc88b69fada3b330cba45a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254654, "uuid": "8e6451c9-1665-4fe7-bcab-c9519c791af7", "value": "C99317C0FBF78A3BD227CAB17914C89D10AAED7092D9875BE54A373925317E0506273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254654, "uuid": "130b827d-642f-4e60-aba0-b4d0e78f4584", "value": "c78f78af0a4b82efe93f926bf0040578", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254654, "uuid": "03b6b21f-9f94-4c2e-a558-7ee8eaa194ca", "value": "768:xKOhTQs/sICfEBiQPIHYqH3qkfNS1Z5EK8GEHPZNrLzrKBvY:1hkGxCfEBiiIjHBG8tHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617254654, "uuid": "0f700c18-2598-4b44-a251-81973f2cd63f", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617254654, "uuid": "81210459-4867-4f42-bc45-1d21f1954df1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254654, "uuid": "f29ab00d-d01e-4eff-90cb-e8f6c7d0f147", "value": "AMPUTERE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2fc4eb-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288287, "uuid": "3a25915b-7421-47ff-be48-dd0d2d96a7da", "comment": "Malware payload (IcedID)", "value": "c756e15a6a9b844329c3a5f70fa8790d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288287, "uuid": "7663134e-a8fe-4b03-877d-121f04126cf8", "comment": "Malware payload (IcedID)", "value": "2c4f120be2208b210005f6a50c189fdc2e7ce661482633bc3f5efb3e706539f1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288287, "uuid": "f07be99f-1fcd-44d7-abbc-10399efd903b", "comment": "Malware payload (IcedID)", "value": "c64bdb961e68bb13e22eef1a75fc3bf5a7db9df7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288287, "uuid": "fbcb5ee9-7161-458d-96c0-d9493821fb47", "comment": "Malware payload (IcedID)", "value": "542dbab384a415d756609fec169a6fc20ec5b7f8840e9ee37865b149a74180697bb1ac5cdb5971f448bc6830898ff310", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288287, "uuid": "697cdf8d-c27a-42b4-ad6a-cfd07b51b136", "value": "27838CCDC913E1DAC2559FBD5A09308112F4E0B7276FF11B148EA62E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288287, "uuid": "b97fe4b0-f110-4852-be4b-2c9ca8b59004", "value": "1536:IB240XZfcaaxf+EQliU2hawdCAIoo8+BNvMhfvtH:+2d1cBWEQXMd9o8+nEhH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288287, "uuid": "d3ad2662-a449-4ea2-8f5b-b781b782d04c", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288287, "uuid": "b6442aa7-27aa-4106-b4c6-c6eea149c3e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288287, "uuid": "786efbde-a53c-4fd4-acbe-e9793179de03", "value": "1216.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd577e97-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288285, "uuid": "e6fa6432-160a-47c3-ad0b-feb7a95d0b14", "comment": "Malware payload (IcedID)", "value": "0d09549c83d2df442bcbeb4403e3fdb1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288285, "uuid": "0927c9d9-9fc9-45e5-8338-d28b00abd8f5", "comment": "Malware payload (IcedID)", "value": "2c7389e7a7707d344e3118092dc40e3236ab35c5334aa3d9e5b7a42d836f7a0d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288285, "uuid": "1f152eb8-a9b6-4dc6-8493-4d2c96e1442b", "comment": "Malware payload (IcedID)", "value": "a85ab45b8ac8f5dbeec21c8e1a41c73fa892552c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288285, "uuid": "1421928d-97c1-42e9-8c4f-1b6958fc0e72", "comment": "Malware payload (IcedID)", "value": "9ee4bd3adeef2401a148ce6ab7172d3a4afbeaaf58832d58fdbe5190d99fd78abe06c6d8547b3f5fa3406ca6f8d14711", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288285, "uuid": "e9c9185b-7d86-4a46-b02d-3df1ff705f82", "value": "9B838DCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EA62E4C42FA84A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288285, "uuid": "e4841580-b880-4c17-b42e-5327aac6732d", "value": "1536:IB240XZfcaaxf+EQliU2hawuCAIoo8+BNvMhfvIS:+2d1cBWEQXMu9o8+nEhHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288285, "uuid": "bfc85f71-31df-4d74-be48-bbe880bac9e6", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288285, "uuid": "ca750211-cbd2-4761-8ceb-4a83ac64cca3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288285, "uuid": "19823a00-3f04-4a4a-8810-8490f26aaf90", "value": "2890.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5836bab6-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282505, "uuid": "4c5b5c40-736c-48a0-91cf-aa0d7722f353", "comment": "Malware payload (IcedID)", "value": "5fc1ecd3552b21452cd1288a9433de0e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282505, "uuid": "43dbf4bb-c622-4fa3-a02f-c7cd43e14b54", "comment": "Malware payload (IcedID)", "value": "2c9578599e263af5f50a8c19691dc37bfc886cfe859cf2c629a59cf7be698d77", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282505, "uuid": "59c66b5d-5a76-488f-873c-af5099ce1fff", "comment": "Malware payload (IcedID)", "value": "2f12a26ed61a207585fe2aa70f46832fc75535d7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282505, "uuid": "bffb86ec-3901-41f0-9f20-4def5e8031c8", "comment": "Malware payload (IcedID)", "value": "8d62e6f427b1afee4261b474971c348c9ae16788571044112456bf312f6e7e5f75e9dbe7843accbe1e65ef757b9b795f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282505, "uuid": "31bd2550-d386-4da7-be4c-1d5464b8f2b3", "value": "75044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282505, "uuid": "f3d97718-460f-4bc5-8040-347c882975c2", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282505, "uuid": "b514ccb7-dd5e-4d36-af00-b0a88d7a6861", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282505, "uuid": "d17796de-7d18-4f9a-b285-eec095093d02", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282505, "uuid": "9bd77985-e795-461b-9343-a9ce48f41bba", "value": "document-2046267247.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01722243-930a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295674, "uuid": "e5a9160e-61f2-4f4e-9661-0bb7bb178fb9", "comment": "Malware payload (IcedID)", "value": "6677151c78a127b57a84060ecd5ca6f9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295674, "uuid": "766c822a-604a-4752-8c17-bf5e2e40934c", "comment": "Malware payload (IcedID)", "value": "2ca3a420343a763ce676078a1e44ff3ceec1bde1f0f04383c4054ff78f625ed7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295674, "uuid": "1c83f722-0c39-4a41-85ad-96287337aabc", "comment": "Malware payload (IcedID)", "value": "0299871e3e46e6c624971646542764959609ff9e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295674, "uuid": "1d601ac6-7a66-43e6-9a3d-b8761e5949ab", "comment": "Malware payload (IcedID)", "value": "cc21f09e682e61efcd2fe5f760b42797c82d22bc755e2638976cafcb5ca71b20cb8a43b55511a157c2076fb6bc0955cc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295674, "uuid": "b4e5e5b7-dc84-4c6b-9c5a-426fcb2d4f2b", "value": "6F838DCDC917E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E0C42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295674, "uuid": "f1a2e2f9-f384-44ef-be28-5e7165223ed9", "value": "1536:IB240XZfcaaxf+EQliU2hawgCAIoo8+BNvMhfvvI:+2d1cBWEQXMg9o8+nEhHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295674, "uuid": "f452440c-5628-4c8d-8700-01a793deac6f", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295674, "uuid": "a7b93b38-9688-4bee-8572-ac478e6dab08", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295674, "uuid": "18cace66-e4d6-4de0-945b-7274f5dd998c", "value": "86.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d4f1ba-92fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289030, "uuid": "aa1ffe24-d580-44f1-94ac-84c65e5016c2", "comment": "Malware payload (IcedID)", "value": "684b3b01802d7017dcf3ee6cfddd1c4e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289030, "uuid": "b32d9ad1-956e-4055-b037-a32e7f2d3782", "comment": "Malware payload (IcedID)", "value": "2cb11267bf468081fdc159aa5ba0598b8597e23505ea337e6a17b6298a627bd2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289030, "uuid": "d4ac62b6-f1d7-4ac1-9605-1e1458284a1c", "comment": "Malware payload (IcedID)", "value": "3d5317a9080bac8ef7c2b78c5675da6edd86eb46", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289030, "uuid": "bf9fcd7c-d700-4323-8f45-81adb689847f", "comment": "Malware payload (IcedID)", "value": "b921bddead648904713083379c20950d9cd24821df236df1012dc75b2af4f32d6c9faaa33285a4f41f31ffb9f2bf849d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289030, "uuid": "6d5c55c3-bcab-41d4-8bd4-b158b18d03fd", "value": "AE838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289030, "uuid": "2867b29a-5db6-48ce-9397-e88b331b860d", "value": "1536:IB240XZfcaaxf+EQliU2hawWDCAIoo8+BNvMhfvq+:+2d1cBWEQXMWD9o8+nEhHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289030, "uuid": "1d2b188e-999d-42ad-9ea5-2320e9e644a9", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289030, "uuid": "1f5bc485-b25c-469d-80d6-9bceb74793f9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289030, "uuid": "20d94748-2dda-4ea6-a752-97e1ad425204", "value": "2832.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53abcff8-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292376, "uuid": "18c18695-c6c2-4285-b159-7ce13f6ba4fa", "comment": "Malware payload (IcedID)", "value": "4ed32197f60d92756960d6cd41691da4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292376, "uuid": "42c19893-a5d3-4155-93af-5cf9d41ac4fb", "comment": "Malware payload (IcedID)", "value": "2cd4743c99125b7053b0a22d27bcab959d6bc28f44e7ce6f63932b10545c421f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292376, "uuid": "cafbdfdf-9404-45d6-9ab1-a39b9b8137c4", "comment": "Malware payload (IcedID)", "value": "37d534b3c721aca189221ab392492ac8aaf4a1a5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292376, "uuid": "82d437f7-91eb-465b-b715-a2dc6037653f", "comment": "Malware payload (IcedID)", "value": "a24d86614319507825ed9b7d3af4cf8989f90ea7a964fddda591bd55f5c85ddc4bfe6265bed16c3f027767a36ff42b68", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292376, "uuid": "c9dc9067-b623-4130-ac4d-0c939b6d13a7", "value": "C0838CCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292376, "uuid": "84e398be-c9da-40e4-a9a3-c7e0101ed721", "value": "1536:IB240XZfcaaxf+EQliU2hawlCAIoo8+BNvMhfvka:+2d1cBWEQXMl9o8+nEhHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292376, "uuid": "7eab5282-0728-4871-97f6-754ba3f317a9", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292376, "uuid": "6f2cc8a6-112e-4c39-bd3e-887d31d38ee5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292376, "uuid": "63b3b5b7-a81c-4d37-a413-6a6e2d26dc83", "value": "1978.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a5c584-9295-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617245675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617245675, "uuid": "eab87822-52b3-4c74-b099-57a7e3381457", "comment": "Malware payload (Dridex)", "value": "b77052d4aebec43da8841bb44ef4984f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617245675, "uuid": "04d1e9c3-c645-4cb3-8cb0-687a9c8b8b7c", "comment": "Malware payload (Dridex)", "value": "2d1fb7cd01c42b3f7b27dc06009a6ceec1d3db773d9ce646accecd2d16a25fb9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617245675, "uuid": "1ae90643-c887-4dda-9817-d6a1b3dd5033", "comment": "Malware payload (Dridex)", "value": "0fc1b1fa40c752dfe6ec08e5bae4333d48cce07b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617245675, "uuid": "84f7ae76-ace2-4780-b223-c2d19cd89fa8", "comment": "Malware payload (Dridex)", "value": "1d9a31f0e183621ccdfeaab63e9b5545d4c9911dcadf12c79159052469b05d449ff50f2ed10918e31822948e76d92c58", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617245675, "uuid": "4c97b10e-5781-40ac-a4d0-65c0d217a84f", "value": "4814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617245675, "uuid": "d8fecb70-352f-403e-910f-93ff97a5416b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617245675, "uuid": "d4ff4ca3-8437-4a07-ba4f-c0011739d427", "value": "3072:Mopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:TpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617245675, "uuid": "711a1d2a-7ee3-4af2-bf9f-cff12a011e53", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617245675, "uuid": "ecd57955-d04c-452d-8ebe-99be6a232c17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617245675, "uuid": "1a7d08dc-4f10-4d02-b601-b2c454539dbf", "value": "2d1fb7cd01c42b3f7b27dc06009a6ceec1d3db773d9ce646accecd2d16a25fb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011d777e-9306-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293956, "uuid": "c4ed7ee9-f903-4d50-b57a-d17f3dce3c26", "comment": "Malware payload (IcedID)", "value": "974074c49f6aedb3bcc89ee2a31fff04", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293956, "uuid": "8b0abd5b-4468-4dd3-9ebe-1cb15c1545ba", "comment": "Malware payload (IcedID)", "value": "2d21f4c14abf3124b106cffd7bf0ffac65c88fd50e6b798620413cd8ec3aaf45", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293956, "uuid": "fcd86519-29e5-44f3-939e-0a12025c4eb0", "comment": "Malware payload (IcedID)", "value": "7627e1f99ad3f928efc8fed8726d2028bb60f233", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293956, "uuid": "596d111d-1d20-4393-a409-cdb69060a92c", "comment": "Malware payload (IcedID)", "value": "3c75f930b215ba402bdf3f7be3dfad2ac7f5c5039b4f463925871f36eae851a2be839d82cbecd1d0a7e17d7578dd56d9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293956, "uuid": "7dc8fc50-968c-420e-b113-ddd8afef254b", "value": "15838CCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EA62E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293956, "uuid": "d40d8c16-9676-4894-884b-e66100b1858c", "value": "1536:IB240XZfcaaxf+EQliU2hawyCAIoo8+BNvMhfv0n:+2d1cBWEQXMy9o8+nEhHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293956, "uuid": "b0d83a6c-ee79-4e29-8468-702cfe52341d", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293956, "uuid": "0436008f-6f1f-42c7-b6ae-903c4d2fe2f7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293956, "uuid": "06c6239a-ff25-479c-881a-2cdf39a9caf8", "value": "807.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ac99f5-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274740, "uuid": "d7062852-c0af-40aa-acf6-01042ac6bb42", "comment": "Malware payload (IcedID)", "value": "fb1b3a249be48a8ad9738fe6fd2177a6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274740, "uuid": "5538c59e-39a4-4afe-8bf8-03e1cbda122c", "comment": "Malware payload (IcedID)", "value": "2d3dbdb3e0b3c3621740479cb51175be2357176786b3cab8ae7f707492c55a9a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274740, "uuid": "2d3f4b58-6319-4706-a779-e21deecb025e", "comment": "Malware payload (IcedID)", "value": "c8750cae07df97076cda6b0461e740acc4c5bc43", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274740, "uuid": "af192326-1b3a-4261-bc0f-b301ae1c8b2c", "comment": "Malware payload (IcedID)", "value": "b75df355011c4a3001fa6114c59eb0eb6f8229ffaaf934eb8b944e1ade70baadb76153de3d0acdc5e81870cb6da7a9b5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274740, "uuid": "acc0f254-127e-4319-9a83-d0693d27d55d", "value": "88044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274740, "uuid": "5b74528f-8130-4436-9385-bf8ef9865676", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274740, "uuid": "e23d904b-f08f-452f-8eee-ca3a5dd3c0a9", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274740, "uuid": "5b58a7a7-b76a-4931-83bd-a2c5ff738518", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274740, "uuid": "df161b64-a8fb-46b8-a57f-7e5d736e5341", "value": "document-1092077414.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8ad30b-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275047, "uuid": "5b7cc4b0-38f8-4124-be14-7fed10c00189", "comment": "Malware payload (IcedID)", "value": "f30760dfe348d88da0cb618a07752bf3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275047, "uuid": "23a1058a-6d40-4031-ab45-1d3fd0c3e737", "comment": "Malware payload (IcedID)", "value": "2d3fa3168c3c74d393ecacbb3295a9b0eb7f83aaeb540846ed4118f1703a4a80", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275047, "uuid": "1c5ec51b-d38f-468b-a36b-449cb775f9ee", "comment": "Malware payload (IcedID)", "value": "7be06f88ebf38045436bdd91ec8e46f113d69ebc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275047, "uuid": "afc8931a-14dc-45fd-9022-eaaf271391f0", "comment": "Malware payload (IcedID)", "value": "4eba0de92b79bc05b1893f9b8960b4eeab907361329e08b8406790c84c7bf66acc6526080f7f1f1e77fb1de854ca1bc4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275047, "uuid": "865540ab-7d1d-491a-aa6c-3c1141a4c22b", "value": "9C044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275047, "uuid": "d72f19ee-0d77-4822-a5f5-2c9b5cb6ec4f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275047, "uuid": "a1f36cba-a5e1-4182-a24a-c5f7feb278ab", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275047, "uuid": "349715f0-12ab-40f1-a460-ee6c5c5ccd44", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275047, "uuid": "c5a0f078-f6fd-42b9-9c65-3a5ecd8edab8", "value": "document-796279569.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e21280-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274769, "uuid": "c130f59b-c6a6-4b46-bc7a-fb8d04ca1557", "comment": "Malware payload (IcedID)", "value": "7f2350a92ef07dc37caff514441403dc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274769, "uuid": "3f611d42-bc5e-491b-8392-e02e6f47a6ed", "comment": "Malware payload (IcedID)", "value": "2d5d7160411c9eccc2db182350861384dc15a41c22986cf79708c8990ba8d335", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274769, "uuid": "10a6cffb-40ba-4e57-8943-6bcddeef7a5b", "comment": "Malware payload (IcedID)", "value": "2a3596cbb4c94f8595f82f4db5e6d3d256eade7a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274769, "uuid": "e1cf53bc-6f30-4910-b238-7a546d752810", "comment": "Malware payload (IcedID)", "value": "3b1d138129f1b51e981ead2999c164f018e5a4204fc21e18046d3631310fe5f591412a193be13d27e9286543803ab90a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274769, "uuid": "c56dea8c-4d5a-4873-9b64-4272c8da42d8", "value": "3C044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274769, "uuid": "8b7a06d2-65bb-4ab7-b798-84b6a79da333", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274769, "uuid": "5589caaa-b26f-4b91-b175-7463e4cdb1e2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274769, "uuid": "38fa37dc-4d42-49d5-867b-8731bc041f96", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274769, "uuid": "d7479e87-6c8b-4826-8a48-5cf2d9bf8c2f", "value": "document-285217174.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c483479b-92f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286553, "uuid": "93402eca-3147-4017-87f8-50a75dac0161", "comment": "Malware payload (IcedID)", "value": "d36505244e45feb2b236ddfd4fffb5a8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286553, "uuid": "546fc6ec-9141-4bd7-8851-66e582f9341e", "comment": "Malware payload (IcedID)", "value": "2d839fb10fe76b589f5a5d4e7664c8a6b19640c8bf7322a39d70166507f26bbe", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286553, "uuid": "4106a84b-cf32-427c-8e05-ce1584b767be", "comment": "Malware payload (IcedID)", "value": "d0ea84366119eb3b7509ba74b9c82550124f600d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286553, "uuid": "931a63e0-a047-4f14-91d8-c75dc783699d", "comment": "Malware payload (IcedID)", "value": "9ddf9be311aec46bb7975a5a808299b3387f7aff5e4c8c0a74b05a007d63028e4af79563c0688db8769d9d2312901500", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286553, "uuid": "1d0b05a2-ee29-42a1-975e-617d1c89b93e", "value": "72838CCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EAA2E0D42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286553, "uuid": "230bb55d-f99a-462a-9a74-5d5705fbb18b", "value": "1536:IB240XZfcaaxf+EQliU2hawg/CAIoo8+BNvMhfvR4:+2d1cBWEQXMg/9o8+nEhHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286553, "uuid": "8407665f-3ff4-4663-b4b3-38abf4a8631a", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286553, "uuid": "3284e898-7230-4bbc-94da-ad914d35add1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286553, "uuid": "3c016427-3195-4dc0-8599-e9bc8db5e18a", "value": "1965.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157bd215-9316-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617300862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300862, "uuid": "e56dd4b8-94e4-46f7-9063-294270e66611", "comment": "Malware payload (IcedID)", "value": "f335c657ef53e72a916517a750f000f4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300862, "uuid": "b0ae1470-0b6a-4abd-8e7f-164853f43643", "comment": "Malware payload (IcedID)", "value": "2e58fa4fdf874d951a7b37acc46bb1274585d9eeb2fb23ee67187ca867e0136f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300862, "uuid": "39ac2dd1-aff6-48f8-bf5a-db639f7ac34a", "comment": "Malware payload (IcedID)", "value": "c2e1693e5e7f441cd3bfedff46d59dad7376aba3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300862, "uuid": "2abcbf96-f321-4f3c-8800-8832d650e543", "comment": "Malware payload (IcedID)", "value": "08aba6ce01f0f8fddbf2d3c4e388b143506d227c29f87a1e4f76eab94b963c4fe807b381492f732570882abba9a16509", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300862, "uuid": "fb5a9ad3-3005-4b67-b9c7-f407b8e81aed", "value": "4104123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300862, "uuid": "78fc669c-e4a5-469e-b591-e436a8c666e4", "value": "3072:rXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:DE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300862, "uuid": "f8736510-c1a1-4351-9b0b-bf8966a94ef4", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300862, "uuid": "1467fa6c-4102-4df4-8f96-b5b7980ad150", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300862, "uuid": "81f2dbd6-55ad-46e0-8307-dafcf94158e7", "value": "7225471124-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f80fac5-92b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617257097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257097, "uuid": "017e5835-7a26-414f-90cc-80bb077c163e", "comment": "Malware payload (AgentTesla)", "value": "c1bf1f875ad31bb201741910c5290f2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257097, "uuid": "0454592a-e3e0-4969-985d-f5b81d567cbd", "comment": "Malware payload (AgentTesla)", "value": "2e88733c114af02daffe68405d5d8c5710b81c56587dffe940466bab06b2ed90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257097, "uuid": "dc6610d8-0eb6-4f23-ba3e-2edc70628373", "comment": "Malware payload (AgentTesla)", "value": "aed1d270404737b8fbb75cc4ee894297df65b9e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257097, "uuid": "4ceaf011-313b-4a31-bc40-308c2fdc21c5", "comment": "Malware payload (AgentTesla)", "value": "4cca1e63e95020463e0c738f1984dc7f9bb435c4212d793415ce78df26ebb9eb0b6c1087f2b5d59a9fb52a1109ffbf34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257097, "uuid": "6d21fdc7-c7d3-4024-b4f0-263af2201b68", "value": "7FF4BFE812646592C3329E925B01B485B7ABF1753BED4830F1CFD379337B65AEE1A410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257097, "uuid": "b34ca9e4-040f-468b-97e7-cbffc15e0a45", "value": "12288:w555555555555555555555555R18EsJVh:w555555555555555555555555T8TJVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617257097, "uuid": "d1597823-c1d6-4cb2-8305-8c226bbac3ba", "value": 732040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617257097, "uuid": "963a0587-2683-40f8-af7f-bd5efba2e99c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257097, "uuid": "8c3f3e3e-6396-4094-8c27-643d36070f65", "value": "061-20-SEP-L.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67181ada-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275659, "uuid": "582452e0-b364-49f8-bedf-d6f812070b8f", "comment": "Malware payload (IcedID)", "value": "8b4c1ded9f196e0e7175ca1be5210aed", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275659, "uuid": "abc48151-86a7-48c7-bbdc-b299874705f3", "comment": "Malware payload (IcedID)", "value": "2ecb4c4cac20c6a4cf4772f7df60df29d24e7a9382369d6381b4993d16a12b4c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275659, "uuid": "623c6ce1-e198-450c-9bbc-79a7b18dd645", "comment": "Malware payload (IcedID)", "value": "386cd716598ca165a4e27fe35836da39de260fb7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275659, "uuid": "3034e8ee-d221-4c3e-8d8f-949b6f7966d9", "comment": "Malware payload (IcedID)", "value": "9972a12e1df10a0d5390c8681cb9f8520952e1ef40716058541e410a5b1bfb5d2052844a377401333976d46a142bc350", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275659, "uuid": "5e0ba4c4-1253-4fc7-b447-8c9999dff80b", "value": "0B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275659, "uuid": "7fb99a0b-7f2d-4660-977e-4457d76c9d20", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275659, "uuid": "4184ea95-358a-4f02-8f32-d378e0328027", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275659, "uuid": "282fbd8b-1bfb-4571-92a5-11c9d567f2b1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275659, "uuid": "ac1de9eb-a595-4df8-b090-30b228420d7d", "value": "document-528425440.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f14f7d-92b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617258764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258764, "uuid": "246ba63b-2071-4703-865f-0574ad9fe610", "comment": "Malware payload (RedLineStealer)", "value": "d30a9084c70e7158127d7689ad65fbfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258764, "uuid": "d03e833d-5030-42fe-aef0-40316c2f9839", "comment": "Malware payload (RedLineStealer)", "value": "2ef6afecb494476934f9883dc80c2e112d71ef9aea1d27f3ee268a946d57f0ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258764, "uuid": "5fda1777-1230-47e9-8c27-91a229dc7ead", "comment": "Malware payload (RedLineStealer)", "value": "7ea9d52b9808a907060d2b415843d28ce4edbaba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258764, "uuid": "2d7782ba-555d-4c9a-b0f6-38fd4fad2a66", "comment": "Malware payload (RedLineStealer)", "value": "4a501ac6522329be6294f7c2a9c26e0c19f88ae758fe4c7d296f3e5e2ad2de084fd6e8adfdc70917017ca9cc04b3c644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258764, "uuid": "a2070e8c-242e-4ef7-8668-df2e5099c7c7", "value": "DB64D001B6C1D033D5164975052AC2B6497EFCB16F34A2C77BD02FAAAE706E19B3A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258764, "uuid": "17a1926d-3563-45d3-9dcc-1c9180bf566b", "value": "d4140c6a2f14379bc2c9ea2aac7824cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258764, "uuid": "03d3b1c5-9a2f-442b-87bb-f3af800bf6f2", "value": "6144:ovQ5G8LFm1CzqG8D3nkGjpp6l5qBLW5ewNtWnlRu2:r5G85m1Cuvki6l5qJiew6nlRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258764, "uuid": "807236f4-8b54-4297-bdd7-0071d5dc4ddc", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258764, "uuid": "bf5405bd-b1be-41ed-aa89-c15a452ed87f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258764, "uuid": "ae09e334-3636-4ce3-af3c-0429c6341d39", "value": "d30a9084c70e7158127d7689ad65fbfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae20e9b-930d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297247, "uuid": "0f949469-7b2b-4025-bc58-43adec8a2dec", "comment": "Malware payload (IcedID)", "value": "dc221013d9f68f9641fc16cf70efed32", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297247, "uuid": "6ec03b95-612a-40cc-950b-b2cf77d0098b", "comment": "Malware payload (IcedID)", "value": "2f4f675900433f167fc04d0a2009195548db1f4aaa0a4d5b70443dcd341aeac0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297247, "uuid": "dec5958e-7830-4dbd-82d5-324581c94530", "comment": "Malware payload (IcedID)", "value": "4444a75c26d4563160c03939793746b1c8059e22", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297247, "uuid": "6a67bdb2-a747-44db-9ca1-7993fcf81165", "comment": "Malware payload (IcedID)", "value": "6cde3f70c54767b7a2df2d80bf4767ffc94460700ae05635f2d051e913b021ac25dfd9f72fd3e793b864c53d6f74737e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297247, "uuid": "5318fb34-c87c-428b-a07b-b79ec4067ae9", "value": "4504123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297247, "uuid": "19c7a990-07ed-4e7c-9f47-3a4131e6dc1e", "value": "3072:HXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:3E5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297247, "uuid": "04065dd3-6a79-4d77-b97b-6a1aee2ab6b2", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297247, "uuid": "d84b55c0-10a6-4f38-9a54-dba8361e91d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297247, "uuid": "a073146c-5042-47cd-a51a-fcef4dcf656e", "value": "71923841627-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca802fc-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287211, "uuid": "654dfa1e-b5b6-4492-bc85-945e10826dc7", "comment": "Malware payload (IcedID)", "value": "9dd15d97490eeece5264a03fa6d59f58", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287211, "uuid": "fea08429-7ce8-41cc-9011-be259e2829fc", "comment": "Malware payload (IcedID)", "value": "2f6a679be63fba5413f05f1b64e074fa2d482602c2dc5455f7941596f5bb46a4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287211, "uuid": "ceec4fee-956d-4734-ab98-e75ee575a0e1", "comment": "Malware payload (IcedID)", "value": "238b37bbf842080ebfb2ee57697474f47cfa0709", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287211, "uuid": "5a205c12-ffd8-41c6-9874-bd17b673bff9", "comment": "Malware payload (IcedID)", "value": "a97dcf8260eb90441c347d9c56f0a456d51602b0fe045cb7235683be18385be1ed2fe4f6ccc090e62318294e5e2eb6b8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287211, "uuid": "da66cdbd-0e3e-4bae-99ef-623bf0d24665", "value": "55044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287211, "uuid": "acbf9bb5-bb80-4c47-a871-1fff92481421", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287211, "uuid": "7fa85b84-8d43-48a5-bdbd-d7b1b2072930", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287211, "uuid": "8e281871-38d5-495d-82e4-f272f01e12ab", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287211, "uuid": "ca9fc990-2567-4004-b39e-ca157182759e", "value": "document-613582013.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0968a5b-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276265, "uuid": "19c1f7a3-92c4-4eb0-a1de-85c6ab5cb474", "comment": "Malware payload (IcedID)", "value": "9c29f9f9d694302f045f6a6eec68c281", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276265, "uuid": "b8ecf963-50b5-4dca-8f40-e191de9d73d2", "comment": "Malware payload (IcedID)", "value": "2f82f1f87aa3af48e4ddc629fe6197604793c9081daf3e70b440d22d8c07a0b5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276265, "uuid": "d4a33f0c-d0a5-4ee5-a8fa-69aa532d3c33", "comment": "Malware payload (IcedID)", "value": "e2e7b14a3a16c56cd37206c01169124abbfa3d64", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276265, "uuid": "070868e3-a406-45d2-bfcc-749d6b4aff26", "comment": "Malware payload (IcedID)", "value": "44b80586c1c90bcc8816f1a6d00878cadb77b4b62183665406d951c4e3a4b3903983a87df9d9759a3a519155c27f03ec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276265, "uuid": "068dd32d-5359-476e-a9a6-7f8a04985461", "value": "BB044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276265, "uuid": "42ade0f8-a0c1-486e-b543-a22a0fbccd15", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276265, "uuid": "9f4815e3-d357-4547-9949-9054c2075512", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276265, "uuid": "58c5dea2-5809-456c-871c-949b187bbdfb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276265, "uuid": "422d0bb0-a21c-4bca-a730-b57c60bf9bb0", "value": "document-275278405.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6f350a-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617261788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261788, "uuid": "5173b955-4185-4a7f-8dec-d70cb66faa68", "comment": "Malware payload (Dridex)", "value": "f7e867960b7eb14c5d95522dd6d3ebf0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261788, "uuid": "0ff6f3b2-9cd4-4172-8d65-c1751b71fb67", "comment": "Malware payload (Dridex)", "value": "2ff3ee7dfaa49851f868a5c8144e9f7a32a104db5ba88121107f197e0bb3541d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261788, "uuid": "b149f8e2-16ef-4ae9-bd21-c09c206b9665", "comment": "Malware payload (Dridex)", "value": "4335f7c9055679f96f7d90c71c3008d46ec33565", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261788, "uuid": "96cf88bd-bfce-48ac-9a1b-de6fad309447", "comment": "Malware payload (Dridex)", "value": "7849c293f2d8ee422835415f4fa1c1a611c60a433d6049727e81a25abc35ec3b1c63b0e7ba16a824657a1c81d3720ea5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261788, "uuid": "f6fff331-028c-4697-91be-8dc6cf6d99ac", "value": "A514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261788, "uuid": "ef0365f9-e012-45ed-818f-834c592a5414", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261788, "uuid": "927d5531-97c5-4570-a319-dd36e96fc246", "value": "3072:Zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:epjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261788, "uuid": "670481c2-0266-4618-a531-4ef76ace4cad", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261788, "uuid": "08dc8f38-dbdb-4aff-b053-d0eb43f66ad4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261788, "uuid": "928212fe-a9ef-4615-93c9-0968c89845a2", "value": "2ff3ee7dfaa49851f868a5c8144e9f7a32a104db5ba88121107f197e0bb3541d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab80c2b-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287771, "uuid": "a15bf93f-5b1d-4e81-b6c7-f11730cab733", "comment": "Malware payload (IcedID)", "value": "0af9b55dc06370b71dc676b6f74e878f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287771, "uuid": "6d212e35-256d-4226-932a-748f1387bb82", "comment": "Malware payload (IcedID)", "value": "30806cb1e3e916f0001a53ee4d374989855be9ea358c42c07ee14aa10d487d00", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287771, "uuid": "a32b6e05-199e-453e-8a8e-e1109ddfffb7", "comment": "Malware payload (IcedID)", "value": "7ed33f091a6f26bc2e0525287d612aa0049ab96c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287771, "uuid": "06e088e0-6d7c-41c7-9c01-1d5fda1b1359", "comment": "Malware payload (IcedID)", "value": "40dd0fd8f3adf06c4a6303bb5f222f666abcb2fdf16ed25b3f7a540f17fae419a434a32f99c8b8d2c3fda96e20fbe7a9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287771, "uuid": "f351fa03-7c5b-4977-abf9-21d00d3d7629", "value": "B8838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287771, "uuid": "774854e2-a896-4ff6-844e-b1264340d2d4", "value": "1536:IB240XZfcaaxf+EQliU2hawXCAIoo8+BNvMhfvOZ:+2d1cBWEQXMX9o8+nEhHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287771, "uuid": "eae314ff-ae96-4b23-b0d0-80136fd46ab3", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287771, "uuid": "94b2ddb9-d4e9-46f7-8e32-d713ef583614", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287771, "uuid": "4431061f-62f6-437e-9fe7-acce4ff9a116", "value": "951.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d437f5-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291439, "uuid": "143c5e83-f364-480b-b4dc-d1ea031a1d72", "comment": "Malware payload (IcedID)", "value": "6c960c3978f72ee224b936994bc3f7fc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291439, "uuid": "3859b2cc-2cb0-4b33-9a6d-509289f9b615", "comment": "Malware payload (IcedID)", "value": "30c48d289ddc2e315b312169827920aaa7448c58f49a3f67e5e504281dad3ecf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291439, "uuid": "2d4bfad3-81a9-4690-9eb8-6c0f53a9ce72", "comment": "Malware payload (IcedID)", "value": "d1505113a5bd7599b9e49d68d7cd48e5e8cf77d5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291439, "uuid": "b20b7d1a-19d0-45cd-a97e-1617636d9489", "comment": "Malware payload (IcedID)", "value": "a64a995fb53e32c2d69cda45eecbe2d63402017a54d0fdb709d0c5938820548b958a6020d877a665e4d703bc80a8ffbc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291439, "uuid": "64ccce2c-4ab7-4c91-9f1d-915f650a8f3d", "value": "9B838DCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B108EAA2E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291439, "uuid": "09ea260c-f537-4bb0-a2dc-9f18f30d8f91", "value": "1536:IB240XZfcaaxf+EQliU2hawz6ICAIoo8+BNvMhfvpl:+2d1cBWEQXMOI9o8+nEhHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291439, "uuid": "8dd50939-efa5-4ee1-871e-964a47b98cef", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291439, "uuid": "5cbeb56c-5088-4140-98f5-a1be81fa3a97", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291439, "uuid": "99779722-2902-4fb4-8a6e-ae2b69a5a317", "value": "1363.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae182f8f-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274060, "uuid": "73c68436-7737-4f1f-806c-2ff0c866bc0a", "comment": "Malware payload (IcedID)", "value": "361d8dd446d7dc4c5188006a446bdae5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274060, "uuid": "1504b993-2ded-485a-b399-03e948ec6970", "comment": "Malware payload (IcedID)", "value": "30f0592d96a6abfa23390ddf59879c2adc759bdd80f2dd03429523d8101bfe2b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274060, "uuid": "682a28ab-99db-495f-8298-14aba35d9445", "comment": "Malware payload (IcedID)", "value": "009bb34aeb5292027d6bac2125a6d258fc61adcd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274060, "uuid": "954f24ab-c460-4f19-a3b5-95c8ac897325", "comment": "Malware payload (IcedID)", "value": "55c957a90dc5e96f6770fc279ebe4378e7f663072987261f81efa69a157da1d2f137ac4c0bf740ba62f877f7c5a0ee9e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274060, "uuid": "4e42d6a9-4717-44bd-8be5-7fa978d53eb5", "value": "EE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274060, "uuid": "7557c79a-5f2f-4af4-9791-7d5106fb73bc", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274060, "uuid": "e8f14623-87ae-43ee-a52d-342981fb59d0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274060, "uuid": "231c8361-0658-4012-9568-f49e842ebe29", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274060, "uuid": "ab752be9-6653-4cc3-a70f-c9228f5245ea", "value": "document-996329226.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734f6cb9-92c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617267519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267519, "uuid": "61c7e312-e55e-45f5-b1eb-227da9c1ea87", "comment": "Malware payload (AgentTesla)", "value": "f52f19bbdde99fb8b2bed35aafb4501c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267519, "uuid": "1bd8672b-c5d8-4d7d-a4af-a0ed695b0134", "comment": "Malware payload (AgentTesla)", "value": "3108d4829b2a4cab133c97c16b872743910ee1ae8588e3c989a9ebf12a22f5ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267519, "uuid": "c11166a4-7745-4a28-9c28-a0a57b937c9a", "comment": "Malware payload (AgentTesla)", "value": "f00ee537774c0db52b790117580468120c6d9ef8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267519, "uuid": "9941d7cb-f861-4d2d-915c-cb2e618ead37", "comment": "Malware payload (AgentTesla)", "value": "5e584a0c58713fce3f686aa9c694a38af2dd346b0bf4d3563fe4f517d333fc08c84ca265f417539741c81e166d925f44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267519, "uuid": "10fa6aac-06a3-46c2-a2cf-ff2b5e40a6ab", "value": "90446BE428143CF7FCCEF63645587A0926A95BB33802640B8BC710E79D71B571CA99AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267519, "uuid": "1cd22c03-ab41-4656-bb7d-eebc0095ca69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267519, "uuid": "2916eaa0-838e-4d9b-89f6-e2cb7e17ea1e", "value": "6144:ooMbMuB7XhSra6m+u0L0kPjm95YBwHElqEr1wB:ooMbMcIUWm95YB7lqEGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617267519, "uuid": "f37d25c4-e6ba-4a1f-a747-102c267391eb", "value": 255992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617267519, "uuid": "9952c0ac-2ded-4861-811e-032f5beed0b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267519, "uuid": "9dcea3e2-c008-45ac-8df0-112bfdb68d61", "value": "R ALHTQ19-TYPBLDGP0401-940 GR2P5 -NASE FERDAN Q0539 NE-Q22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fa76d0-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617273992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273992, "uuid": "fce00c89-7060-45e6-b7d1-905d5f97c8c1", "comment": "Malware payload (Dridex)", "value": "8bd91bb061e41756db84550bc66d1f23", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273992, "uuid": "1deed3b3-75b4-4191-b0d7-bcdf22bfc1f3", "comment": "Malware payload (Dridex)", "value": "31246c09c99810cbc63449c5e1dc9830df805ff085b935aa18acc07d0db97ce9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273992, "uuid": "e699ced9-cec1-48a0-972f-885c5cdaf9be", "comment": "Malware payload (Dridex)", "value": "62c06014336421b444e1fe9ae811d8516d0941ec", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273992, "uuid": "aecb4838-de49-41d4-bd88-754ade57c264", "comment": "Malware payload (Dridex)", "value": "b0e77100a11256c80900cbea0c460c4bc0fc6f84c27a43bec6e3dccd93a3e13d6f4596cbc4b43ea8767c0781bf3de14f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273992, "uuid": "a86c554c-1507-46c9-a3cd-8243023f85c0", "value": "EE14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273992, "uuid": "495e3bdd-36ea-4e26-b44c-010a9d65d265", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273992, "uuid": "3a9a1c38-03d8-498f-90d8-80d9dbb81caa", "value": "3072:Copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:VpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617273992, "uuid": "eac219a9-5064-4511-b5d2-1ff725b24c8c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617273992, "uuid": "62bed205-b2f2-4c9a-9224-beec57344c95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273992, "uuid": "a38ed9c8-efe7-4534-aec6-2a6eafe45756", "value": "31246c09c99810cbc63449c5e1dc9830df805ff085b935aa18acc07d0db97ce9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15abf86d-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291413, "uuid": "91542ba2-d34d-4237-8508-84305f740dda", "comment": "Malware payload (IcedID)", "value": "7beaabd9c2d997637f679ad42855ffca", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291413, "uuid": "2a739bad-ccc1-4801-8645-373c71b44329", "comment": "Malware payload (IcedID)", "value": "3154433c392477fec68a83e713434a7a3eed88e6892a7f44315a928e1113e6fb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291413, "uuid": "17291494-f1a6-4153-b91e-e6da8e4178c2", "comment": "Malware payload (IcedID)", "value": "141fdb0491ee22ff3c952221705a973d642b9bb7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291413, "uuid": "b1b18385-210c-48f6-9777-ed532c01106d", "comment": "Malware payload (IcedID)", "value": "41062e707f561ca39fd6b938c61d08f3a58c9cb2aac9c4cba350cb8209282b887e0eb4f58303b940b16d71b4b9675129", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291413, "uuid": "ee999357-efbc-4cea-a6eb-dd41b715ae19", "value": "8C838CCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291413, "uuid": "9a049ddd-9acf-4c8d-9d11-fcf999fa6603", "value": "1536:IB240XZfcaaxf+EQliU2hawoCAIoo8+BNvMhfv6z:+2d1cBWEQXMo9o8+nEhHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291413, "uuid": "bc3ecc45-28a1-4f17-b56f-e13a72e274e2", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291413, "uuid": "44f3b888-9cc1-461e-b9f3-01270ecbe5df", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291413, "uuid": "7adc724d-2178-4764-a37f-952b586e5171", "value": "1444.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5e5163-9289-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617240667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240667, "uuid": "e00ee04d-2d6e-4133-9bf3-284363a590e2", "comment": "Malware payload (Dridex)", "value": "345a1d0e16f2386468f995b0d552a271", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240667, "uuid": "149cc8a3-be1b-41ae-a981-10d8e84d781c", "comment": "Malware payload (Dridex)", "value": "318f363e55aef70b2c07cf8ba3e2948a7c8a9498e4c3aa6f5f3627fc9a68adc4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240667, "uuid": "688c1c94-ea42-4dac-9e31-e371ab0be102", "comment": "Malware payload (Dridex)", "value": "1f1d5c83da8422439231bbaafdc8851b24fd0f8b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240667, "uuid": "63a21276-85f1-4b0e-983c-cc20b39d48b8", "comment": "Malware payload (Dridex)", "value": "0c39194ac03efeb664fb6eefffbb6be3ce8f86824a106e7ddecf6373ab775a7f51d3ba70afb705b59d6b73802abe0800", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240667, "uuid": "52fb3253-ed23-4691-8647-50b919d2d1fd", "value": "A114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240667, "uuid": "1eb07814-573c-46b4-b8f3-75b17d63ce22", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240667, "uuid": "438ebfd1-9676-4bd0-a8b5-f9108a7849ca", "value": "3072:K1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617240667, "uuid": "f4f0a03f-061d-4fc6-ac9c-3a46af5d26fd", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617240667, "uuid": "a82d05c7-8ee8-4845-bd65-c9ed7722e51b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240667, "uuid": "0c719efc-0da9-447e-b099-55156a1f08b8", "value": "318f363e55aef70b2c07cf8ba3e2948a7c8a9498e4c3aa6f5f3627fc9a68adc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165f2a57-92ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617255766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255766, "uuid": "055b227f-73d3-49f1-b8bb-7def17faedd6", "comment": "Malware payload (AgentTesla)", "value": "d6cb2e24dc0988009e7e82d73892c491", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255766, "uuid": "9021ab68-1fc4-4684-a718-7a1292b9251c", "comment": "Malware payload (AgentTesla)", "value": "31b23e9d6e1a2a7f26993c5380efca86e3bfc5c8beb767dc4a22e34ac63884d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255766, "uuid": "6d7b9a31-2fba-45cd-8dc9-387f6823cf9a", "comment": "Malware payload (AgentTesla)", "value": "b0319e92ce3486012ae409cb17207ecfd2813018", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255766, "uuid": "a98cdef9-2481-4d85-baa6-6e0b15413191", "comment": "Malware payload (AgentTesla)", "value": "89f498ff9f122246f37291898160b6204a8995a348d028ec2d50588010b733da8f36fefe0fe29a6a2052a894ae02a984", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255766, "uuid": "598aa45f-d359-4a1c-b544-6c705a7b9793", "value": "A7A423F3279EC6224FF8873141D1B7A7198BDEF05E83D18B64189E8259749F1C1AE8C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255766, "uuid": "c76a7290-1235-4ec8-80fc-442239062808", "value": "12288:ZfCP6v+4FkXT7DbB6Q+ENbmw6vWNKngHh:Zf2KKT7AQBV6vFkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617255766, "uuid": "f32aa898-d1b8-4f1f-bf08-f6ef65ba206c", "value": 466723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617255766, "uuid": "4fb99e71-4af0-480b-8428-9cf942714aaa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255766, "uuid": "afaca115-a455-4670-a87f-11f66319e287", "value": "SWIFT COPY.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc6b615-9299-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1617247294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617247294, "uuid": "d375948d-0e7a-44e0-8bad-0487025ff0f3", "comment": "Malware payload (BazaLoader)", "value": "71360b2696150d61ce8dce291dd46da8", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617247294, "uuid": "1dc6a5ce-e1f1-4d9e-9e48-7560d53fd67c", "comment": "Malware payload (BazaLoader)", "value": "320ccfb19d2ef45408729a909fc2cec3d10d2c7683d2c58d24ba464258dda995", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617247294, "uuid": "e4e8170f-3692-4853-90bc-0ca0f4aaf479", "comment": "Malware payload (BazaLoader)", "value": "8b54d7800f3a4802aa9c01787255cbdb3feacbcf", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617247294, "uuid": "28185c26-37f4-471d-b108-7a6ea61eeb73", "comment": "Malware payload (BazaLoader)", "value": "d8acd4619334b9722970bcad7ce212bca6a485576c2b14d40c66ed02108f099824cc6367ee3c3f0f4a31d1a93a044582", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617247294, "uuid": "2774bd3a-10b4-49ef-8946-f3f7030fef83", "value": "BA9312D23C844AA4F89A473C0B412E1570A16EE255B6E091BF04FE5363BEAD57F7A3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617247294, "uuid": "66122ad4-bea3-4be8-8e1c-d63fddb2c8f7", "value": "5049cbdd72d7b0748fd5f8aeeef34495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617247294, "uuid": "f6afcc75-aaaf-4e08-ba9a-b14d4c64aab8", "value": "1536:P1zTa+HoVvU5sLxyFDktBczQrQqyFwdKvbl3PNf2Inku9dJXCHdeaj:N3a+H92QJYI5q8DdPNuIkyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617247294, "uuid": "0b523104-da78-4803-8288-700d2f3a63e5", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617247294, "uuid": "583ed727-087a-43ca-bf26-bc66186826c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617247294, "uuid": "a217c41f-d16d-40f8-b727-2328ced88988", "value": "71360b2696150d61ce8dce291dd46da8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899a534a-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281729, "uuid": "ef0a79ad-adb9-4ca2-97f9-89aad9105241", "comment": "Malware payload (IcedID)", "value": "9df390d09d8f9a497a22512f9ee2e25d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281729, "uuid": "c11c6bcf-ad23-47bd-880c-4a624b0c8a29", "comment": "Malware payload (IcedID)", "value": "320db98adef535cee32c927cac0ea6852e56300d0e7e10b9b3e3a4f54e955988", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281729, "uuid": "8fd09ef9-44ae-4850-960e-f25a5cc14d7d", "comment": "Malware payload (IcedID)", "value": "cddb78a10b02db187feff063ddf5e2a0b5089cd3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281729, "uuid": "00882c0e-faab-4407-b77c-572d2e520eb2", "comment": "Malware payload (IcedID)", "value": "65d65de965a16e9d58f9f198ba32f8331c4b56a5a0577627e2766a2b3b41014a043133b8f3cc07ffa47a39fd3d76d2e4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281729, "uuid": "961dcc20-0d3c-46c0-b366-71e2e52fb861", "value": "30044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281729, "uuid": "9ad3aa40-e4e2-4035-af9a-d891f50c0f81", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281729, "uuid": "cd936dd8-7e57-438a-a2be-fc7ec30e63fa", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281729, "uuid": "a91567dd-8dbd-4e75-a97e-4ea9dbef3015", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281729, "uuid": "820bfc38-0dd2-4a41-b3fd-5837e622288e", "value": "document-921217151.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058b9fe2-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617261751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261751, "uuid": "51464fc2-2dcf-4147-abd5-c3221497a823", "comment": "Malware payload (AgentTesla)", "value": "c26d250f012cc8796efea3a41ea5c95b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261751, "uuid": "28ac12d1-2969-49d4-8f35-5bf4aad21d51", "comment": "Malware payload (AgentTesla)", "value": "32799018b06d3b2014415b6a1f7d30527b21b4d3493e1392ceb772b574db8b79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261751, "uuid": "c4436eda-d5c6-40fc-83aa-690f4b16606c", "comment": "Malware payload (AgentTesla)", "value": "dff04d0e59c2e26ccf5725b75444b74e748d17be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261751, "uuid": "42218f0b-bb39-4699-8bcb-4e85b22303aa", "comment": "Malware payload (AgentTesla)", "value": "4c9c52397d84b84992841a3ece0f9e2592e4a22403d0d09847e2c9f1ea38ffad30e1ebd6ff018cb629f37218801c2ce0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261751, "uuid": "b8688ea5-60a5-4b17-907b-89bd7702a675", "value": "4FD47C7421E047C0ECEA96B4A6F0432053E66E28C9D1E586FF9D30BD3765BBC56D2923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261751, "uuid": "c3f3d1c4-3830-4336-8484-5682733f5f1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261751, "uuid": "304f0a4f-743e-409d-9125-f548eb176c5c", "value": "12288:rmkp3UIjE3XuuT5j5rHtnMwp9caeMjEhf4/xU7Of:Np3TjSN/LSu9kO/xU7Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261751, "uuid": "b0fc3db8-b567-4d2d-a1d8-03bf63bee588", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261751, "uuid": "68c60a81-c684-4792-ba32-592c22d0538d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261751, "uuid": "2f666eec-da8c-4bba-903c-b128202a5a0f", "value": "RFQ#ZAEL67012_doc.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f921ee2a-9305-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293942, "uuid": "a90d1eb4-30ba-4fe9-b31c-2df204abf368", "comment": "Malware payload (IcedID)", "value": "2c689ac930276be2b877c4693bdc4b0a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293942, "uuid": "2acfeec5-5591-4c17-a851-27d6c2b9135c", "comment": "Malware payload (IcedID)", "value": "32a893cf4c35f09fb12f8aff804cc3f69110702e0b1e68f4f68cec96d6bfa62e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293942, "uuid": "8f7dbf13-2e13-49df-912a-7b7f5ae20796", "comment": "Malware payload (IcedID)", "value": "fde14af6b5804561bdb2ec8fc8e78549bb834055", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293942, "uuid": "f5fe25e2-8c8e-43d9-8a77-4d845c60421a", "comment": "Malware payload (IcedID)", "value": "6f9177936f9fe9e18220ddec8fbc41d6d7465d2a613002bcac96e70ced499a69b15a4cd314a349a598ddb152ecc374b2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293942, "uuid": "796a49a8-a992-476e-a86b-a3015dc14c78", "value": "97838CCDC917E1D9C2559FBD5A0A308112F4E0B7276FF11B108EAA2E4D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293942, "uuid": "362069fa-207a-45c5-b737-0e42057819fb", "value": "1536:IB240XZfcaaxf+EQliU2hawbCAIoo8+BNvMhfvKF:+2d1cBWEQXMb9o8+nEhH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293942, "uuid": "602c353b-660a-4003-943a-60ca32dd4896", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293942, "uuid": "be468f6d-8c5a-4581-b4bb-a5f85bc382a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293942, "uuid": "59234b9d-8040-4ff8-ac77-95ae96c0aa77", "value": "3276.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c83ef9-9344-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617320918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320918, "uuid": "62a9d9da-3886-40da-a020-76a89241ebfd", "comment": "Malware payload", "value": "3df18ecd55f8e267be39f6f757bcd5f0", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320918, "uuid": "19a1460b-6189-495c-a6e9-57e65fa8be4f", "comment": "Malware payload", "value": "32da33d03270d3e434898d06ce4eb21dfd78a8fda4eae22c55c7a31cdf85ce68", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320918, "uuid": "1535f5aa-c720-4243-905d-d8eba8603171", "comment": "Malware payload", "value": "d8fb3dcce1acd9d5c0bd69c40720d64b7f877ec1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320918, "uuid": "770804e2-cd1e-45bf-bb29-e0d5801fde11", "comment": "Malware payload", "value": "6497d42d0ae7305824f727dd0eb45d1f21c1a8056f43deb3494d8b12debdc334dca160bb3198a78ab07f74af79ffd436", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320918, "uuid": "f47e669e-7853-4e0c-8f08-e9b8ed8fca02", "value": "CD629D6EED42B524C56545BE18096BF0F74DA1CB9219B60F3402B3AC4F409CB5FEADCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320918, "uuid": "b77b249c-179c-4509-9bc5-d8c7cac379de", "value": "384:VbZfdkBK4SXRiinp4KaG67aivotlTWF06:ffdkBK4Sh7n6yyIC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617320918, "uuid": "4686a675-9a96-44f3-9a86-0c66c06ded3f", "value": 15880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617320918, "uuid": "c026ddec-7896-4e62-aadc-f2fbeb0366bd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320918, "uuid": "8561903d-3772-4142-9430-c8961c2444f7", "value": "32da33d03270d3e434898d06ce4eb21dfd78a8fda4eae22c55c7a31cdf85ce68.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676a5fff-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274371, "uuid": "6ed5d4cb-b491-4f00-b5a3-03486f4306d5", "comment": "Malware payload (IcedID)", "value": "46c5143e32e573ea4dc607ee6b89f590", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274371, "uuid": "2968c907-15cb-4fea-a118-a41f2b3cb9b4", "comment": "Malware payload (IcedID)", "value": "3303c5adc165334a54e10fb8a8ad93cdf0758684260fcbb9c1a025839e3e842a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274371, "uuid": "d7bd2e95-525c-4fa5-91e8-2508ca7eecb1", "comment": "Malware payload (IcedID)", "value": "4d1cb608e72267af4cafb6a8269b20ea4941a0c8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274371, "uuid": "5f8702da-1910-420e-a8f6-62861bda6063", "comment": "Malware payload (IcedID)", "value": "785e79090940c9f17d46cc6bd48288eec3c3460640a2f8e838bc6078bbaa0da978144c47dbf5a21bfb3628ebbff48e2b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274371, "uuid": "ead9e6cd-4a5e-4292-a444-684fc58d271c", "value": "5A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274371, "uuid": "30924d41-ec01-421f-bf24-a2b96cf92543", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274371, "uuid": "6b5e0959-a53a-4bcb-bad1-7e44a4cdfbf2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274371, "uuid": "ac068f25-ec76-4b64-858b-688c1215fd7e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274371, "uuid": "4b2ce008-dc0a-45f6-b89b-c21fdb360a15", "value": "document-264324729.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4db1cd-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278162, "uuid": "d18ad898-e146-48fa-b658-6d0f6e74bcde", "comment": "Malware payload (IcedID)", "value": "c043c933b03edfb30e4947ddd6daf378", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278162, "uuid": "1140e107-4d6d-4a84-a470-9fab1da60edf", "comment": "Malware payload (IcedID)", "value": "331c12907017a2ad52ac7c14138cf933d8b521722355add162877fa72ec19706", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278162, "uuid": "324c83db-57e9-4192-b797-92da0b444b2c", "comment": "Malware payload (IcedID)", "value": "61b5a514fea8b4837589bcf021bf1f7afba10b14", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278162, "uuid": "13de9d2c-5f2b-4b82-a61b-9c8f7cab12ff", "comment": "Malware payload (IcedID)", "value": "6c7a562cb4ba6589ad7c5ed0caf318ba895533ae484de5c2e8dcf23aa6fc3701960f653bcd7b728e0de0eafcec0060d5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278162, "uuid": "a4003075-2861-4a6c-966a-0873c8b1e7e3", "value": "67044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278162, "uuid": "60063998-ce44-4ed5-8bc0-8b30a9460192", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278162, "uuid": "e1f2eb9e-eb50-4139-a889-feb3c804f838", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278162, "uuid": "124da757-974b-4fe6-9a6d-fe964fc1653c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278162, "uuid": "e9ed6419-2b66-479c-82bf-e200199caa92", "value": "document-605797747.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f127c85f-9319-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617302519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302519, "uuid": "bc10a159-9c2d-4ac2-b927-e59231217b3b", "comment": "Malware payload (Dridex)", "value": "bdb942f0da62619be71db8cbedc0248f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302519, "uuid": "550f781a-9ee4-4c6b-90d0-4d7e2b891450", "comment": "Malware payload (Dridex)", "value": "3382d25579ffcb565109795ed037aa8d14ffdd759308cc68f0442990048c485c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302519, "uuid": "080a7357-a144-4de2-9cad-f99390c34237", "comment": "Malware payload (Dridex)", "value": "9a0836bef47fa3a82b00149dd2d5d0d810d57ae4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302519, "uuid": "5d55c384-9aa6-45a3-b4b0-0e05781b7189", "comment": "Malware payload (Dridex)", "value": "6d6bb54d14cc8aeb119a225b843267a710507797ed497bf2fb40acf7b7ce12b6d7586b5e07c63a47ffac9e54dc90e415", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302519, "uuid": "f5351381-e1dd-4c48-aab2-48e889a876b3", "value": "6314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302519, "uuid": "b0c1897e-f2b7-4e74-be16-683c54172e7e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302519, "uuid": "4a854d45-2eb8-4423-a017-e41f4cdf2863", "value": "3072:zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:0pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302519, "uuid": "5237eed1-014d-4739-be06-ce4c5b52ece4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302519, "uuid": "d833b085-24de-47b2-9dd7-3df375e686a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302519, "uuid": "11652597-6cb9-46dd-9c6b-d33ece228cfb", "value": "3382d25579ffcb565109795ed037aa8d14ffdd759308cc68f0442990048c485c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe2b21a-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276962, "uuid": "3aec2ea5-d95f-4591-86be-f783eec4d327", "comment": "Malware payload (IcedID)", "value": "3aae38a626e9f6902fd1b02d6c69136e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276962, "uuid": "450f817e-5dda-4c13-8ffe-f992d9c03d38", "comment": "Malware payload (IcedID)", "value": "339db76ea3a198c19e91872eac1de2ffe515209897d8a50ba647178b30471ace", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276962, "uuid": "57174b80-8873-4bad-9d8e-091b6e0a1edf", "comment": "Malware payload (IcedID)", "value": "f832ac53132fe825ae0ca063e5774a27f31b49dd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276962, "uuid": "9dee6821-fb6d-4be7-95f7-bacc71bb3c39", "comment": "Malware payload (IcedID)", "value": "592443fc965bb1ab6869aae8846dc438c12fba98ecf86fb7bb479afa952dfd8397daa26f1298120a3bd5dc01a71691bd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276962, "uuid": "990e8ad9-5ede-4472-b597-d4c8bfc1ea02", "value": "4B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276962, "uuid": "99a62702-961c-4cf4-8f60-f3e452969068", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276962, "uuid": "81b9e2da-cf0c-45ad-9912-c209fac9b9fb", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276962, "uuid": "8546783b-f283-406f-b01e-06586a91ee7e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276962, "uuid": "bbea3ee2-028a-4cca-9354-b7d153d478f3", "value": "document-1377266132.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff9c8b4-931b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617303081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303081, "uuid": "77a69ca8-4602-4057-bc16-e3b15f611147", "comment": "Malware payload (IcedID)", "value": "6049f53957e937e837ee9819f4a3d4f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303081, "uuid": "70d40094-dc31-458b-8f15-cb67aa8aa142", "comment": "Malware payload (IcedID)", "value": "33a21184c636478ad06bde75451c90aace07f3e7288d14d200d55f32fabdfe8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303081, "uuid": "4f848eff-eeb6-4bc9-98ce-9f042f182d40", "comment": "Malware payload (IcedID)", "value": "e3c72bfedd0e9a8abddb63e9ccb8602a6c824569", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303081, "uuid": "990d5a72-3622-4de4-add5-2aee25969dfc", "comment": "Malware payload (IcedID)", "value": "007d2143bd88c3b593dddbd6d34a1ee213b75fdbba1ec5c35604386553fb185fa8823e9a707de547666ce0a65bc404ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303081, "uuid": "e9870094-b92a-441b-92e5-ae626c6847ac", "value": "821408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303081, "uuid": "225d50eb-550b-48a9-ba67-df445fa6d5d0", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303081, "uuid": "e959af19-87f5-47ab-9789-2f5d9fb940a5", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617303081, "uuid": "e44c3f78-23e7-4f60-b882-2ca15db17ff8", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617303081, "uuid": "4c1b9555-d13c-4285-af27-5e68bc3e69f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303081, "uuid": "81cf434c-9f01-475d-809a-2926e6d52e85", "value": "33a21184c636478ad06bde75451c90aace07f3e7288d1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29c2b40-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1617299005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299005, "uuid": "6de4386c-13d3-43e2-85cb-1d9bccdc5512", "comment": "Malware payload (BazaLoader)", "value": "9b224a8a1e6e5897e47fee0eb1e21766", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299005, "uuid": "f4d44f4a-1d9d-4d67-9ca7-f82db35fe266", "comment": "Malware payload (BazaLoader)", "value": "33eab464bca9b39b6c4457cf44320e2e70363a3581bd9b81bca93bca0c63e5d4", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299005, "uuid": "a2939824-9316-4f08-a46b-0e38e3face79", "comment": "Malware payload (BazaLoader)", "value": "d81ac7b2d75d74b1b325c63df5b4a7744a91d8b4", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299005, "uuid": "e60011ae-4076-456e-bffc-8fbc7c6616e6", "comment": "Malware payload (BazaLoader)", "value": "45d20aedb397f992974caa0df8413372ee19e78ea276d4fb7eeb25cb188c6aaa6eb577dc56075ad0ae172aef81de9509", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299005, "uuid": "b86c7ca1-05dd-4014-9964-9f53daa77f11", "value": "9A84AE46731054B4E35A87348842E5C697A5BC3D4AE5E34FE638BA361E332939D3B21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299005, "uuid": "55f96c98-abc0-4494-a9d9-aefc7998f7cc", "value": "bb3b7b74ba5cf43655fdbba213daa5ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299005, "uuid": "39dfdeb8-2277-4e8b-8d1b-ce4d6e9acab8", "value": "6144:vhzyPKlU/jriw3TS6WcziGK4TXj0XF9jywcY/CB/EhNZ:5OCqGDGK4TzIyA/s/EhNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617299005, "uuid": "b0ca0e2f-2764-4ee6-89ef-b87c82cdc54e", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617299005, "uuid": "908ad96a-782a-49ca-839a-6159d35d73c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299005, "uuid": "55515e0d-98c5-4f54-b25a-3ae98d9d3fdd", "value": "9b224a8a1e6e5897e47fee0eb1e21766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5933284-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283521, "uuid": "4beb71d9-5361-41f7-9ad9-521fe1bcb69f", "comment": "Malware payload (IcedID)", "value": "6536ad3161be0df9d315e09ed90e469b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283521, "uuid": "1c73af90-83ae-4328-a77d-022bfc1eeaa3", "comment": "Malware payload (IcedID)", "value": "3434140948cbc8108d76844ac8d643301f34e3465431aa71376c0a67ed055b77", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283521, "uuid": "89cb36b1-2d01-4a59-86c8-daa54f057292", "comment": "Malware payload (IcedID)", "value": "bfd578b672074c87855fb41760906eeb80938840", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283521, "uuid": "7b15e05e-61a7-490f-8fa8-eb44ea56ac04", "comment": "Malware payload (IcedID)", "value": "f915add946fb77cf5339de03216facb094815408e794c563623f3f63f0917a6d874ed0df5c922bc4134f641ec99b1853", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283521, "uuid": "31eec617-45b8-43ce-abb0-b361fe0a9da9", "value": "D0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283521, "uuid": "bbc94747-109e-4cf8-a63d-c2d6f3ea3c1a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283521, "uuid": "8077bdce-1fad-41c5-b829-d576582c2075", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283521, "uuid": "d2e7194f-5498-4024-a5e7-9829c6b9e388", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283521, "uuid": "b930a8bd-37c2-42f1-b86d-81c5f71239ac", "value": "document-680444728.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9c8471-931b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617303078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303078, "uuid": "8cfb4127-517d-4c2f-bec7-217fefa1a66c", "comment": "Malware payload (IcedID)", "value": "f34670c7cf01f5d56a2ee60d577c0365", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303078, "uuid": "670f09be-c791-4045-b3c0-0728ea279303", "comment": "Malware payload (IcedID)", "value": "345538bd567e16dc0408b9db3499d641b79d5dea5c15a14a509fb19bdb9ed019", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303078, "uuid": "b35bef69-d225-464a-b25f-1d66f11605a7", "comment": "Malware payload (IcedID)", "value": "d4084075dab888d4c8b7fc4fd34e2eff5c5029ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617303078, "uuid": "9c4efabc-54b1-42cf-a159-816ac559291c", "comment": "Malware payload (IcedID)", "value": "c127df21f838b26c9381dfffb791fa0f2a0fe6b1bc73c24fc0d4b5d2d0d90d427cd7dc77bc052a6145c335f9b735d817", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303078, "uuid": "cd3f38a1-c9ec-4ad2-b761-906de2717bfb", "value": "B61408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303078, "uuid": "eead3952-27ef-4304-9b57-d7bbd205cd67", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303078, "uuid": "88c6fff2-1f85-47d4-8926-ae337bd2e7fd", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617303078, "uuid": "c95f6def-d40e-4474-ab7a-f99240e88445", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617303078, "uuid": "1b7ce903-c1df-40f3-ab4a-cd4e5d910a6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617303078, "uuid": "87a624ea-f076-4593-bcdb-4679392185ce", "value": "345538bd567e16dc0408b9db3499d641b79d5dea5c15a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8449ce-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275020, "uuid": "f71f2e00-204e-4bfd-aa81-3d42c5049917", "comment": "Malware payload (IcedID)", "value": "5e702f55c8765ea0463c2cd86832cc45", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275020, "uuid": "ce25cbfa-4e11-4beb-9565-2b54ca8d2259", "comment": "Malware payload (IcedID)", "value": "345e75cf011b1221abcc77247d7865bf4e0260b638aaafdc27bab660288e3648", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275020, "uuid": "06e3c9f8-2750-4e74-866d-0ba71240d81a", "comment": "Malware payload (IcedID)", "value": "7bed96010dec597b6c8a1b499b0773529c7a6684", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275020, "uuid": "b4af6d02-6412-4cbd-9591-5f07072a6411", "comment": "Malware payload (IcedID)", "value": "f49ede89253715fdbde8505eec347bec5b073782b78ab20d786684316178314c1f297e247dc812c7c479daf185a3b224", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275020, "uuid": "fe7d42ea-fdf8-488f-8a25-9ea217d24290", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275020, "uuid": "2d9a7d4b-428a-421a-9c6a-81c5b074b0a9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275020, "uuid": "a4c1cd30-85d8-42b3-99ca-1f84393b1587", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275020, "uuid": "848230ed-c473-4b05-b2c3-2a3c552a74cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275020, "uuid": "662a0cbc-02a7-4701-b264-139dae8b3257", "value": "document-1381653482.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3669b581-930c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617296622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296622, "uuid": "33ac370b-888f-4fd9-9632-c0c999400658", "comment": "Malware payload (IcedID)", "value": "1945993c42e43f4f60afd4ebba6ccbb5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296622, "uuid": "e8f28e4b-0259-4b28-9523-3125dfff26f6", "comment": "Malware payload (IcedID)", "value": "346cfc25489633b6961dfd83b3186c5bfb3faed715c3cfb693a02245b4f47390", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296622, "uuid": "58947ff9-1943-46d6-8d6d-498e84df4829", "comment": "Malware payload (IcedID)", "value": "936fcb5ae7ecff66a8589bc0cdb47003e28d89e6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296622, "uuid": "33eb54bd-b18a-4734-b771-a4eea6fcdb0e", "comment": "Malware payload (IcedID)", "value": "f2aa45a61ff6e6e4a5ca6711a6d5ba0875c90e98bccc91eb2d08cf2c973a9d32a40f56fb6a4ee15dc2a7347646a50d3c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296622, "uuid": "a16b1e51-1176-4ac4-9c92-95ad3b53aa75", "value": "6E838DCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EAA2E4D42FA40A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296622, "uuid": "94c20eae-44f6-403d-8c06-eabc5c219074", "value": "1536:IB240XZfcaaxf+EQliU2hawxCAIoo8+BNvMhfvV:+2d1cBWEQXMx9o8+nEhHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617296622, "uuid": "520cac7d-4f5a-4b29-b6ca-824c29589897", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617296622, "uuid": "a8766d13-41d1-4a23-b8e4-65c2cb402908", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296622, "uuid": "e8882370-7e5b-40cc-85f5-4df92f414b90", "value": "2931.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978fcd77-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277458, "uuid": "77216175-647d-4074-ac98-74efed11b560", "comment": "Malware payload (IcedID)", "value": "aaabfeeb06b88471c8b14a66a2ffc76c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277458, "uuid": "4b262454-1b27-461c-bfc8-30a7c1465249", "comment": "Malware payload (IcedID)", "value": "34994f2109e197063e783f1c244a2daa0bf2d0feeb740fcbde645bcd93dea6b8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277458, "uuid": "62069643-b012-4428-b858-50b8bf6b8125", "comment": "Malware payload (IcedID)", "value": "f38782f91fbc81ad2a54c286e78be894017b7e33", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277458, "uuid": "5e726638-cb93-444c-9ce1-05dcfc0d7347", "comment": "Malware payload (IcedID)", "value": "d7b4edf06d1d3734a1afddf88f6b5ab90ed6deb154310279586ec106476a1a754504f4eb2b937d5449ba963a98313c6f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277458, "uuid": "9ad94d5f-e095-4c8c-86b9-8084c3a750f9", "value": "88044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277458, "uuid": "026cb66b-b38e-4e82-9985-09c560c0af90", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277458, "uuid": "8fc30d5b-2773-45be-becf-c73f669d63fb", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277458, "uuid": "1c16c2c5-053c-4b14-a893-87ebaa71a21c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277458, "uuid": "5763c779-feed-41de-940a-75a32188c475", "value": "document-600747455.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab041f13-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277490, "uuid": "a84e6e7e-31a0-4754-995c-6a41b61d7a8b", "comment": "Malware payload (IcedID)", "value": "7b153b4fa983783eab1eb252eb4ec21b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277490, "uuid": "fded05e9-d553-451d-8b63-03d10d9842e4", "comment": "Malware payload (IcedID)", "value": "34bee401d482940412306e6acfc5dd34323098bdc401313b66cc8cc48aa25743", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277490, "uuid": "be0a8624-6a08-495d-b6b4-7911b4123206", "comment": "Malware payload (IcedID)", "value": "331802d086a07bce6729ad74bfc37e38f950497e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277490, "uuid": "0a80a29b-89aa-4a31-859d-f6dc5da914a7", "comment": "Malware payload (IcedID)", "value": "87c60d62ad2bb0a894434a665446a8c17df7312e2333a12621598d025be22dce5907c3467b27d17f95cf8d3b5f16324c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277490, "uuid": "4d1c8341-35f6-4cfe-904b-0cb46e8a2adb", "value": "F6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277490, "uuid": "1a99c475-6d6d-45cf-aead-cb1f32bc81b4", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277490, "uuid": "58d0b8fc-f94a-41fc-ba69-6eb16597a3cd", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277490, "uuid": "b844a083-b036-477c-aa7c-8c31d6d83258", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277490, "uuid": "287fe0ea-8e9e-4949-a57a-c4a9cece088e", "value": "document-1293265212.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ea0807-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279017, "uuid": "cf874ebd-3b07-49d4-90f2-dc44f7f0bdd7", "comment": "Malware payload (IcedID)", "value": "8d3e159a16562fa92111fb285a935bf1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279017, "uuid": "b4928a1b-159a-4725-b2ee-dec6af5a9afb", "comment": "Malware payload (IcedID)", "value": "34c10ca792777674ed47b627a22f1504e2864d8a1ff6e58aac97fa99dd8cdf37", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279017, "uuid": "145087f9-53d2-42d8-afbe-5df1a1b80b41", "comment": "Malware payload (IcedID)", "value": "e207e7f9f97a69fd12f6404c76a8d82d08b0c416", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279017, "uuid": "8e786beb-0a10-423a-9aed-e7e1924a3af1", "comment": "Malware payload (IcedID)", "value": "fe72d59d9b8186d2ed537c6a4c958326e23f7c2f60d70b535906ab8a8b42e64be7ec8c559401d5caba918878388bf8bf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279017, "uuid": "462771d0-cc3c-4130-9f77-ca46e490cbc7", "value": "5E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279017, "uuid": "dcd6bba4-6b46-4664-b2b8-f898cef7630c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279017, "uuid": "f4104751-316b-4f9a-a285-d882b006fd02", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279017, "uuid": "61e2ebf2-a043-4ba6-9913-154a3231dcd5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279017, "uuid": "988fe140-11ac-42d9-98ae-0e00eb3555dd", "value": "document-1633521065.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca95784c-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617280979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280979, "uuid": "528ebf78-af81-4afe-a4a4-ba8de24f577c", "comment": "Malware payload (AgentTesla)", "value": "772a91f26780d326bfb4fb1c7de241a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280979, "uuid": "621dd837-f82d-4362-a783-01891377023f", "comment": "Malware payload (AgentTesla)", "value": "34cb78b59b227613e3166516873fb54cb599444d399a2531238077808f72a286", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280979, "uuid": "c4305217-666b-4aed-80f5-531978c68a98", "comment": "Malware payload (AgentTesla)", "value": "d35767d634adee1891de8edfc44e3f308b574397", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280979, "uuid": "c5c48e24-a011-459d-8e23-ff4ae16d440f", "comment": "Malware payload (AgentTesla)", "value": "7db338fabc5480de9991e0e1d95d12101395194b01f42d266da047ad74b889e0ba3408a930954d70dfede366bb9bd991", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280979, "uuid": "dab433eb-4f5b-4620-af51-ff407633f948", "value": "8FA4CA9CC09742E88F89ABB86B1F1F85014C7B6EFB44A6327234977527E2C7B501687C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280979, "uuid": "c9c6ca9b-03fd-4abe-8980-5344d0d7f009", "value": "6144:6TFjqb5yQ4MzwCmDph+U0X5Kw2RrjMFMu+fhKd/ZAorvSO55cZ29WRJSAMdmcIPp:BwLwcX7zfpX6OzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280979, "uuid": "df7adceb-fcb7-4bc4-8811-1fce4654add0", "value": 458007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280979, "uuid": "b65f850a-ddd8-43b8-bb93-74c338cea9e6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280979, "uuid": "887069b7-97fb-46e7-a90d-9cec0ce8ff3e", "value": "list of items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66658e10-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276946, "uuid": "9292f8f2-cfea-46de-9741-b6028d8db30e", "comment": "Malware payload (IcedID)", "value": "212776c5bb788195a58ff1b76f96b524", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276946, "uuid": "1d231591-8ec6-4624-83ec-10f6c25c8128", "comment": "Malware payload (IcedID)", "value": "34d413ca8af123d5b99b807511135b6907d49041525cbe478bc20750a62c7f4a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276946, "uuid": "8a69f722-dde8-4ce0-b64e-cedca76eeca1", "comment": "Malware payload (IcedID)", "value": "90f0b0e5fe4986f9ff04a541a5bf35b869790e9a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276946, "uuid": "befe69d6-d1aa-4350-ab4f-bfe4cf028194", "comment": "Malware payload (IcedID)", "value": "9563a947354bdc318622662e1c51b27de03a5cd48c0d5a5887d776a8841564a79d360e06ad14c3d5454c22cee156e89c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276946, "uuid": "e291708d-9e89-48ff-85fb-214093fb5381", "value": "6C044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276946, "uuid": "513eafeb-fa89-4998-83ff-ba248ca71e3c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276946, "uuid": "565ab695-5292-409f-b89c-b70564da5cf3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276946, "uuid": "19a5308c-31bd-4caf-96c6-dfc244dea3ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276946, "uuid": "9bb9c85a-4aee-4d9a-9667-fe8c0c3e55e9", "value": "document-149823391.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be139a7-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276955, "uuid": "580ec3d7-1aef-446a-9055-521778351f90", "comment": "Malware payload (IcedID)", "value": "76292c0f4a135ca262bee46bd6f9e735", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276955, "uuid": "60dbe8e6-fcd6-48ca-ae15-b96a01790d02", "comment": "Malware payload (IcedID)", "value": "358fe3c9a2578a057857dbd3f267de81dbac7a7e44ad4e1eb704681f857d4eda", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276955, "uuid": "ca3a4f03-e17d-4c9e-b1b6-75b3068cb403", "comment": "Malware payload (IcedID)", "value": "7566f869843c955cd094846412ae40baec83685c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276955, "uuid": "dcade1e5-78df-4cfa-8d85-f648670a296a", "comment": "Malware payload (IcedID)", "value": "f1e7efee8fda4b86771499453110a955a87a43184048ecd14faa4ae0eec7ce1e952cd98f03fae548851f0133d48936ea", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276955, "uuid": "4377bba5-94c1-4bd4-b361-8c2f59668dfe", "value": "F8044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276955, "uuid": "9a1a98e4-2ad6-43a0-92e8-28d06ad3f55d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276955, "uuid": "2455bad3-0e52-4dfd-b816-43e827cc367d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276955, "uuid": "acdfc52d-9b29-48d0-9cc4-1726e1cbe37c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276955, "uuid": "8cd532db-8a51-4bd3-b906-0d3b43bd62f9", "value": "document-395055219.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cfce40-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283542, "uuid": "214d403f-b4ed-49a5-8abd-4a33e7b1d20b", "comment": "Malware payload (IcedID)", "value": "d07000de29076acc7e99cb2b4a10f144", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283542, "uuid": "fe6de8df-3875-4e14-b6b9-15570bb573ac", "comment": "Malware payload (IcedID)", "value": "35fa4c28369839e331866716110a8ff440678ee1a302c6f97c89357a8ac7f02e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283542, "uuid": "f6b325b7-b736-4003-ad33-06fee8bb01dd", "comment": "Malware payload (IcedID)", "value": "5068c6d6b42f318530b552104bb51bb4e10eb867", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283542, "uuid": "1e80d915-c1f5-4c0f-a76e-581df5084b07", "comment": "Malware payload (IcedID)", "value": "70a31fcbb561468a0ca7d8f67ab09c29e108b3cfbae95f082e46d5f1cc6a6f2f34dc375c1bd99ba624f8c6984d5e7672", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283542, "uuid": "c77fe951-d7d6-4229-9824-85060e82ebac", "value": "C6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283542, "uuid": "3e1335a4-61da-478b-911d-519e0121b5fe", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283542, "uuid": "b17a8ccf-a705-4214-b05b-238f49f59c54", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283542, "uuid": "13983ee7-bb93-4e67-af6d-9f14e963be61", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283542, "uuid": "cc6728b5-faf1-4c83-b128-860e69a79ed5", "value": "document-1148707746.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9fc69e-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278164, "uuid": "d177c78c-4e6f-44ce-aa17-03d05864948e", "comment": "Malware payload (IcedID)", "value": "f75247dc44a8a454fa36218522ebf88c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278164, "uuid": "3a60e00a-23c5-4bb5-9c9d-10795889cf9c", "comment": "Malware payload (IcedID)", "value": "36187162e5afc9af887e3642eb35659ab78caa6c413905d56ecb0eda50c47e18", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278164, "uuid": "2ec2ec6b-0fae-4dca-ba80-de811ffe5ef5", "comment": "Malware payload (IcedID)", "value": "c210877c708ffed64ca2755ad9f692c4d2b117f6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278164, "uuid": "d5aaf71c-cf4f-4eeb-b340-0e854566fe86", "comment": "Malware payload (IcedID)", "value": "fef066ea2127775a4084f8c6a3f4914b1b654c08e196768e4416fb02fb5ccb9dcebd27964251c719488dfe6d1917992c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278164, "uuid": "fbb1af59-fa4b-45e1-997d-c3281bfe6515", "value": "A7044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278164, "uuid": "01dd2cd8-5aee-4dd7-8eaf-03ab36d3386d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278164, "uuid": "49f43ffb-d50c-4459-b966-b50005e74086", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278164, "uuid": "65c92267-05b7-426a-b671-81ac450b7723", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278164, "uuid": "dde38957-3cc2-4712-9e27-2638310699b8", "value": "document-1242714231.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955cf4ac-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287762, "uuid": "79689417-c148-4955-a5b5-7ad1b4acd1af", "comment": "Malware payload (IcedID)", "value": "e9f5e5e3daa77a596d2cac558d6ba00e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287762, "uuid": "50ab4c5c-c6ba-4354-8e8a-4027aa9767f7", "comment": "Malware payload (IcedID)", "value": "3630de502af9869b48de7342a43c8d81833885d033e9d527309354d4a93c103a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287762, "uuid": "f98a949a-8928-4976-92ff-f8ff6ab14edf", "comment": "Malware payload (IcedID)", "value": "45ab7e9f8fe0de5a64a46dde8042ce549e467d3c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287762, "uuid": "a6c89116-c436-41eb-a371-5e19aa271503", "comment": "Malware payload (IcedID)", "value": "6832982738482ea251ca3ad4a6ef382e8a23d437be70b6bde9305303e72bacfddaf5590cb1c3fd28517f6f83eddf0740", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287762, "uuid": "e270ee41-dfeb-47b3-853b-25fcd5db125b", "value": "4A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287762, "uuid": "853f4bb3-1a9a-4b8b-97d8-a6563f4b34f9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287762, "uuid": "fe966345-2aee-4c08-8608-e88ad6f2a5b2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287762, "uuid": "e9173fa6-6a11-40ec-87e1-129da98d8dca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287762, "uuid": "69daf5a9-f22f-45b9-8adf-ad8166ef6b0b", "value": "document-1866418734.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42681e3-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275895, "uuid": "4cddca24-3e90-4dcf-bdb9-9c984b0c392c", "comment": "Malware payload (IcedID)", "value": "f1771cff59fa1a01b8a517d54b312c04", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275895, "uuid": "37cc62e6-b86a-4a48-ad0f-6fbd89227b5b", "comment": "Malware payload (IcedID)", "value": "3655424711d01d258b14ec53004db54efb7807a055ebf8300a55e7dc9a322341", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275895, "uuid": "86f37fa4-a6c1-48b7-909e-9ee162209091", "comment": "Malware payload (IcedID)", "value": "efa498f52aa0d3d61f1b7485d7954150847961e7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275895, "uuid": "fd5cc620-c627-4327-bdfa-45773c01d1e9", "comment": "Malware payload (IcedID)", "value": "be191de06cdec323b82c6763acb381c3ea0f17eeffa940ac42f0123d8e634672ffa6157c39adcf7c4bbbe1e82eeb4295", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275895, "uuid": "171bd072-e828-4791-9d5b-f99d0a446184", "value": "88044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275895, "uuid": "ac255245-0f94-457e-9fa6-c6797f899d45", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275895, "uuid": "15c1833c-a3a8-446e-aecc-9c38998540b0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275895, "uuid": "5cdd6156-014a-40d3-80af-e61bd60be848", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275895, "uuid": "d37f0aed-a3bb-4e69-a37b-a2511439511d", "value": "document-85578399.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7511ae2-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280947, "uuid": "6c0219fe-9fec-4ea5-8014-00cf2e076715", "comment": "Malware payload (IcedID)", "value": "dda5988e932426f3cafef6c7fe880c3e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280947, "uuid": "fc7e222b-3f69-4e63-8d92-c0687a1b6b3a", "comment": "Malware payload (IcedID)", "value": "366fa5c3e290050134af50e8bf754dc7a902566182b052c06be99566ed0562c1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280947, "uuid": "f96b4aae-7c34-42a0-8a4c-1f5674851462", "comment": "Malware payload (IcedID)", "value": "bbf4f00dcfb04a7fb04d83e7437c3385a9edd66a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280947, "uuid": "234fdbe1-9953-4bfc-a5d9-05f7d954e8d4", "comment": "Malware payload (IcedID)", "value": "da0d6d6c328bdd43e1a04fb2bf505d75564bc48176dabc35e63e4d2f6525db4e22eef0fa052283b390e3173197e1faf3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280947, "uuid": "a3b188a0-39c7-4d60-b373-4ac54346f90b", "value": "F4044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280947, "uuid": "b43d6307-ac9b-42da-a359-db3d6d20b63c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280947, "uuid": "d2b8e9f8-db9e-42cc-91a3-e8aac76d160b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280947, "uuid": "bee5ef8b-8b74-4049-8209-e251353540d4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280947, "uuid": "873f1d2e-997f-4175-8a30-9899ef158c5f", "value": "document-719712851.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7969c5f-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617261701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261701, "uuid": "bc486ee0-dc89-4700-896f-79b92651ad63", "comment": "Malware payload", "value": "cbfc4fa058fcdede60f5ecf6d64d37e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261701, "uuid": "8658acb1-f8ea-4e10-ad6c-921e6b1085e6", "comment": "Malware payload", "value": "36f36e94e2f0adebc759ef4ba3140f3d4d9888ce3a3efe1b3f82fe12d1d3c8e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261701, "uuid": "f2ac957b-6e63-4c8d-8fe5-31292ca910a6", "comment": "Malware payload", "value": "018c69abd8fb6349b99e19a06c147226201cd369", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261701, "uuid": "a33144ed-61a0-4edf-a89b-06256ddfd73c", "comment": "Malware payload", "value": "ce0d39cd699f9444c215086391f215578fcaec3ed2596ad76613832d61d3e37fea8c725d0f4607d5588b3b7c1a1fe438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261701, "uuid": "394ae849-2b6e-45f5-b3ba-683385831235", "value": "EC84F01AB7D20E87E9BA6EB12F9791F042B3B85B1FA7464B7640723D2821F114C9471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261701, "uuid": "47d11cc8-4319-414c-845c-8d3d6bad886c", "value": "ce1c6fdc67e50426e322780731487a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261701, "uuid": "260831f9-a6dd-4d97-910d-8e009177b6ec", "value": "6144:9un1c71S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYRq:9c46A9jmP/uhu/yMS08CkntxYRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261701, "uuid": "d61fc438-a4a8-42e5-8cc3-441c2a875094", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261701, "uuid": "b0c1a694-4ef8-4f75-b1f0-1ae7c682d498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261701, "uuid": "604866f3-9370-4162-bd49-cb8d6781f7cf", "value": "image.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48c0d6c-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277480, "uuid": "e724c58d-daf5-4ab6-9d8d-49bb6cac2f46", "comment": "Malware payload (IcedID)", "value": "3b858a31c053d19d753c981d5ffb4514", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277480, "uuid": "bc997a1e-8425-45f9-90b3-ef66db0716a7", "comment": "Malware payload (IcedID)", "value": "37a734759f4c776bc1a5023a6a4712fd272ebef4e192a31232a79df867f215b6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277480, "uuid": "002f5747-4708-4494-969b-f90fcb0828f2", "comment": "Malware payload (IcedID)", "value": "3bb35eb56e7f96129a657dc36ab994a319dd35cf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277480, "uuid": "9080af36-d04b-4582-a5ae-35367477ab14", "comment": "Malware payload (IcedID)", "value": "b0961587a39ffdd8b7eb560f0f11250a6a4a3827cd009159b1a1112c74c5f7e2a807fd3b61f986b5dff3a94d63c85f0e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277480, "uuid": "1191f1ee-f4d0-4630-bd2e-9e545c579d58", "value": "19044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277480, "uuid": "9187e667-edaa-46c6-b7aa-77ac1c2e1e80", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277480, "uuid": "a4bc2a26-9f73-46fe-97c8-060cf1cb69f5", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277480, "uuid": "bcb08a54-3a11-4ac4-84cb-b4cdefc71af9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277480, "uuid": "32f82cce-f4d4-4a77-85cf-0d9e1afe4e22", "value": "document-220648556.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2222a0-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286163, "uuid": "bd99ef16-299f-49b7-bc3b-6425892eef97", "comment": "Malware payload (IcedID)", "value": "157e6264ebadb60f681ae4f3cbd512df", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286163, "uuid": "c8df6691-5b9f-46dd-987d-03c483e9a7ce", "comment": "Malware payload (IcedID)", "value": "37a7388b8e2136ca0df3cff6336f8acfd531c7177eea58f48cffd1b146df8f1c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286163, "uuid": "70e3504a-10b1-48be-b5f5-fe6eb351e000", "comment": "Malware payload (IcedID)", "value": "6a6caa78fef45a184c9fc7067f25ce26b4b1c5b6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286163, "uuid": "745d0272-40a8-4e53-9b3c-da2f7b48a716", "comment": "Malware payload (IcedID)", "value": "6281c68a97294c0893d32272f2660c612479eb753c2c478f66bd85cf0e664512d47bfe7f8ca38e0d09cc18dd5cde1df8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286163, "uuid": "f7047342-a55b-4c2a-bfb5-7749b5174756", "value": "7A838CCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EA62E0D42FA84A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286163, "uuid": "5192a5c7-1e67-4b9d-a8c1-f8d54a4d22ff", "value": "1536:IB240XZfcaaxf+EQliU2hawMCAIoo8+BNvMhfvGF:+2d1cBWEQXMM9o8+nEhHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286163, "uuid": "deef725b-c650-4d0c-8d3a-482db5299a05", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286163, "uuid": "b0c38962-a7d8-427a-bc69-14856ba1b5d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286163, "uuid": "a0602142-c5b4-4ba8-8a9b-b8f853f58f49", "value": "2139.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edff3f1-92d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617273470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273470, "uuid": "1fd4d9d2-8243-468b-81b0-ac9eee8a1a67", "comment": "Malware payload (AgentTesla)", "value": "eb1db92108eb6d91d2964d237490f7c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273470, "uuid": "22de023e-d8d0-486b-9bd7-d560fd1e0236", "comment": "Malware payload (AgentTesla)", "value": "37a8d6589b8cbbf567ccb5686ea0c4486eabbd6078089a6829fd109a77d4e2e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273470, "uuid": "0c6c8a53-7a14-4185-9c3c-ba483a4d4e14", "comment": "Malware payload (AgentTesla)", "value": "b0c406c4253b409c458eab880f83818208fc4932", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273470, "uuid": "fb364807-1574-4ae9-80e3-62435f3ee6ea", "comment": "Malware payload (AgentTesla)", "value": "2353e148abe69633ef66764dae037ae8c309570dcfaae816c1d87c75ca24990509b223124ae7b7a75bcd688881f5d73a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273470, "uuid": "efe8d5ab-9ffd-4263-836e-7474e77e04f9", "value": "83E4596337477BAEDDB803B62452411033B0AD36EA6AD10DAC64735D5F772C08BEE662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273470, "uuid": "1b10ddaf-15bc-4bcd-90eb-25e985ddc67e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273470, "uuid": "6400f088-8745-4398-b4a5-c203f599a127", "value": "12288:ujN8tVjQPq2dyIcJ8XUxfulqE72lDqOMgWC+mfQ:uW4q2wIGfIqQ2Nq5C+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617273470, "uuid": "03eda80d-0017-4e16-a8b4-8def76478701", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617273470, "uuid": "21604cd8-2a07-4bb6-bcb2-dc1784871661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273470, "uuid": "cb9ec48b-a09a-4944-9466-aef4c9ac6d7e", "value": "SCAN_310.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b446b59-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617259318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259318, "uuid": "1a43861e-8b86-4740-91f0-ceb6fd293134", "comment": "Malware payload (RedLineStealer)", "value": "335f9d49b25655d5204f4745577b2a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259318, "uuid": "90317c34-89bf-4847-9bbe-8d469c8b9869", "comment": "Malware payload (RedLineStealer)", "value": "37b026efa4d522e78254378341d61b888b1a454723c7bd50d11ead50d624d8da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259318, "uuid": "91fe97f6-276f-44b7-aa61-6318bab3613f", "comment": "Malware payload (RedLineStealer)", "value": "c23f5616722c1eba74db418da8bc19ad28922a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259318, "uuid": "0972f84a-7377-41c3-8f9d-6b803e36912d", "comment": "Malware payload (RedLineStealer)", "value": "ea3753a9295f5b02cb375e4472ffd444602f565b2e6d11198dff2ea1aac971542ed88f5738a8b0c2efedbdd21cb2ff5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259318, "uuid": "09d923c1-b700-4dd8-80a2-38cd4b03e5cb", "value": "8464DF00B1D5C433D2A619740825C3A55A76FCB66F6466CB3B947FBA8F352E18637383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259318, "uuid": "6b916f81-f919-450f-9ffe-09e467861bf0", "value": "52daee09330e1d9ebf497442d16920ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259318, "uuid": "539da99b-84f5-4d7b-97ef-ca924800ba3f", "value": "6144:cdMEImE2LAQixdo8gO1oNs7PjdfA/AkXZOM:DEtE2uxdwa7PpA/xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259318, "uuid": "ae21ac5c-2325-4873-a01f-bec40a7ca1d8", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259318, "uuid": "93302e72-4339-47fa-a048-97af069f6964", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259318, "uuid": "d884e2fc-15a9-482e-808d-a3878617ad6d", "value": "335f9d49b25655d5204f4745577b2a86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4351a276-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278175, "uuid": "c2771839-40ca-4743-9f26-107a419290c8", "comment": "Malware payload (IcedID)", "value": "f66eb3efc9cb8671950a66fbed39684b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278175, "uuid": "def9003a-82fa-4946-8b6e-4978ae150efb", "comment": "Malware payload (IcedID)", "value": "37bc41b1f132c3545f6aef70a729edf2948761bccbcb5a0ed57657cfb80efe6c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278175, "uuid": "f19b7196-eabe-451e-a63c-4a6d834936fb", "comment": "Malware payload (IcedID)", "value": "0b02cf7b2e444b7d5d43ba3ef10450edb93bca7c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278175, "uuid": "b08640f0-f62a-4abc-8235-1a8a2662c93d", "comment": "Malware payload (IcedID)", "value": "30b46262965113ef28c7102e457b850ef0d26825d077556d3d7aa2c544ec8c615c8ab107cf65b4abbe840881baa3105b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278175, "uuid": "a268dc3e-886a-413a-9060-c958ec03e8c4", "value": "65044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278175, "uuid": "419cb324-ae0c-4edd-b55f-916dc0e3fc46", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278175, "uuid": "e41fe2a8-6e05-49b1-aeca-3a94ce46d02c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278175, "uuid": "4b9011cf-f5c5-4607-adbd-dacbc5bc2410", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278175, "uuid": "8bd77fff-2616-479c-928f-41a6e385bc97", "value": "document-651083968.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a94e25c-932b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617310105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617310105, "uuid": "6b9d927f-c22b-49b5-8381-30f29fe6dec0", "comment": "Malware payload (Dridex)", "value": "e2e8fc617de1597ea323cf770a782cf4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617310105, "uuid": "9820c50f-e326-4291-9b7c-4914dde1b873", "comment": "Malware payload (Dridex)", "value": "37e680fb190507965e2a96db1a4ffd60af6c2c6a34afb615f0bc93699826dd71", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617310105, "uuid": "a7fdb8fd-5f00-4d84-8c4f-5d8243d0a4ad", "comment": "Malware payload (Dridex)", "value": "c7d15a7ce1ed6014ee5b8030fd1e6ea5d0208365", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617310105, "uuid": "830e96fc-4a4e-4b62-8a3e-e93e08e3ecac", "comment": "Malware payload (Dridex)", "value": "52b5943b76ba918dfcf9c90a70664aaaa8e037b236b2f2d9526f3d5b6b9c096483dbb8186011ae0cb02a1faa27cb336a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617310105, "uuid": "8a315e87-e3af-4d4c-b92b-f78fe953bd7a", "value": "D414AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617310105, "uuid": "4a65fad0-7aa6-4b3c-824e-44bb3d22f58e", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617310105, "uuid": "b7070ede-367d-4bac-8607-b8c72370a645", "value": "3072:P1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617310105, "uuid": "7b2fd465-a5be-41bd-8849-37aeabcc20ff", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617310105, "uuid": "2fb7899b-edac-4bd7-aba3-994a6072a344", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617310105, "uuid": "fc3fd21f-1abf-4c0c-ba9b-69e013bbda2c", "value": "37e680fb190507965e2a96db1a4ffd60af6c2c6a34afb615f0bc93699826dd71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410698b9-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261851, "uuid": "cdc1a741-894d-448e-bd66-0fbf55447900", "comment": "Malware payload (Formbook)", "value": "68614b4f9185440fb9dca40451d4d6e7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261851, "uuid": "7fb56eb0-b1c5-432b-88fb-69bdd0171308", "comment": "Malware payload (Formbook)", "value": "3803dec5e2ab718dedda091e9ee84b588545614ae3d54aa78d956cec21128fda", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261851, "uuid": "e65b538d-398e-46ff-b9d7-0353c28b269e", "comment": "Malware payload (Formbook)", "value": "37db2314481eca57a00a26b7552cd1c97919371d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261851, "uuid": "1321a4e4-7ad1-4eee-a671-9d0a209a1944", "comment": "Malware payload (Formbook)", "value": "0a4ef4de866f53702e114fa36303c20294019f67cf2e2d6faa0f151f539b67c6d23257c8f069a958ba4d2fd2e9420441", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261851, "uuid": "ed788df9-8817-456d-a519-59a6bf5b8087", "value": "6CD4592337877BAEDD7813B61452410033B0AE36EB6AD50DAC54725D5F7B6C08BEE262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261851, "uuid": "44cb2ec0-0a48-4106-9176-5872e3f38f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261851, "uuid": "5b5a04ae-d5f9-4e0f-9eed-d97857b4b04b", "value": "12288:nvS8TNjpd2p9jklP7fjddqhhdfsC6erhW/Vp:nbap9jkhnd4hhd0orU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261851, "uuid": "78bb4276-e2e5-4cb4-83e3-85a325e7aceb", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261851, "uuid": "4f1d36f8-3b3f-4e74-a13a-4c9542b63e4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261851, "uuid": "6425679d-92d6-4d29-a174-d2c1d8d3d5e7", "value": "PDF NEW P.OJerhWEMSj4RnE4Z.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979998b2-931a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617302798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302798, "uuid": "580ed8f6-ebe8-4715-93a8-41f8303111d3", "comment": "Malware payload (Dridex)", "value": "920ccfb1bfd340663db5080f96a89b1a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302798, "uuid": "33f98342-8021-4513-88b0-18ebdb5a8abc", "comment": "Malware payload (Dridex)", "value": "383a79200cd09f3f120633838e3723b40b547d2062a1174595d9b006ada71be5", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302798, "uuid": "a4671e80-fdc6-41f3-9ec2-01ae3639b793", "comment": "Malware payload (Dridex)", "value": "0dea7904af2dcdc3cff3685114c324e6d2ebfe29", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302798, "uuid": "aa69a66e-7c9f-4008-b03e-f53b7bcfa6eb", "comment": "Malware payload (Dridex)", "value": "e54bfba5c481ce91dd1c8f0cc1e48bf760fb7c1caa676d793dc5ad81e34c9d191af84817a36a8a7ec3c7b790d0ebfdbd", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302798, "uuid": "7ac31c57-c32e-47c6-81cb-a9bf6f0a085f", "value": "5314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302798, "uuid": "f12673b8-8135-4275-9d9b-cfcd225b4d01", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302798, "uuid": "5aa3ede4-0d01-47f8-9e41-1ee7918b3ff7", "value": "3072:Wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ppjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302798, "uuid": "dbb6122a-00e0-466a-98d4-9679b98e9f07", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302798, "uuid": "ec72b600-2959-40bf-b673-1730b0efc4dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302798, "uuid": "2646d074-e08b-4a47-9acf-1e12865a5226", "value": "383a79200cd09f3f120633838e3723b40b547d2062a1174595d9b006ada71be5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbb5dc9-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275292, "uuid": "758da59a-6188-44ba-bb80-35f6dd5f151a", "comment": "Malware payload (IcedID)", "value": "8f9adfb8e80c99be65bbcb3af5b2d997", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275292, "uuid": "0dc1f28c-1340-4163-848d-b6dea4f66ece", "comment": "Malware payload (IcedID)", "value": "38456f839b658862f79f66678fbb140a76af056530157524ffd58dd1d38c47c1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275292, "uuid": "b8617319-f95a-4f78-8836-9c1469992bf2", "comment": "Malware payload (IcedID)", "value": "2ab2be77d97f00006b113cbdbb7f135b0d5b7434", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275292, "uuid": "ea88cbca-e7d2-4cbe-87ec-3dfcbd67bc4b", "comment": "Malware payload (IcedID)", "value": "0a247e7fad38e5945ce5613b6ab55a51748e2313734338deff0e8b295369084d3e89f5b2d5ee308ec856bc5ad0390956", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275292, "uuid": "599e0b53-9c52-44ba-b0d9-78c32e000b39", "value": "94044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275292, "uuid": "89f59997-39fe-4600-889d-2e7963664bc4", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275292, "uuid": "c3abbca9-65a4-4a1e-a746-a1b5f945c914", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275292, "uuid": "66fe9eb6-78d8-4aaa-b066-40dec369a067", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275292, "uuid": "de123c14-68cd-4ee5-a58e-9231468c699b", "value": "document-1141558953.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5231b5d5-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274764, "uuid": "f37660e3-9d03-42b1-8919-5dcd0cdc448a", "comment": "Malware payload (IcedID)", "value": "88602de25956f0041ade8e129a9ae2f8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274764, "uuid": "3f8db218-7fa6-4fe5-a062-6b1b1e8f2631", "comment": "Malware payload (IcedID)", "value": "38599915d5bc5091602e9784603f8b88aefe78c2bc2ee221d7a9dfe1f940cf7a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274764, "uuid": "430380aa-8bac-4b88-9703-7ab866e2e0e4", "comment": "Malware payload (IcedID)", "value": "05c5fc170c6bf576d44df1433fa2c0d9ee198b40", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274764, "uuid": "9566f364-7a5a-431b-b89b-30adb6d9d7e5", "comment": "Malware payload (IcedID)", "value": "2ebdbbeec318507a16ee57fe04609f41500ad78de540ba8bc7c39253074a37fbf6984256207915b1556a32a81a9dd3b3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274764, "uuid": "fae3814f-01a1-4244-ae1e-67ab9133b20b", "value": "7A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274764, "uuid": "ec7e8706-e1fe-407d-b4f5-d62f50162f52", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274764, "uuid": "9e34d71c-0075-4493-946d-e3fe760ec64c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274764, "uuid": "7f3de2e2-3902-4c09-b644-0a5cd5833aea", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274764, "uuid": "429a11f4-729b-4f50-90fb-4c5a6269f2dc", "value": "document-1389260864.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35b0315-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284779, "uuid": "aafc7ccd-4f2f-469b-9f40-f8f4bb1444c8", "comment": "Malware payload (IcedID)", "value": "094aaa4fbe8805d1a9318cd4ce7c2d9f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284779, "uuid": "e30a0ac8-2aa9-4e46-bd47-3ee3fd01c5ea", "comment": "Malware payload (IcedID)", "value": "389e04b9d4a4ed82a939649465a92b19b9be51801b2a16e5a1fa1d8afec8f93c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284779, "uuid": "5480df9a-5b67-4af2-8231-ffa4d6570a89", "comment": "Malware payload (IcedID)", "value": "0bc73fc9c91f10785d08ad3457c99f06353ba9dc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284779, "uuid": "90221424-f0ed-4e73-9354-0f9e8f11e707", "comment": "Malware payload (IcedID)", "value": "1dad036077198337add643c41427eaa6e75f02cc3f7894052beefb80de68f7f4b688cce3096094ddf3ddf743de57ded1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284779, "uuid": "1a854fbd-d090-4c39-a3fb-dbc1881aee5b", "value": "F6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284779, "uuid": "d1778313-455d-44fb-8d4c-eff603edb112", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284779, "uuid": "80543edb-f23a-4702-9a29-e2a071089b11", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284779, "uuid": "d0a4cd53-0719-40f0-812a-60c37661019b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284779, "uuid": "e614d148-65d9-4c35-84a5-aafec156fd10", "value": "document-1285757876.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1b8409-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278140, "uuid": "54768adc-dd0a-470d-a402-cd78d39c7969", "comment": "Malware payload (IcedID)", "value": "df59f3d31c46098ec70fafbb201638f4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278140, "uuid": "a9a40585-cbbe-4bfc-aa79-3a78a516c53b", "comment": "Malware payload (IcedID)", "value": "3914eee9a2b41bdafc634ef4926831db2f4b608c91420930ed345cc66b1c5e2d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278140, "uuid": "7f7f71c7-c056-48cf-af90-5547ef5b79eb", "comment": "Malware payload (IcedID)", "value": "93b5ec4646ecf257038dbdd50b7179a9fbeab98a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278140, "uuid": "cf77f84f-d244-4452-b3a8-13da68082185", "comment": "Malware payload (IcedID)", "value": "ad6cf29b38fb812ff15813d50c4c933684b9d1d7e4f29127a9cdb2bdb43728800b8738c8a1927e337a3052b795ba8e31", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278140, "uuid": "6b081ffe-d79f-4a61-832c-ee13dbd9433f", "value": "CF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278140, "uuid": "0688cb09-c69e-4709-a02a-8479a5177d2d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278140, "uuid": "33a74c3c-2230-4673-b973-2dc616a873e3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278140, "uuid": "221e7f41-1e6b-4ccc-bc9b-a3ccc22df5f8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278140, "uuid": "8d001390-32e9-4229-bd90-de71fc404191", "value": "document-1708987255.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b708754-9314-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617300228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300228, "uuid": "e8efa1c5-8c6b-4700-b843-2c215a2f0577", "comment": "Malware payload (IcedID)", "value": "55ae1a9f9b7437dd8f5d1e898994b9a2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300228, "uuid": "fb325dee-d773-4a41-b55b-659c15bab65d", "comment": "Malware payload (IcedID)", "value": "3934f99854464c6f8879a2addc1e5229c77e9f00abc56189bf081c99a88419e3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300228, "uuid": "77234288-c50d-438f-99ae-5ce3fd79e6a5", "comment": "Malware payload (IcedID)", "value": "ba3d7419ae6efe51b8edf090715b1ca37a9c6e73", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300228, "uuid": "df9962bd-c548-468c-948b-393d53fbf6b8", "comment": "Malware payload (IcedID)", "value": "25cd520c99d61804c89492b368d9c5453df873364aa677f99ce33018b9c1f92ec24910b3183c0ae31e093e4215cc01c7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300228, "uuid": "40050455-095d-4835-8801-83c420939f8a", "value": "AF04123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300228, "uuid": "6ada0206-02c3-4645-a448-cfa0c5738f0f", "value": "3072:dXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:hE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300228, "uuid": "9e0bfaa5-832d-4583-9ee0-f21a9aaf994c", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300228, "uuid": "1a9390f4-1352-4ba3-9458-20e2246965e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300228, "uuid": "08faea60-01ac-41ce-b909-7ef875ad0380", "value": "9513130898-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfeffe8a-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617262091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262091, "uuid": "037d4b48-6120-4767-b636-7669a62bc691", "comment": "Malware payload (Formbook)", "value": "4433891ceb43012d0f10b3a9c672aed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262091, "uuid": "6324eac0-f45e-45d3-9e5a-77c623d8c839", "comment": "Malware payload (Formbook)", "value": "39673d6fd51aeaedf60429480dc615144baf0dbd65704dc40825942e60e82be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262091, "uuid": "d0147596-3e96-4578-aec8-e3a564e9921e", "comment": "Malware payload (Formbook)", "value": "1e38bc91626d06aa6f0951bded6e2f2c3ad6db29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262091, "uuid": "3e06e70e-76d0-405d-adea-433ee2970806", "comment": "Malware payload (Formbook)", "value": "2f6fdc35c679d02f757468ae441500c9d38b557abc190465630257f296b129b534d48e67856bc7e2b37d557ded7535c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262091, "uuid": "6af60a97-87cd-4465-a522-03b54569ddaf", "value": "A7E4692337477BAEDE7847B62452450033F06E36E6AAD50CAC54324D5F7B6C08BEE662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262091, "uuid": "64efa377-47fc-4f59-ac6c-c87a345e5931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262091, "uuid": "583e3f71-a6a4-4645-b297-adda691fdef4", "value": "12288:0sz8DZkjkFBfu8EHpJfIBMmiG2Hr/Nm95t8pLskvNfWcvF:0ekDYJwMrHDYLULsKHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262091, "uuid": "549f5888-5c96-48a7-a60e-edf24671447f", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262091, "uuid": "7927b07b-7aa2-47b0-b2dd-8124905bad62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262091, "uuid": "bf83581a-eecc-42c6-af76-bf9c8e58c5c6", "value": "YMvYmQQyCz4gkqA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5127d223-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292372, "uuid": "e07c1cdd-5bfa-458a-935b-41a6a029ef5d", "comment": "Malware payload (IcedID)", "value": "e4c925c8f2f8cfcdcbcf4df96cb5e8ad", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292372, "uuid": "c04064b5-22b0-486f-ab4a-e3c989202552", "comment": "Malware payload (IcedID)", "value": "39be7c4edeb04e9641c743396b8b2d7b52688dc4319e815c93c7ab9388e3d201", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292372, "uuid": "3764a964-ce57-4b87-a58a-1728a276f7f6", "comment": "Malware payload (IcedID)", "value": "3b1c563ff3d42fccdad489597b33395e50f30007", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292372, "uuid": "145c7146-f56a-4851-83e9-10e9c4871dc2", "comment": "Malware payload (IcedID)", "value": "228c8736ad504ff04437723cd1b121cf08f7346be1ef7d4bba9033f361c14c7e58cebe9d140e1e7e179cfa0c50bc89b9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292372, "uuid": "71c7678d-f928-4269-a69a-0cde08321325", "value": "76838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292372, "uuid": "9aa43900-e51b-4431-8188-dedca26851a6", "value": "1536:IB240XZfcaaxf+EQliU2hawVHCAIoo8+BNvMhfvSL:+2d1cBWEQXMVH9o8+nEhHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292372, "uuid": "0c274691-a6e9-4290-9b4c-71a9dac4a0af", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292372, "uuid": "2ee153f3-3a51-4077-9805-0eadd2b90481", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292372, "uuid": "7db2bf5f-5862-4e6b-822d-fcc533c0891a", "value": "2053.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648bca9a-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279090, "uuid": "89a0267c-2f92-4688-9ef2-ea499e64e43e", "comment": "Malware payload (IcedID)", "value": "7a28fa84ffa1a77c3b020145e8c590c7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279090, "uuid": "96405856-1b16-452d-9358-a6d7d68b4f8e", "comment": "Malware payload (IcedID)", "value": "39ccf5f4fbffb92cd5024cffa0b1324588681b44a6ed1ea9246f18a1cdfa46c8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279090, "uuid": "a660b512-24d8-4e64-9ced-38ce1b74467c", "comment": "Malware payload (IcedID)", "value": "1c8b7acc1a2d873ba218b8f3156acf87ab635ed1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279090, "uuid": "b07c7c4d-d5d8-4e83-af97-fbd13b8654e7", "comment": "Malware payload (IcedID)", "value": "847643066ec19d1c8ae281552a902e63e657a9af9e6ab3cc64749345f0578523393c935fdabe37c5c0bc26a41f9c0ae1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279090, "uuid": "ba3b36b3-a54c-4485-9f88-f6f35a8b162c", "value": "06044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279090, "uuid": "73f103c9-5e84-44bb-974e-6200f01d17e3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279090, "uuid": "d3440c08-5ca7-482b-a355-a472f5013c9e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279090, "uuid": "588c23d0-5f24-4be2-bc2c-a118f5b078c3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279090, "uuid": "890c8316-cadb-49b7-9d69-a7d2e1e14131", "value": "document-634752715.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7e74f9-9290-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617243538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243538, "uuid": "bef250ae-3e6c-4b7c-955b-f6ef8af1c926", "comment": "Malware payload (Dridex)", "value": "7ec994f32bcfb841a26dbc855a80ccf6", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243538, "uuid": "69d74bb5-819d-4cf7-ab42-f2a93d2806d1", "comment": "Malware payload (Dridex)", "value": "39dec3601ada3ff7c2a8a25597c8eeb8892edf00fa040c3518da570ad39a561c", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243538, "uuid": "093c960e-ca36-4048-b052-d4121f3d89e1", "comment": "Malware payload (Dridex)", "value": "276de1b9e369364b647f756c0d4bf3c1d9d2be13", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243538, "uuid": "b390e03c-9054-484c-9830-5ab81f4947f8", "comment": "Malware payload (Dridex)", "value": "24af4b8427fb54df0a5a4247e21541fadd0df19971304c1c59675749b8fdc442d8b24df3aeffbea884e6d1fcfa1bb682", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243538, "uuid": "30ce0de6-f651-4406-9a42-179b8b6be53e", "value": "A784D143ABD54472F6721F3804739B104BEFBDD64E308DAA6289211D2F673C196787AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243538, "uuid": "bc263d87-f629-4fe4-b6bd-ab5f4a1921e4", "value": "61ef004a8c2946a166c67bb888b0e53e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243538, "uuid": "214b6c7c-60d7-435e-8f3d-2b6c5b1c7af1", "value": "6144:pOhxWpCcRexubjJ/WNQoGuBF4CEejyK0nnTaftjWnFGLOk0zEj/LbOc+gpHU:pOKcubjNA5BFiTaFjaPcHOcjpHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617243538, "uuid": "41912000-10d6-4fa7-8304-ec2267d30ddc", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617243538, "uuid": "a27db70d-689a-420f-bca3-1881b6c1bad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243538, "uuid": "7c9b0bd6-2474-4231-b525-601b3db88b89", "value": "39dec3601ada3ff7c2a8a25597c8eeb8892edf00fa040c3518da570ad39a561c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6da30f-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278142, "uuid": "637c6131-09c0-42aa-83a8-81c6a82c9ddb", "comment": "Malware payload (IcedID)", "value": "319b9048ab3112722ab3dcd56a0c1a84", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278142, "uuid": "e4b5ac4a-5eb8-403d-a388-776814669ce6", "comment": "Malware payload (IcedID)", "value": "3a0ed5f9c31c92e3df89adadc1004519e71b189ecdd0b050d1d4336ab0c8723c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278142, "uuid": "29fe9dd4-7356-4550-a60a-8409f2b748f4", "comment": "Malware payload (IcedID)", "value": "2d0bf79fb2ac7bb7ee5797e7e136f692028fa376", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278142, "uuid": "e555710f-92d7-453e-b495-df255314b32e", "comment": "Malware payload (IcedID)", "value": "e2f63ffa23a83af5c78593d10cd127beb8a9886abf20b5bb754dfe640ee79b77ac9eed8bf37f10838a0338940057442c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278142, "uuid": "bf937b45-f39d-492f-ac06-10ec873f2e12", "value": "FE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278142, "uuid": "ef91de28-20e4-45bd-9961-146f8414e4d2", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278142, "uuid": "10bd2008-944c-4d59-94e2-e41900e996ec", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278142, "uuid": "a0b1a6f5-f91c-4c79-abf5-28108daa8a07", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278142, "uuid": "f10d0204-1793-4b29-9ec2-70207524b346", "value": "document-1905567573.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bf49c9-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282936, "uuid": "5e60df83-8af4-4828-95c7-6298a270be7a", "comment": "Malware payload (IcedID)", "value": "401ea15fb27cefbe4bacf9a499ac5854", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282936, "uuid": "18695568-c533-4f18-9475-fcec2aafac7f", "comment": "Malware payload (IcedID)", "value": "3a264a582626febf2700601faf5967d9a27f852766aab38137aa7b1784aee4c7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282936, "uuid": "3491a903-35d2-4f49-97d1-b1bb5e66de0d", "comment": "Malware payload (IcedID)", "value": "3637b3cd035ab0cdf4320f391221b95032692070", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282936, "uuid": "d0d8e009-e356-4371-bf7b-d8f96178b154", "comment": "Malware payload (IcedID)", "value": "aa043ff2eb1c8743d0ef5c9427d124acf0e84439a5084e8db18eddebcd1d4f65777ec02d399444ef7a7c62e71c0e478a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282936, "uuid": "c4e8d9ad-3160-4838-afef-780c304cf329", "value": "06044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282936, "uuid": "2c95c23f-6eab-46b9-80d7-a419cc6cb63f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282936, "uuid": "8df8cb76-ae35-46a9-8f35-1d3d3fb1aaa2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282936, "uuid": "5d8eb89e-305c-4cf5-8709-b7362f288588", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282936, "uuid": "ed8f3838-0532-4edc-9ba1-ec2c3ed78c36", "value": "document-1044655525.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf4721e-9290-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617243537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243537, "uuid": "edd9ecfb-26da-40d5-a2ef-12e32eb9c185", "comment": "Malware payload (Dridex)", "value": "dbd39771c73e1af0d99df90f4018bbc8", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243537, "uuid": "abbc0078-2589-4741-a16d-832d86cc3c36", "comment": "Malware payload (Dridex)", "value": "3a9c78c586e4961c4aec5ae72d07940d3233cd1f117be8e3676d0b710b88599a", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243537, "uuid": "5ed268e9-a07b-4448-a450-00ab522e6e30", "comment": "Malware payload (Dridex)", "value": "39202d625be5022aa0121fb1d6da85b9a01da794", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243537, "uuid": "15bf0d6a-7d92-4d22-a457-f583ee81f2f9", "comment": "Malware payload (Dridex)", "value": "a8aa4048fc0b7596a89648f0571bd3c036b03dec0ff54989c4e204d33ce944bbf4070d5b821b19e8f0e1daa344a488dd", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243537, "uuid": "45b1e10a-63f5-466c-a880-461fed15cde8", "value": "AB84D143ABD54472F6721F3804739B104BEFBDD64E308DAA6289211D2F673C196787AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243537, "uuid": "d3af48dc-63b7-4815-a421-2492e903c6f8", "value": "61ef004a8c2946a166c67bb888b0e53e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243537, "uuid": "f803a09c-ea2f-4be3-8d8a-b08d52dbc65e", "value": "6144:6OhxWpCcRexubjm/WNQoGuBF4CEejyK0nnTaftjWnFGLOk0zEj/LnOc+gpHU:6OKcubj4A5BFiTaFjaPczOcjpHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617243537, "uuid": "d53b7f87-4bc6-4833-9d97-7e96aa0ea218", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617243537, "uuid": "40991fbb-81ee-4b8c-b161-01cd7dea3ab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243537, "uuid": "c589a5d1-d32a-4aac-89fa-6f1cbe67e57e", "value": "3a9c78c586e4961c4aec5ae72d07940d3233cd1f117be8e3676d0b710b88599a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64c14c7-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617262021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262021, "uuid": "d657384e-0fcb-49da-9865-e82c1dc4882a", "comment": "Malware payload (Formbook)", "value": "227c8049f8c1c6b14339a25e61a3c8d5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262021, "uuid": "fec6deed-ca35-4aab-9785-02a02a6e5140", "comment": "Malware payload (Formbook)", "value": "3aa74a6a425bebffdeb283b97140fc13855f80621b773440885bec100b082869", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262021, "uuid": "1c10ce6a-18c1-4bf5-b320-b1410e93c420", "comment": "Malware payload (Formbook)", "value": "3ac7a242170e8356d04a0c6d04ca2195b7134e81", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262021, "uuid": "4eb959e9-ae1e-49ec-9ea5-c66ff17212b5", "comment": "Malware payload (Formbook)", "value": "f93bb905a8978ed7d464a7c43378393173133a2da707474b3b894067c94e51845c489f25eac59a7fcba20427214a769a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262021, "uuid": "10ad0d84-f7c7-4bde-8242-6fa3a2587713", "value": "0E457A2333877B5AD9B803740551458823F1AFA6F66BC30D7C68325D4F776C187AB6A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262021, "uuid": "00c3958c-2cd6-4105-8f2e-858e313a6166", "value": "12288:XNW8jkU9jY+ZlB93B6lLNVe5Nz5t37TeBPWs4LN+JZn:XQgY+ZlBQSlTfeBPWg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262021, "uuid": "8bb7d8f9-8202-42aa-93bc-b69a405c3aee", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262021, "uuid": "26d22815-fa8c-4fc5-ad58-e25d86c9404d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262021, "uuid": "5e5ac366-b91c-479a-9abe-c54706614de9", "value": "QUOTATION.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb943f37-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288282, "uuid": "bdff1bf7-83d3-4809-aa4c-e7cfe7edfe33", "comment": "Malware payload (IcedID)", "value": "4b8095b73738d9726b4a296e582e6258", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288282, "uuid": "a80b79bf-835c-4977-8f96-00d98cfac8a2", "comment": "Malware payload (IcedID)", "value": "3aaf3f7c57befb1401e1afb37138bfa1e4cee24dd2c7c873d8e05e0f8ce59e46", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288282, "uuid": "220a750f-7ec6-4624-98e3-9e6ae2eb53ed", "comment": "Malware payload (IcedID)", "value": "e757ffab827143eeabbb0044d68e15966d8d8bef", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288282, "uuid": "738b2f0a-e4a3-4c23-928c-ccb89987ed89", "comment": "Malware payload (IcedID)", "value": "daf6954024244ce1d34d92b56184bbfaf0de5162463646171cef74275cb8e39df8357094ebef0bb2ca84703e7c19df47", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288282, "uuid": "c5513048-0b9a-49a1-b74a-072498cf4100", "value": "E1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288282, "uuid": "1a1f39e8-a7ea-46e9-9c23-4fc7121cc059", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288282, "uuid": "63315a16-dff2-4394-b6a4-feaae29b82c3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288282, "uuid": "d12ee6c4-d305-4bb8-8afd-a7c797a8f25d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288282, "uuid": "ffc74ade-cab5-404c-a7b7-611c098af05f", "value": "document-1046528276.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a6bd55-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282474, "uuid": "7ea29b7c-6ab2-4464-957a-de2a3aa09188", "comment": "Malware payload (IcedID)", "value": "af838a0a6cba4fa505d53bc964e8d608", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282474, "uuid": "9afe264f-eae7-4ff9-bb0b-7b64b0b6e955", "comment": "Malware payload (IcedID)", "value": "3ac3940a36834c7bb91bc573f824c6895fe0db47a82d4fff10ec075800716ed3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282474, "uuid": "29f70d4a-3430-46c6-835e-105ded0925b2", "comment": "Malware payload (IcedID)", "value": "579ade23a31f0522b111ae6e2fe0e881f4e3954c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282474, "uuid": "acce150c-5045-4749-bbaf-27e952baa7b8", "comment": "Malware payload (IcedID)", "value": "5aa8844ba442ce1a2fc8c5d4ca505613cc889110ee2e1ef74ebb4c0945d023e10043c7a0a7e383abe6acd81020d52743", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282474, "uuid": "adae88f7-6c66-43d6-aa38-103db792f574", "value": "26044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282474, "uuid": "a2b82eec-0787-467c-99f4-d8dd5e578f5d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282474, "uuid": "aa63afee-5e8a-46ea-99b3-33e704388457", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282474, "uuid": "5a68b9d6-23ae-4e15-bc66-887adb75f310", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282474, "uuid": "0a36b106-6c19-45fb-a073-e0b280852219", "value": "document-1378087829.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2320d9c-9333-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617313553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313553, "uuid": "cfd61e6b-4a8d-4d23-8688-12a36fc86071", "comment": "Malware payload", "value": "dea482ea5681bdcefd064071bbe2792b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313553, "uuid": "c3cfa4d8-13cb-4f9f-a7c7-683295d2a1f3", "comment": "Malware payload", "value": "3add58f107ad5342d27c6ee70eb16fc54d91a0aa341205ace623e4b1f3738c4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313553, "uuid": "6194268e-301d-48b4-953f-ceaced626739", "comment": "Malware payload", "value": "374c0d6a41942901e066316ddfbb1444f00e72b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313553, "uuid": "90818515-cbbc-4318-a963-45da6bbc6229", "comment": "Malware payload", "value": "dcd9eba608ec89819353f4aeebd4d613f3e9fd4d513431f2d7e4e454da65ac2a1a87349b8031e0ce08f68a7895bc048f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313553, "uuid": "099d3ade-510a-4350-b654-626e76bfe791", "value": "CDF35B06ED515FEBC41FCD704229430616DD95EAA2E6733BB5BCDEACB26D28148E3C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313553, "uuid": "9ebcc2b6-a9de-4a01-9d9f-6026b9a8c9f3", "value": "3072:p2+GSQEsSlY20hFTCGyijGvQS76wYHw3z5qCQhuw:gKQEsSiFTZyie56wYHw3ziM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617313553, "uuid": "5d6c0a6c-48a3-44d8-86df-f52afb210e9e", "value": 161992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617313553, "uuid": "106b22c6-ac48-4a55-8518-f5701611cd75", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313553, "uuid": "6a61c2eb-cd6a-412d-be42-2ffdedc57a7d", "value": "dml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba29a852-92f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286535, "uuid": "97ff06a3-d5d6-48b2-9212-e6f12f44d116", "comment": "Malware payload (IcedID)", "value": "980733435072a6374eb95cad7b057655", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286535, "uuid": "b10f650c-159b-4fa7-907e-e48160e35bd4", "comment": "Malware payload (IcedID)", "value": "3aefcb06a5b3ad2fda3c9c206e546d0124e985941009c3cb08180772a6231224", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286535, "uuid": "e54b762e-2408-41bb-a3a9-7759f444635d", "comment": "Malware payload (IcedID)", "value": "b9ad9fe72ff292fc53aeec85836438c1f0020a6e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286535, "uuid": "ddbbc435-a964-43ee-82bb-5d480fff7fee", "comment": "Malware payload (IcedID)", "value": "5df96bdcae8ae40350248ffd30a1e6a411aa27345a8ca32a361af49c4bb0c8f2cd5e842c6b830a701f19892b61f1d41b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286535, "uuid": "bbbe4aa0-9c22-400d-a4bc-7fbddf693c41", "value": "C6838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E1D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286535, "uuid": "b4816f98-d516-40ed-91d1-30bd0714499a", "value": "1536:IB240XZfcaaxf+EQliU2hawqCAIoo8+BNvMhfvSh:+2d1cBWEQXMq9o8+nEhHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286535, "uuid": "9b920ab7-3361-4a93-86a4-4dd3f8082e42", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286535, "uuid": "bae1845b-fec2-4e22-87c7-3a5aa8417a1e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286535, "uuid": "abb0e0a5-bb76-45aa-b519-6c70a32e78e9", "value": "316.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27624f1c-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291443, "uuid": "79f40bf9-2921-4a58-ad51-a94023c6fba7", "comment": "Malware payload (IcedID)", "value": "c87298c0f259a84a85d5b75051fe8c83", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291443, "uuid": "bada2c52-664f-4e6b-9008-7ccf1a4fa88b", "comment": "Malware payload (IcedID)", "value": "3b2a5259679593bd302a5e067b969ba82c998d8dab51fa604c667fae0bde744d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291443, "uuid": "cc0f6576-b6ae-4d4c-b62e-b7b856f14aba", "comment": "Malware payload (IcedID)", "value": "95fe572c854883cf739ce904dcabf4732df72c6a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291443, "uuid": "77eb685d-923c-4af9-92b0-025f47b9347a", "comment": "Malware payload (IcedID)", "value": "92906284c74468dd93df03a6fbc9d6672ae657442cdd50f6991c225e6414a847f17a43f36916f99ed3b50c305ab7d0e7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291443, "uuid": "82ea996b-e761-4e16-bf9b-a96c4e30ed1c", "value": "86838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E1C42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291443, "uuid": "542dab49-8710-43bf-8146-dfbc5d2d55ee", "value": "1536:IB240XZfcaaxf+EQliU2hawzCAIoo8+BNvMhfvcTU:+2d1cBWEQXMz9o8+nEhHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291443, "uuid": "37377122-f7f4-49b9-b665-bb06688f34d5", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291443, "uuid": "b8a5f9c1-da18-4316-b1fd-e93534c26403", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291443, "uuid": "b341e927-5aa2-4ab1-afdd-a3fcc5a310e3", "value": "1057.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d3c4a1-9344-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617320727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320727, "uuid": "27c65ccd-12b5-4b1c-bf8c-4cf12b9374cb", "comment": "Malware payload", "value": "61639f301c4cdadfd6c4a696375bdc99", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320727, "uuid": "f0abc5b7-5ca4-4c84-ad46-607f2e425a4d", "comment": "Malware payload", "value": "3b6610abf7001660036c8527c7b5a799baf926e3ea61f8d3cd5b3bc017e61914", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320727, "uuid": "25b25b9b-0335-4824-8144-ffce8249bf38", "comment": "Malware payload", "value": "b74ec5208474d744b99c5e0e4bbcec800dca6f05", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320727, "uuid": "9f48d27c-72ab-40a7-ba2e-3eac81e558e4", "comment": "Malware payload", "value": "71846779d04229110d69c223e0f8f953ddc73e5670213f14753262898522fd04163fcdcef99346de85fef7fb78250210", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bahamut", "colour": "#2E562A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320727, "uuid": "83931b01-df1a-472f-b0d4-3ebec351194f", "value": "6EE4B146F66CD926ED10A07DCC16E9DC11A3BC80AE40FEF7B899771F10F4663E899852", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320727, "uuid": "8ec875ae-bc22-4897-8d50-5ca45f5ba0de", "value": "ab336ef1d7ce517241cd77e41b355ea2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320727, "uuid": "5c8378d7-94bd-421e-9aa1-1f805ad1acda", "value": "3072:UY3WXBv129XXS8WebyN3q8IWrMH3wjor2U:Uk9HSsGN3qRH3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617320727, "uuid": "081a7c2f-84f5-43df-8881-cef12fb83e92", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617320727, "uuid": "f2d0640f-10d8-4711-a85d-5170825f5bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320727, "uuid": "0f8ade12-f7e3-4df7-8f95-d32d03bebaaa", "value": "3b6610abf7001660036c8527c7b5a799baf926e3ea61f8d3cd5b3bc017e61914.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e75195-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617262017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262017, "uuid": "fdf6df45-7ce8-4917-b62c-e6913d9e6713", "comment": "Malware payload (Formbook)", "value": "bc08c5debb3419808915c16751835618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262017, "uuid": "4605cd9e-9d14-4a5a-baf9-1f604a2bf3ea", "comment": "Malware payload (Formbook)", "value": "3b70e4fc486e35f388db065ff8f187f55a820ccf8ce90f0e656ff55aaa0d5fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262017, "uuid": "2964ca4e-a919-4ff6-8cc1-aa738af3ca1d", "comment": "Malware payload (Formbook)", "value": "f08aa50d0dce7360feb4ed45be81f3987e2b8185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262017, "uuid": "60eb6ea6-6b26-49e1-9b8f-d617db955dca", "comment": "Malware payload (Formbook)", "value": "3e642ffc464beaf039a13d984c6248610560b03686981f9e9b52bee31f02f247b15ec0ccf5e23940712418641e473f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262017, "uuid": "114ffe9a-d267-4c1d-9992-2022806484a4", "value": "9D94BEF536E85B06F07EEBF86861100193F4A57E86E6D60D2D9810DE1872FB195A2F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262017, "uuid": "6b7e50bc-ef5e-4d36-bbc6-a201fd30ddd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262017, "uuid": "4bf84841-28c8-4dda-b82b-8c44ca7660e3", "value": "6144:3ZloV5YQI/jtxWM7beDFZm23tNGm1tFU7tqRRsWElGXdruo31q4RJ9kCA:3ZloV5bC/oztNGmmQ6DGluo31xcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262017, "uuid": "90958a86-5d90-4583-ba5d-5519039d9e9e", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262017, "uuid": "15e18b13-7a9f-4a40-ab75-62a6dcb98f49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262017, "uuid": "0c8c3e12-399b-47fb-8a12-3c67b3dfbb60", "value": "bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096ecd75-9339-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617315874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617315874, "uuid": "6d80c0ac-0a04-43f4-a79c-437993337d0d", "comment": "Malware payload (IcedID)", "value": "a3e105e94b7c0e69012b92ab0aa00067", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617315874, "uuid": "258e9b37-37ea-4a46-b768-c4c17de9e4fe", "comment": "Malware payload (IcedID)", "value": "3b8f0ee2c31e4344d12364aa7b5360ca283352c5f6020865ce8415f64b54277d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617315874, "uuid": "6a0d8da4-6104-40d2-8146-657a3e57aa21", "comment": "Malware payload (IcedID)", "value": "3c64f8b62f1d4358de537610702f3a873def7744", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617315874, "uuid": "2ac4f200-46cb-4d0e-abe9-dc5b6a01d4b6", "comment": "Malware payload (IcedID)", "value": "d008164b36e303d94c4a27509a22975a780f173c57c98133686b698ebfa069f145f651a21383485a44e5ade52f4deb14", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617315874, "uuid": "d77015f8-5ed8-4ae0-a00c-2ac34d3708dd", "value": "2F14F7935CCFB663D42F50F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617315874, "uuid": "de7946c3-bc7c-4cdc-b168-8bbb36354bbb", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617315874, "uuid": "f3bf5604-daa2-45a9-8b12-5ade10e67415", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617315874, "uuid": "6bb5e7ae-d438-400b-9d6d-1aaa9c0b711c", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617315874, "uuid": "a049532f-25a5-4f4b-a91d-247fb7727552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617315874, "uuid": "ab85cfc2-04bf-4165-a596-cb6d6b64fc7b", "value": "3b8f0ee2c31e4344d12364aa7b5360ca283352c5f6020.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c063afe-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617261842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261842, "uuid": "c79aebc5-4654-45e8-b8d6-058971e45f49", "comment": "Malware payload", "value": "7b17b1552bcacec5e94b32e10c0bd415", "object_relation": "md5", "Tag": [ { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261842, "uuid": "21d8e959-1aae-48d8-b69e-f350b2f6ef09", "comment": "Malware payload", "value": "3b9ed58b0257f47f063f185e5254ad039eeeb26aa86d6b193b4e4db309f82f63", "object_relation": "sha256", "Tag": [ { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261842, "uuid": "7f6a21f8-0bd2-4731-a6fe-311b317f38cc", "comment": "Malware payload", "value": "1724eef7975f41396e92cf6ba405c5e49a41f576", "object_relation": "sha1", "Tag": [ { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261842, "uuid": "5a331d17-256b-4bf6-a1b2-634fa7d6deba", "comment": "Malware payload", "value": "5a353886a2cfeb66c7f9bfb99c2393a9bfba9c4f8fa2ecab37420707d845bc487f633ed8b44126992aa707a216c4e658", "object_relation": "sha3-384", "Tag": [ { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261842, "uuid": "6bf15719-9725-48cf-a5be-34cf016590b3", "value": "9916334305EA2EE8D53416713A770FEDC7A43A824792D4AE7C8C61490BF918D7FA72C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261842, "uuid": "ab9a07fb-ab3d-4908-858c-f4d9b7a3a3b7", "value": "98304:XRHA3hfl5fjJFa4wPu/1Nf1QTGRhkfh4A1D27+:XRHA39J4Bu1Zch4427", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261842, "uuid": "db973f90-b556-4ebf-965c-94a564e4de60", "value": 4325376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261842, "uuid": "a985a714-edca-481a-be7f-debe1ee461ce", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261842, "uuid": "bc748faf-6874-48fa-a061-40205780b182", "value": "PO_4000010871_RFQ_PRS_1000024753_RM.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632806c2-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275652, "uuid": "d653189a-221d-4eb8-b103-102163894e41", "comment": "Malware payload (IcedID)", "value": "f99f667be20fe0625b7e847441bda552", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275652, "uuid": "1058ef2c-687b-473d-a018-327425bad7b2", "comment": "Malware payload (IcedID)", "value": "3b9ee81c9a7cca1f6ff12b74840dd26a3f34c78b034b10fb051f7244aa714233", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275652, "uuid": "cb095c0f-e72a-4f49-8e1e-996f251ee528", "comment": "Malware payload (IcedID)", "value": "92ccded8c453dcd2da714b71fe24f1fe101d5947", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275652, "uuid": "9427e78d-9778-45c6-a424-508fa98c4ee7", "comment": "Malware payload (IcedID)", "value": "eb3d2c8f28188c023ba711ceb50ae3e46a4de944b49210139883998b6a4b55ca659aee1d97aead2f26df9dd8e949ae8f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275652, "uuid": "97875b01-930d-4382-a586-5f4ea3ea2429", "value": "DE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275652, "uuid": "260bc792-ef8d-462f-835b-282dd2dd1710", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275652, "uuid": "613a2b00-453d-4d3d-a663-1304f0f70660", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275652, "uuid": "5cd24337-68ad-4b92-8a44-310d1f5a32b2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275652, "uuid": "0cf2713b-3ece-41cf-ae24-454024d2001a", "value": "document-1489979626.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af85c08-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282483, "uuid": "7001e74a-b1d5-427f-a7d3-84bc74cce41a", "comment": "Malware payload (IcedID)", "value": "1d361d57d9bb3c0e9fff513f8ad3860e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282483, "uuid": "b44a199a-fc34-4a0e-8b45-61aff412c1d2", "comment": "Malware payload (IcedID)", "value": "3bb37e859801877675041254fca04e5ee197d6676bc3c1ea58138f184872f649", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282483, "uuid": "6ab5334c-ede4-4261-b9c6-ed7e3857b6f1", "comment": "Malware payload (IcedID)", "value": "6644633486e5bfde6f556d1d279febbfa6b5d8b2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282483, "uuid": "610fb243-d9a2-4d9b-8425-68701db0d409", "comment": "Malware payload (IcedID)", "value": "569a246891ce84639018f67f07b1ee41645ffec50983909faf924b4e646de40497da23cafae0b812e44050ef91011ed0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282483, "uuid": "f12a6572-4b76-46f3-9a3a-a38888ad0631", "value": "B5044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282483, "uuid": "2161ffb3-b61c-45cc-9111-428e1a890c8e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282483, "uuid": "53ba9102-f8bd-41dd-bd7d-b94a2de106fb", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282483, "uuid": "40184516-b45e-487a-b377-752c94ecb221", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282483, "uuid": "9c7b37d2-1789-4ff5-b026-f16e247f302e", "value": "document-116291302.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c26902c-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287183, "uuid": "19b87a5b-b3c5-4094-9a3a-00cfd8ef01f0", "comment": "Malware payload (IcedID)", "value": "cb0ef593709d73e27b399175384d372d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287183, "uuid": "7cc2548f-4e85-4651-afed-dec5a256b32d", "comment": "Malware payload (IcedID)", "value": "3be39e09f570c068e55c32070569ccb2427366588235f7902455e42b24bbf412", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287183, "uuid": "63cfc819-2544-437b-ba1a-63023a1617e1", "comment": "Malware payload (IcedID)", "value": "2bf23fd7227b7125e3cbd4186c144a0726e06508", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287183, "uuid": "92fc877d-4580-4607-82e9-bd2b728b74b4", "comment": "Malware payload (IcedID)", "value": "34f9ea9524484453f582d3ed5e173c697a4ce6df1dbc2211fb4d25671fea62175991ce6a4fd51a129f2d8af62414db77", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287183, "uuid": "1979392d-f7ab-47b3-b737-806732da0cdb", "value": "66838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E4C42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287183, "uuid": "eb3a7de6-c46d-4c62-a02c-5ef06c441865", "value": "1536:IB240XZfcaaxf+EQliU2hawrCAIoo8+BNvMhfvjk:+2d1cBWEQXMr9o8+nEhHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287183, "uuid": "ed24b7ee-b312-4762-b04f-3772e1ab8b63", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287183, "uuid": "4243a34e-2324-45af-807e-92e949dd43d5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287183, "uuid": "00f93c8d-4043-495d-9baa-682218981fc3", "value": "2540.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31549d90-92c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617267837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267837, "uuid": "62c297d9-71ca-43d6-8021-c2566c9b1e7e", "comment": "Malware payload (SnakeKeylogger)", "value": "79aa48690e356a9aa34d8d21cb0044a0", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267837, "uuid": "4486543e-33e4-481c-a746-e311890caba8", "comment": "Malware payload (SnakeKeylogger)", "value": "3be3bd524aeaa9d4310a9b2a4c48d75c412e02be67067cb0670b63d4fd6f160a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267837, "uuid": "abca59a2-8198-4266-9a97-01fc58435cae", "comment": "Malware payload (SnakeKeylogger)", "value": "7552aefaab05bbd16e94a544630fd160ff36288a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267837, "uuid": "9e34c090-d3a0-4d3b-ae7e-862b88423a28", "comment": "Malware payload (SnakeKeylogger)", "value": "33d1acb5acf155f86d071aae572e71421f07cea362b051675ff8b63ec362c331cd576780912742794a7e6fb6c4b3accf", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267837, "uuid": "478e6e20-d932-4fc8-8225-87476564fa54", "value": "A13517DC9D48C0D6D83A4BB455DAC4A506AB2EF78B62C47DFAC897D3C232341A157E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267837, "uuid": "3aa65fe7-f6e7-46b7-b3ee-9aa78e5a15a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267837, "uuid": "8709b74f-49d8-469f-bc0f-21704387b5bc", "value": "12288:TvShp7euqGDjt53w2QwU9QQb4gu28PSHm8PUOFYnw8LD44iXsI:TvShp7Zxq26QQHuNS/UOFfmc42s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617267837, "uuid": "ff59ba90-a8a4-4472-ba30-c4f0f2b99bcf", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617267837, "uuid": "95aa1537-5856-423b-9d02-2d022d508e61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267837, "uuid": "57ee34e0-f9bd-4be9-a921-1dafa512b6fd", "value": "RFQ- 29012021-756455460 xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55f48ad-9281-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617237162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617237162, "uuid": "5219fcba-7253-4d59-91df-05d9bb1779e8", "comment": "Malware payload (Dridex)", "value": "425ef2cc17ebdfe357a90d7529bc7461", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617237162, "uuid": "935dfbae-de26-450f-8e41-8dd3984ba533", "comment": "Malware payload (Dridex)", "value": "3be84cf2ac4256398533967d610b748cbce3ea64b40e4742eead64a46d8a5726", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617237162, "uuid": "29dc9cbb-f7bc-4599-8149-a25437ab85b9", "comment": "Malware payload (Dridex)", "value": "38b9c366adc02c4166fdc3687b67a3c37677a6df", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617237162, "uuid": "6955ffce-523d-467b-aec3-277ab3894f40", "comment": "Malware payload (Dridex)", "value": "a2c854ce3f871e1997f37ad1ce91a6b08cd4a054526dc57816b23d92d4c877251f3261a4dcb83b657ddbb048fa13ff36", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617237162, "uuid": "ba95bb49-f64a-4b83-a74b-0c3452b14c2f", "value": "71248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617237162, "uuid": "b98f71c8-fb78-4b25-83d2-4c21311997f3", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617237162, "uuid": "f8a54269-8ae2-46be-a8c5-a45ee4bdf82a", "value": "3072:h6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:hoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617237162, "uuid": "d716a035-1e84-45b1-b6da-a5a5299d66b4", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617237162, "uuid": "17be25dd-f61f-49a6-865d-a5786f6324ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617237162, "uuid": "b0187922-5849-41ad-b5be-12c8af0e4c09", "value": "3be84cf2ac4256398533967d610b748cbce3ea64b40e4742eead64a46d8a5726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65342d0d-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279950, "uuid": "cef93705-525d-4587-92ad-3b6399ee8eae", "comment": "Malware payload (IcedID)", "value": "9d01bcc28ae463749a441584a09d457d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279950, "uuid": "177ec300-34c4-4ca1-baea-06528bc9a8a9", "comment": "Malware payload (IcedID)", "value": "3c2e213de8f19af98864f37b13d5f44656192efcff8524b362b03d894bdcbdfb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279950, "uuid": "58d8593a-a329-466d-ad59-523fb5fcaed7", "comment": "Malware payload (IcedID)", "value": "3ea279428b6ba4b557f17094a27bff4405cb7b89", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279950, "uuid": "76316186-2bd8-4097-8a43-084b99b52b46", "comment": "Malware payload (IcedID)", "value": "f0f08c1b2e13f87fbfd8812a0040c88a14ec4828351446723b137a641e64f53768af1078e48024b6760fe625fb94ec40", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279950, "uuid": "f30d0578-64a8-463d-8e11-f9cb3766c5f3", "value": "B9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279950, "uuid": "d5480135-e5e2-4f0e-9eb3-15be64cd4a6b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279950, "uuid": "eacc2371-3d11-4396-9228-8f406e94bbc7", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279950, "uuid": "1683d551-d444-4852-9340-888005843b72", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279950, "uuid": "20fe09bb-2bae-4de0-ab90-705853234182", "value": "document-2135448346.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa13c1e5-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (404Keylogger)", "timestamp": 1617261732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261732, "uuid": "0990cd43-f914-42a7-9003-4cd19e8b5041", "comment": "Malware payload (404Keylogger)", "value": "b075bd472bb9cc0649f87f74cfa2ae7d", "object_relation": "md5", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261732, "uuid": "57641f75-ee2e-4fe3-a2cd-dc9eb06c5a8e", "comment": "Malware payload (404Keylogger)", "value": "3c80e1dcbdca8a93fbb85ff13b20dc0ef5d587c513150dc47d396c518e1694da", "object_relation": "sha256", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261732, "uuid": "e16d4117-24d7-4fdb-bc74-d1a3e0210b37", "comment": "Malware payload (404Keylogger)", "value": "e28acb48eebb92aac6c77f5ccb26202089d63975", "object_relation": "sha1", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261732, "uuid": "27823f27-62ca-4609-b4ac-c63ab1657c38", "comment": "Malware payload (404Keylogger)", "value": "c5290ba4fd7bfb81e7c0a4d786b274400846353d793e25c93d1cb868253981e03ec6fadcbb771a9b811c20c3443a1318", "object_relation": "sha3-384", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261732, "uuid": "06f0f9b5-a176-4465-88ae-38aa55f9a194", "value": "14C4372737477BAEDD7953B62452410033B16D36EB6AD10DAC68734C0F7B6C08BAE662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261732, "uuid": "915bf9c6-14be-4db6-b808-a470c3da5a7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261732, "uuid": "e5913575-603a-45cd-8f55-fa32b6d90e0d", "value": "12288:RPjC8X+j5MbTxnWTrg055QAEaGZcI2+f:RPg5MxWXg0zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261732, "uuid": "2d0822f2-722f-4730-a534-b17ae04c6411", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261732, "uuid": "2312ab93-7f5d-4d37-9677-8b7ecdc4a463", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261732, "uuid": "c61fd6a4-e4a2-4d41-80f9-ac5046922266", "value": "RFQ-PO-8372929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9507e0ad-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275306, "uuid": "f864dd4e-26e4-48d3-916a-3b939bd9ff8d", "comment": "Malware payload (IcedID)", "value": "ee0e3026390e2d7edcb71efca8510dcd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275306, "uuid": "d75041d5-981f-45c4-a4ca-48616aa43a9e", "comment": "Malware payload (IcedID)", "value": "3c8640f756e404225c4e658aed831a5829e495f68ef36655bbd7f0db743f5c9e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275306, "uuid": "d8310865-9ca4-465f-82c5-e0b566a0f92b", "comment": "Malware payload (IcedID)", "value": "d4fd1e194e192248929aa0fa76052716ea0adf2e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275306, "uuid": "92229836-971d-4007-aa6f-8226923f0d3d", "comment": "Malware payload (IcedID)", "value": "2f97c01d630938e1ca92d8cede36958f73144ead61f62830e957ecc215f03620c10b73b4e6caf437e1d531c5d105ce12", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275306, "uuid": "b354989a-56fa-42f5-99fc-77a686606cae", "value": "02044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275306, "uuid": "cc26bc8e-cc0a-408c-ac30-1785c4975071", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275306, "uuid": "a7c15789-0bd1-4a09-b4d3-873fe1b83fdc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275306, "uuid": "5649f799-19ac-4369-8a6a-ec0d0d2c7106", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275306, "uuid": "53bde791-3532-4aa2-9cea-dd519687d22a", "value": "document-223294552.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23db9f4a-9323-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617306469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617306469, "uuid": "fce8701b-dff3-4bab-bddf-25ccdddd3ab9", "comment": "Malware payload (Dridex)", "value": "b1889af3e1ea19e36e1c706316eb6d25", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617306469, "uuid": "33f3e98e-f00c-46e1-9adb-cc7ef765cc44", "comment": "Malware payload (Dridex)", "value": "3cbf0dc3818825fe5a7bf65cb49e59ca105bfb7de612284a81c3ff6aa7239cdd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617306469, "uuid": "9f1de745-5632-4828-ad48-d0eb36081341", "comment": "Malware payload (Dridex)", "value": "6bcd5d097fea8a675b0aa370d9458dc1accc4de6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617306469, "uuid": "a9ab6174-a313-4ec0-abac-6700985f5ac1", "comment": "Malware payload (Dridex)", "value": "52e92f462db274338f22266049414489543784074057dc168ced37f65b50db88ece713b62e937c023f62c31fc14e6aa1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617306469, "uuid": "47a96c03-53fd-4e39-963f-9f020cf4cc96", "value": "3F14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617306469, "uuid": "875a5e17-1212-45a1-ae0b-e511fd4217cc", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617306469, "uuid": "1a74912d-5873-4f6e-b9c5-428bda823083", "value": "3072:51i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:bi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617306469, "uuid": "8485d7cb-7251-402a-85f2-588daf6f0270", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617306469, "uuid": "295659ca-0314-429c-a91e-41fab16ea1c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617306469, "uuid": "cb4e36a3-c9f5-4843-a957-12af872753a4", "value": "3cbf0dc3818825fe5a7bf65cb49e59ca105bfb7de612284a81c3ff6aa7239cdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f2ed82-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287253, "uuid": "4cc4d0bf-ce8f-43d9-9bba-14b993a5098e", "comment": "Malware payload (IcedID)", "value": "dc75c9ffc282c87f13a6927909e8e90e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287253, "uuid": "b044b72e-a71d-4183-98f9-ee7b9f3a6c06", "comment": "Malware payload (IcedID)", "value": "3d190bc33612054a4181f79a7edcbcc13f2a7d0339e729dec2dbdf884d255422", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287253, "uuid": "ee91384d-3ba4-4c1b-99c7-0a714e073886", "comment": "Malware payload (IcedID)", "value": "6e7fda5150f13c89682b98beb198e5a57f80daf8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287253, "uuid": "570bc6be-866d-4ca9-8557-f8ecb7bc1d80", "comment": "Malware payload (IcedID)", "value": "6709e10dfeaf6dbd11811b624a69bc249f86db135748a57647aaf1f293cf620a6033c84e4761737a0549129831a3cb80", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287253, "uuid": "abdb6b84-61bf-41e9-aa18-ece32d105cb9", "value": "7A838DCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EAA2E0D42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287253, "uuid": "0838c955-04e9-48ca-b357-2f79fa95eb71", "value": "1536:IB240XZfcaaxf+EQliU2hawycnCAIoo8+BNvMhfv4ym:+2d1cBWEQXMLn9o8+nEhHlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287253, "uuid": "ad243473-e426-4a7d-9d78-123b46eae77d", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287253, "uuid": "5ce200a6-f64f-4568-81ab-31d3886b8f5c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287253, "uuid": "eb65f8d8-24df-45e0-a872-e21c35ee258d", "value": "1765.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1898f93-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1617299003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299003, "uuid": "e051cb98-0a09-4a33-af25-bcd029d455f4", "comment": "Malware payload (BazaLoader)", "value": "d2749c21fa8671e75cd147380ff110e0", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299003, "uuid": "908df693-658b-4390-824e-103edd3fe579", "comment": "Malware payload (BazaLoader)", "value": "3dbab512123a36954684474e9a9f5502aa9edf0228a4df8f0cb33e328890d33b", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299003, "uuid": "a30ed6cc-0ca1-4210-90c7-bc4d2a303081", "comment": "Malware payload (BazaLoader)", "value": "2797fa0bcb834e4d52c068d266ada43f315ca59e", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299003, "uuid": "6062b5e8-6f9a-45df-a646-a5ac0d91bfee", "comment": "Malware payload (BazaLoader)", "value": "e45b1738ab267f8606860ef3e17e5aceec733acd00b140f5d392800db98fea3428364028fd674e00aa9f47a3da4aa7ee", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299003, "uuid": "c6b88c62-6902-4e1b-8d75-cfc366ad315f", "value": "8F84E14792A631E8E1A29A3590641D0CD771FC352725DF6F474832D1AF776A08E3EF22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299003, "uuid": "e8ace2b8-e6e1-4666-9e83-297fdc5cd2a5", "value": "2de0725e4eedc6f70b07cc6f3c2e3b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299003, "uuid": "5ce073e2-9bad-42eb-9fb0-99c9f4f0c796", "value": "6144:BABatTx4LuLbY0xtTZrLRcBDrh15kk5XvI9eNtlhzQKOR64sWkxfkEW5sX2Lg:qc4utt95cBX8ejWT9kvW5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617299003, "uuid": "27168a78-cda7-4dd3-b436-95b433e0830e", "value": 376320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617299003, "uuid": "b32ea332-c25d-4720-bdc4-c9480faa43ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299003, "uuid": "f018ad86-f195-4449-a571-900dde7d737e", "value": "d2749c21fa8671e75cd147380ff110e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f002c9e-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279054, "uuid": "5ac9e16d-1c93-40d7-ae23-643569ed8dcc", "comment": "Malware payload (IcedID)", "value": "0f0dd06d622fd3c3ed4cabf61eccad62", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279054, "uuid": "ab311232-5843-4b21-862b-6c6651e4e0e5", "comment": "Malware payload (IcedID)", "value": "3dbf024000d7c72c778c7f4be966f771550dcdabde7dfc18f897457905c3434b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279054, "uuid": "55b7591e-9701-4c15-90a6-e0ed464e159d", "comment": "Malware payload (IcedID)", "value": "c26ac625706f52b7712267580e611ac8093f6bb3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279054, "uuid": "b9ecd16c-c39f-4661-9cd7-d4bee6967f95", "comment": "Malware payload (IcedID)", "value": "b57050cf55dc874021689b8f7142aa7ece428c179047ea5cbe86ab68e8f7eea3ee3a753eaae685df7733c05826e86e88", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279054, "uuid": "54dd6973-139b-4541-9b17-486503e4435a", "value": "01044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279054, "uuid": "27db57ad-9ac7-4a4d-8d01-deb7d2002659", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279054, "uuid": "36c17c42-6e48-4645-abb8-f248cf25f88d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279054, "uuid": "3026cd09-aab8-44f3-aeb6-0c23a87edeed", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279054, "uuid": "21db3131-5b0a-4de3-8ac2-c91a268c6448", "value": "document-201554587.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99797da8-9290-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617243531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243531, "uuid": "1b998026-8ddb-411e-9741-59fb08896ada", "comment": "Malware payload (Dridex)", "value": "70b5774c6e670c26ce07edf6a3ae688f", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243531, "uuid": "ad7b7c31-eca5-44af-acf9-c71f43b8816c", "comment": "Malware payload (Dridex)", "value": "3ddb6d9dde6a6d38745c271e6ff4b6c045beabafa2fe9a607ac7b183a51cb9cf", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243531, "uuid": "daedc2e2-c26c-4af9-bc70-6babd92d1474", "comment": "Malware payload (Dridex)", "value": "cac242f19221cf5425539ba5a2f27ab01b13b0da", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243531, "uuid": "265555b1-347c-4ce5-a2cd-f363508f7eec", "comment": "Malware payload (Dridex)", "value": "1865a2d3cd3030fe91e31c090bec2acde8d58df58dc31f99f38e63e86af225f23b768559c0fd114544957d2c9a7c2c58", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243531, "uuid": "f48425f8-bd60-4877-9ec8-95b1048b10ae", "value": "CC84D143ABD54472F6721F3804739B104BEFBDD64E308DAA6289211D2F673C196787AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243531, "uuid": "105d6c99-ad86-4942-b7da-a2db530fbf44", "value": "61ef004a8c2946a166c67bb888b0e53e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243531, "uuid": "897f07da-a7df-4998-9096-688ac9698600", "value": "6144:TOhxWpCcRexubjC/WNQoGuBF4CEejyK0nnTaftjWnFGLOk0zEj/LHOc+gpHU:TOKcubjEA5BFiTaFjaPcDOcjpHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617243531, "uuid": "7e56e892-ef33-4ac3-be25-0bde3d70a7ad", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617243531, "uuid": "648cf53f-1c63-4808-8b9f-7a55634e151a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243531, "uuid": "95daa849-efbc-426f-9cad-4024bf5a5d55", "value": "3ddb6d9dde6a6d38745c271e6ff4b6c045beabafa2fe9a607ac7b183a51cb9cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e5da9d-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284787, "uuid": "4406b933-cbc7-498d-8bc6-abe297b0d5cf", "comment": "Malware payload (IcedID)", "value": "d17b7159bfd147dcc0397388a0b8f514", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284787, "uuid": "88e4b0f0-a3cf-4487-a7c0-227384b9f550", "comment": "Malware payload (IcedID)", "value": "3e06d410111adacb9cefa75377391e213ebe53bf5b18298922e37f239b898c7e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284787, "uuid": "0003d83c-4938-4978-af9d-902d3c3df9e4", "comment": "Malware payload (IcedID)", "value": "de4c593a3652ae6540bce1c93ec5d8b68ae2cd07", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284787, "uuid": "666068c5-02df-4be7-8eef-f974b22db19d", "comment": "Malware payload (IcedID)", "value": "1d24b6cbeedc22c46babef6a166a3ced59156ba68cfededf703a6eec24a216a8677b3d75a22583e528b4e048fd31ab5a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284787, "uuid": "660f8edc-1ab9-411b-bd81-4e6bfabb9b0e", "value": "E3044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284787, "uuid": "ec6660f1-d1d3-4d86-a9a7-8a102d639ec5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284787, "uuid": "63f50961-c4c1-4a13-ad72-f94e5654444d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284787, "uuid": "c4fc480b-00be-405f-8864-a9ced858b989", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284787, "uuid": "caf97622-7c3f-4619-8ac6-e9ab7b0b5386", "value": "document-142045729.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dec3b8-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284322, "uuid": "03dbde6a-927f-4a10-b2a8-d4a7d4ae75f6", "comment": "Malware payload (IcedID)", "value": "22e6475d50424ee0705adfec8e465192", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284322, "uuid": "45545b6c-55f9-4ffc-a49e-75c1900b4624", "comment": "Malware payload (IcedID)", "value": "3e25a67396801eb65b62d0325b559f910f50079e5c0e1efddfc240c9357dc55b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284322, "uuid": "127c04dc-ee11-4adc-9100-77b82ed98150", "comment": "Malware payload (IcedID)", "value": "501207be44f25887ac3abdd57f94cf0cdb5df656", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284322, "uuid": "b46adad9-2b13-41bf-a95d-17525edd924c", "comment": "Malware payload (IcedID)", "value": "183dcc5df03191601ed6e2782516ee4684d0cebda5bf5419619b8eb8b9ebe6c0ade736c2a866ef15d1ed1b4c9098808f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284322, "uuid": "8294f4d9-e057-42d5-bb0b-7b6b8d0114d4", "value": "B5044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284322, "uuid": "4594aab6-d9f6-4d51-8e09-bbfe6eeff38b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284322, "uuid": "2c959559-4b9d-452d-8046-1e480004db50", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284322, "uuid": "da51c19d-f283-4e93-9a31-6c904038bf50", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284322, "uuid": "88c9c5ef-ae0a-4f2d-91e8-1bcf62d402e2", "value": "document-200128782.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4ba50b-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282485, "uuid": "5b5b546e-530d-4b9b-a58b-903f7f17b888", "comment": "Malware payload (IcedID)", "value": "87c2ddcf058b8ef601fd85f40fe7365f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282485, "uuid": "de2b5f4c-68a3-4ade-9a1b-95f57f3ffd1e", "comment": "Malware payload (IcedID)", "value": "3e3928534e51d53e230e436b0ff2e15d6fb4ec22894ff2a7b67ad28c8df0683d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282485, "uuid": "892b926e-d9f4-4021-8d4b-3c41f88773ea", "comment": "Malware payload (IcedID)", "value": "eaaf34f3faded269c9fac4b890ce99739d77b134", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282485, "uuid": "c8bead82-e3b2-438c-a1e0-cd6e33a7a128", "comment": "Malware payload (IcedID)", "value": "64be6e5471a847aab62d4bfd7d0d9b28aba888033a4e80fdf2e8a0bd2e5e98fa6d8604f9a951b6de3c37b13a89e6dcf0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282485, "uuid": "a61f4df6-0b9f-47f3-865f-3c117dce725c", "value": "B9044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282485, "uuid": "083e1904-4748-4f34-874f-804216aea345", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282485, "uuid": "cbd05b17-f55d-4612-856c-85b13d5ce55b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282485, "uuid": "3762e019-3686-42e7-8ced-03e02a26ee3c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282485, "uuid": "b3f7212a-51a1-4944-87dd-ca1b13369331", "value": "document-1609666552.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38a3958-9331-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617312723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617312723, "uuid": "86de2924-9ebc-4cf9-b012-e5446178f52a", "comment": "Malware payload", "value": "11648b5a13ea91f0afb0b0fd3ac6e1de", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Vsingle", "colour": "#A1E2ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617312723, "uuid": "c628b37f-c7e0-4e25-8b60-f80b240f0cc1", "comment": "Malware payload", "value": "3e6fcd919f52706a501c704bcb96474e5947044d73b857d035400344f6306e7e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Vsingle", "colour": "#A1E2ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617312723, "uuid": "a9bbe515-c66f-4039-ab9b-87818e63a412", "comment": "Malware payload", "value": "bce43ed8bd69c2bcc6f781c789cec5af7993d51b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Vsingle", "colour": "#A1E2ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617312723, "uuid": "1b0c76fd-795e-4510-841a-627a081d12cd", "comment": "Malware payload", "value": "1c3eab47d1bdb943543287eb34370e342d753df4cb902308fa68b718e642f67d2692e78cda90e994703753948ed499ff", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "Vsingle", "colour": "#A1E2ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617312723, "uuid": "56b33ee8-f314-4cf2-a0f1-7438be124675", "value": "C5248C11B580C031D5B3943147798726997C79302BBC5AEFF7D82A7A2FB41E1B631A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617312723, "uuid": "e8e476bf-6f1b-48c4-958f-f2b39f562db9", "value": "5f65d5c7362d53eecff709f8dbfc69e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617312723, "uuid": "15642b92-8b95-4a48-ba34-5e252f8315e2", "value": "3072:68M9vybJYDAMfCVsJofoTwHDfvnJbga8oX+qUafTxjAakrkAWzVMi8rPVSxL5:xM92JYDAMfusJeoTwHDZb3X+4T71R15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617312723, "uuid": "ea1ce28a-95a3-44c4-9466-ce46356a946d", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617312723, "uuid": "7b4c3fae-d3f4-43c6-b757-235ed706c1c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617312723, "uuid": "aaa087c7-88f9-4d05-9865-d903d54caa98", "value": "VSingle.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f98057-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279896, "uuid": "abdfe033-65a9-4ac5-92d7-ced350990ec8", "comment": "Malware payload (IcedID)", "value": "7d7111f1084bc5c1a9dd95798a0d73e6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279896, "uuid": "2366c7a6-a523-402d-ab0f-153e933475f7", "comment": "Malware payload (IcedID)", "value": "3e7b5ce20d145f3018c5533d828d9185d30c56373a273cbe4c6404f57c0d1ff4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279896, "uuid": "d2bec4f7-ba12-4cca-ab1a-3359df95d84f", "comment": "Malware payload (IcedID)", "value": "9bf7524ea2421017179ac5163c93b288568e9156", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279896, "uuid": "9f743675-edc8-4f6f-b1d6-d2dedf97a441", "comment": "Malware payload (IcedID)", "value": "e844ed5324da47666d2539e9438b65bb237f332f017aa517f4110daa3c6cad85447eac791fee25e8fda2503aa3d7d8f3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279896, "uuid": "c66e664e-0f07-4b2a-8421-a1b8624fc7c8", "value": "7F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279896, "uuid": "d9f78272-fe7d-447c-ad1c-d5369499ea60", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279896, "uuid": "fbebdc38-59b9-4bdc-b052-cfb63d501563", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279896, "uuid": "c095b024-fd72-4082-aab1-aa5d7fb25c3a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279896, "uuid": "07326ac1-87f9-4ab1-b3a8-7922673bace6", "value": "document-1376447212.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6248a84-928b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617241512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241512, "uuid": "be66d582-afef-4c41-9935-dd3b49ce35d0", "comment": "Malware payload", "value": "5a0834f9f79dc93efc65c8f795eb23fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241512, "uuid": "62a9c0a1-b033-4d60-b45c-baa02b985587", "comment": "Malware payload", "value": "3e87b3e2c809d75e4e820ae6af88e44f29461540928d3b2dbb9b6de1af2418d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241512, "uuid": "6d83fbea-df2f-4a87-a40c-0bb73e63efb9", "comment": "Malware payload", "value": "8325d77b53e6d97569e0fdfd00d13a9dbfde5f66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241512, "uuid": "55ffdf9a-bad6-41a4-b2ff-45998edd73c7", "comment": "Malware payload", "value": "9c0bc1036b3cd0661e05b89607906c44a3e889c1a63b98f74c026ca13f22044ca6b8326bb550ac104237e9105ecad03d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241512, "uuid": "e575e78b-b29c-4063-a4cc-e8aeb4cd8c06", "value": "99B3B76A2B129FE7F198C3314FB746B063A827E73690D285E36CD7881E3119D185FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241512, "uuid": "b6c00110-0fe4-4b80-9e62-4353e03a1af4", "value": "1536:YQeuM+3w1FxdZgTCOBh2mrJIUc0F8qkwzMqqU+tV2a:Y7uMF6Bv2mrL82MqqDrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617241512, "uuid": "6a3d3be4-ffd7-4542-a5c0-2a7815447da6", "value": 113868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617241512, "uuid": "b5a20d66-a3ec-446e-9eb3-45b2fc57188e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241512, "uuid": "12d963f6-2686-4d4b-96d3-a9c348bea844", "value": "dmex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425e5369-9289-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617240378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240378, "uuid": "77e30371-38fb-4c2e-a42e-f8c1d2efc3a2", "comment": "Malware payload (Dridex)", "value": "a3224099356f79de73a952682e5201c3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240378, "uuid": "45a0d6e2-48f8-45aa-9446-1b8a9c15e5fb", "comment": "Malware payload (Dridex)", "value": "3ec91af9ea43e7e8042025f9bc8b326cd04ab8a55f1f39ac2155d11caa57519e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240378, "uuid": "8581e1fc-0455-4609-a5f8-a3a9258d702e", "comment": "Malware payload (Dridex)", "value": "249a06cb265832f3b6715bbee3e72510925f03e4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617240378, "uuid": "d5fc9f20-691d-4fa1-9911-76082b6a6af9", "comment": "Malware payload (Dridex)", "value": "b912bfc89590241a4f7adbdbd707e66b8ecd865b0bd7ad77d32c1952a16d828d20356b290d4638aa41793d368dd2945d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240378, "uuid": "9527fab8-1550-4c6b-b5e6-a64759da7c86", "value": "B714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240378, "uuid": "8ebf4e07-e8d0-46c5-93e7-392d2c225530", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240378, "uuid": "7301c6fa-c180-4cc9-96d8-76becce4bdc5", "value": "3072:Aopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:npjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617240378, "uuid": "65e0b7bc-49b7-4804-a2d8-3f7a3b3f1043", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617240378, "uuid": "f3765a5f-ba81-424d-b4fa-d25f4c3dd3de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617240378, "uuid": "d3f4a382-d9ba-44ea-b957-ed92e23c6f50", "value": "3ec91af9ea43e7e8042025f9bc8b326cd04ab8a55f1f39ac2155d11caa57519e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370cc1d0-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617261834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261834, "uuid": "b8f5ccb8-f15b-4af3-b187-6b02636296eb", "comment": "Malware payload (AgentTesla)", "value": "0b2fb8e1ce2faee33ecc4eb8d73df00d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261834, "uuid": "6d1a15cf-aaf0-47e7-85ad-20872c692eff", "comment": "Malware payload (AgentTesla)", "value": "3ecf636a0d0d09987d861f3b470250742e1a37775d550e29cca275b4959bd9af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261834, "uuid": "0a3dd0e9-071f-4b06-8ce6-1a06fed5f671", "comment": "Malware payload (AgentTesla)", "value": "7b9df50b52ffb715b30d280e24c0320dd47fd821", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261834, "uuid": "2ce0a0d3-db0e-44ed-8be5-0e4bb2256596", "comment": "Malware payload (AgentTesla)", "value": "c21ecbeaa20453845c0e03812fa6e05203913aad9833a45a217a5f94c3c9557135b62bfffd15e81b4aded1c9b4c0593c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261834, "uuid": "0973e046-054b-4d20-8f1d-b412fee8e537", "value": "0503C55C32D0C198E43EFE7AEED9F95653BD9361280246CA2D84672A4D41781CBE23B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261834, "uuid": "385a5cf6-60be-4042-8c18-e586d2d5f95b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261834, "uuid": "6b69947b-afe3-4e00-ad1b-c762225e8ad0", "value": "768:YUMMn8sFp8zKlDp4CxZTaGflqF48o5ytWnTJ0rZjD0I3thLugrq6Hk7ilVwsigQa:YjrsFpVlllxGF48o5ytWnTJ0rZjD0I3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261834, "uuid": "bdbeccfb-3646-49dc-81e2-bf0f19cc9346", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261834, "uuid": "af87eb39-89e9-45e0-b26c-dbe829fef7a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261834, "uuid": "36a4fba2-0cdb-44e6-b3a6-9e886b7c4aab", "value": "kelvin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703d334f-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274385, "uuid": "584698a1-ff69-4390-99de-ecdf8db0d134", "comment": "Malware payload (IcedID)", "value": "67c64d5662ea8a085f2b8e1f2c6ebd9a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274385, "uuid": "4a38b335-7d21-4526-bbcd-0085d8e29c63", "comment": "Malware payload (IcedID)", "value": "3ed2cf3bf4d23cd3bcea0c27bc2cf3a6c66adff6a969178bd7d7ee190d6bae3c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274385, "uuid": "14f6f444-7206-4613-92c9-000ee35b5ed2", "comment": "Malware payload (IcedID)", "value": "f484aa88454f520227099769c16488a705077fe7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274385, "uuid": "4ff7c516-1b3f-4a79-80ac-1ed8b3674045", "comment": "Malware payload (IcedID)", "value": "2b7f3cd0bf31b00a212ca2a7edc8e21812faeec374bb93b3bfe39630c04b38f14ad801de33aa955d46ff81024cb07e8e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274385, "uuid": "68f1deb5-7bf5-4e4b-ba75-16c8b678feb1", "value": "24044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274385, "uuid": "fc70e9d8-ee89-4cfa-9789-bd6ecdb53c1d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274385, "uuid": "6612d174-c8c0-4362-8797-d6e38c163ac7", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274385, "uuid": "5f56ba3e-df5c-40f8-9a2d-eede0e464402", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274385, "uuid": "5a0bd334-d910-403a-aedf-37f0cd181348", "value": "document-88237788.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0530fa3c-930a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295681, "uuid": "e8d2cdd7-7956-4884-9d2e-d6af9cfb3fbf", "comment": "Malware payload (IcedID)", "value": "0ac18fc032bed21d880846b744c0e1d0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295681, "uuid": "801a7a57-76e3-4e15-b2ee-b50376693f05", "comment": "Malware payload (IcedID)", "value": "3ee0589ee438a32136a56fe1b1374e0b4cf1c5042dd00f0cab89302af065f415", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295681, "uuid": "d9dc9053-33ad-4cfe-afef-63139cd93005", "comment": "Malware payload (IcedID)", "value": "1a0e243b6c0b00c8a620bb80c031f2ee7f891869", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295681, "uuid": "82647082-2dcf-4ff8-8896-e82d9e21766c", "comment": "Malware payload (IcedID)", "value": "98523c77a65554440b17b4297323f9ba9cd92cc7b255b634d4b63b604f6309ffb1a12151b9fff3fd8294ff36d020fd27", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295681, "uuid": "bcdf2561-2642-40aa-9f7b-6e99eea84986", "value": "4F838CCDC913E1DAC2559FBD5A09308112F4E0B7276FF11B148EA62E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295681, "uuid": "68792eaa-9127-42bc-88df-ac502bc60964", "value": "1536:IB240XZfcaaxf+EQliU2hawrCAIoo8+BNvMhfv/y:+2d1cBWEQXMr9o8+nEhHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295681, "uuid": "65392fe9-7ed0-4aa5-a8aa-3d4695bc0468", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295681, "uuid": "c6367a8d-1630-44e0-a411-46ba067b9dd9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295681, "uuid": "18f05bfe-ad52-469a-b1c4-0ed00deab755", "value": "2116.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bace7428-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283530, "uuid": "4c4b1049-1460-4627-9f6e-942e5f53513f", "comment": "Malware payload (IcedID)", "value": "891dbf908198aa1c04f1994b813b5e54", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283530, "uuid": "f8b269fc-24f5-4deb-9d08-2eeafead344b", "comment": "Malware payload (IcedID)", "value": "3f059214d52177b5a9783cdb55301afafd2d80404941638007e1674ccc3ccdb8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283530, "uuid": "5d6bbeac-bd18-4a5f-9df9-880ce4b1d883", "comment": "Malware payload (IcedID)", "value": "349d4ea13b114b16f56446d0e17b43dba58c2673", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283530, "uuid": "4860df43-9ae5-4511-b160-5a2af6dd1c20", "comment": "Malware payload (IcedID)", "value": "9caf26da136c7d99a446a8cbb50e1649ab2514cbc60e39118e89d97f7196edd91506e7990e5317a7606e91eb3d57d258", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283530, "uuid": "ee99cdc3-4ce9-471a-963f-224f43a626b4", "value": "6B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283530, "uuid": "415fe87e-18f6-4a85-8b57-a379a2e6c763", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283530, "uuid": "b96de498-5fed-471c-b447-8a32b5082263", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283530, "uuid": "6012c1ff-8b1c-4e84-a38d-7f05cd419c01", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283530, "uuid": "7eedaf06-22bf-4612-8a84-5740680e9731", "value": "document-219212267.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e11e6f-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285877, "uuid": "b859da3a-7d7e-476a-9232-0080022d3461", "comment": "Malware payload (IcedID)", "value": "900ad2a046376d78b48f0124742a7c75", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285877, "uuid": "4d579e0d-e9a7-479d-8266-6a3b0d204adc", "comment": "Malware payload (IcedID)", "value": "3f1304a114e37dbdc4e89a830d0b52784e3c21679642c7b7ad0ee67535b2c47c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285877, "uuid": "6cfe3ca1-ed5e-40d0-b31c-23ee34321e44", "comment": "Malware payload (IcedID)", "value": "593ddc4e7a1abef50365465518043114c8caf839", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285877, "uuid": "bf5bac0c-f60f-4466-a84b-5f55615ed62c", "comment": "Malware payload (IcedID)", "value": "6989d04d684147059c32cafc289d6a3d2fdbc8f6c8dfa5e9b0939e42f67cbbd3b9711e968388a363f0b16b2e1623e714", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285877, "uuid": "a04e617d-e2d7-4418-8960-56c3534102b7", "value": "4A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285877, "uuid": "ff71a1df-6023-41a3-9d67-4c3651e34dd7", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285877, "uuid": "4b473c09-74eb-436c-b5b9-e5b676bf5cd5", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285877, "uuid": "fcc58cb8-ef15-4452-a4f5-73f61b519044", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285877, "uuid": "39f9a9ab-48c5-42e7-84ab-68552b1abcf6", "value": "document-1153014194.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b948ffa8-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280950, "uuid": "dd9ef38e-69e8-42e2-ba65-e029a8f2f986", "comment": "Malware payload (IcedID)", "value": "7537cbd625f965ac06b3108b01db2a19", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280950, "uuid": "d686c0d3-ec24-42ed-b723-0da6962f7d00", "comment": "Malware payload (IcedID)", "value": "3f42e5ac2b0c856fa00dc4b80c4dc39e234ad6f50eb781d6b37702e6d88ae961", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280950, "uuid": "36ed296c-aec1-47cb-8f76-b48653900219", "comment": "Malware payload (IcedID)", "value": "2b3bada88dc914e906991e100fbd0140cc9a563c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280950, "uuid": "f5186dfa-92f8-433f-9c8e-e4c95d301bb7", "comment": "Malware payload (IcedID)", "value": "59fdc23a3623e86f1d245b9a576894d61eaddb75052f82132923b76f2c92293171d624fc81a2f9e4e37c112379686934", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280950, "uuid": "8313a463-29b6-4ce8-ad15-e9fd97ce3995", "value": "96044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280950, "uuid": "30cda927-a8b3-4a38-8b48-c5c243bc7dfb", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280950, "uuid": "66137a61-f6ae-4e2a-975a-081fb7fea996", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280950, "uuid": "4d3c9900-a038-4307-8ea7-563666ae4145", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280950, "uuid": "7790fbd9-f448-4c9c-9aab-16f29b4ce8d3", "value": "document-2006800774.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b824b26e-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277512, "uuid": "9089b58d-acfd-4270-9d1f-f4a2545624bf", "comment": "Malware payload (IcedID)", "value": "5fc85bd6763ad278c3d1d632f40bcfdf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277512, "uuid": "498162ff-b406-4b03-8ea7-33f175bd1dfb", "comment": "Malware payload (IcedID)", "value": "3f55513bb97265a41a4756b87bb06e64ed904251527434428b556eeba14e5ba5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277512, "uuid": "aa7439de-9fe5-4958-b2b5-24769dbb3d04", "comment": "Malware payload (IcedID)", "value": "2f09de92568c9ab985cba5ec99ea09f909623a5e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277512, "uuid": "d195c3e3-7d84-42c8-a06d-ec62989f8e72", "comment": "Malware payload (IcedID)", "value": "849b0aefe96593d133be618113379f0dc1dd3687180f9612fe66492bb95c7ed9cab8f82a202dfbc1feb44bcc22a362e3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277512, "uuid": "14749507-32ae-47a9-b05b-54c0fa0b8ea5", "value": "05044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277512, "uuid": "fa048624-3dc2-4077-977a-4ebd52808e1c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277512, "uuid": "96dcaf95-7f68-4096-ab18-f76f7709b81f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277512, "uuid": "a83ac2e1-c7b4-4fce-a2df-f40366a2c496", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277512, "uuid": "0d6e7281-1858-46fd-9d1e-e4dbda036da4", "value": "document-1033390287.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11ea025-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617288721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288721, "uuid": "fe49976a-04db-4744-ae90-9895a062ae16", "comment": "Malware payload (Dridex)", "value": "fda632fcbc60dc96c6080e169fef4f3b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288721, "uuid": "3c4e1829-1de2-4d13-b36f-8321d4a954ea", "comment": "Malware payload (Dridex)", "value": "3f6d1a1cb96a282e13b403cc99112683cadf0eea6a7695b64d48055c0f1408f9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288721, "uuid": "455b9392-dcd6-4668-99db-c4f88f724b22", "comment": "Malware payload (Dridex)", "value": "fb2ba68a0bcda0bec9fc6d4b0973d377d07cf56e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288721, "uuid": "7567421b-15cf-463c-8cb3-d145dfe745ef", "comment": "Malware payload (Dridex)", "value": "8b4255a4d39b1b1759364d7938c8e351b7890d1da4a01f3249d0839c405db5ffaf8dea1b1936e7a477960bbe7215864e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288721, "uuid": "5822beff-05df-4666-9561-3cb621936a8c", "value": "F714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288721, "uuid": "8332506e-d6ba-4d3f-9e8e-b3adcf65c3bc", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288721, "uuid": "350e545e-433e-4275-b03e-0341ae3256d3", "value": "3072:hopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:2pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288721, "uuid": "4ab2509f-3127-453f-9df7-fef04a755a25", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288721, "uuid": "ab8aea1e-c768-45bd-81f3-bcb8bb4c0d6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288721, "uuid": "5c430492-4760-4dcf-a9bb-fa21894411d9", "value": "3f6d1a1cb96a282e13b403cc99112683cadf0eea6a7695b64d48055c0f1408f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05661a5-9305-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293928, "uuid": "29d7b71d-8dbd-41ab-872f-4a782936aa61", "comment": "Malware payload (IcedID)", "value": "2cbe71ffc3bc87782de76e5be3504aa5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293928, "uuid": "a48e510a-f8a7-425d-9eb5-bc450bcf7f2a", "comment": "Malware payload (IcedID)", "value": "3f7636a10472c31958bc7c761f8823392fc405472ec2e4948ea23c632553b362", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293928, "uuid": "664374e1-ee94-4c37-a464-e4684de5e652", "comment": "Malware payload (IcedID)", "value": "df73bbe8346d71ce1b776d6e764761c7cb7e7605", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293928, "uuid": "85113418-5cd5-415f-8e39-2e2be164c0c9", "comment": "Malware payload (IcedID)", "value": "4a08fa42e1353640b784c391ee8ab68acb2d016f592b80921371cfb7716555b816950b7f59ce0f1858083d8a63877173", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293928, "uuid": "2e44e94c-d78c-4b1d-85b6-4a6a2ee87c8a", "value": "90838CCDC913E1D9C2559FBD5A09308112F4E0B7276FF11B148EAA2E4D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293928, "uuid": "790e378f-023e-4b66-af58-cd22c4139fdd", "value": "1536:IB240XZfcaaxf+EQliU2hawgCAIoo8+BNvMhfvq4:+2d1cBWEQXMg9o8+nEhHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293928, "uuid": "8e7e9ee5-4128-47d5-b371-d7429228a457", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293928, "uuid": "d56c2658-f25d-46f8-86ab-badb23bc2e8f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293928, "uuid": "74436ce0-c5f2-4943-bffc-7581b3d9896b", "value": "2836.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e301ecd9-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617261693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261693, "uuid": "8dec0ff7-8a87-41b1-86a3-fc9759b6af31", "comment": "Malware payload (AgentTesla)", "value": "58a6d9f7f659313a455a500f67e673cd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261693, "uuid": "792dbad7-bc03-42ea-9a69-6eb393bc0dca", "comment": "Malware payload (AgentTesla)", "value": "3f7e202c5cff52997bed1b9e3261df0f38183ae1c78eacd7bd1d9cde81c90375", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261693, "uuid": "efd60a96-d56d-4c6f-b8b0-557d0d11f82d", "comment": "Malware payload (AgentTesla)", "value": "51e0bfd4a3dc32e032ef064ac97015940e7618c5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261693, "uuid": "3f572975-8eaa-46f5-8199-99a3298d83f3", "comment": "Malware payload (AgentTesla)", "value": "4e7b9bd4ddf6f135d884b5563ba4d6c714afa7cc4d7a64ff26635883ae39efd2b995f89be59f1c3164a5db7ae0a9e8c7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261693, "uuid": "b786ee28-27d3-4272-b0f9-5bffb1ca0198", "value": "3BA423DD2A2CC5526E630F2289CCEF59592C07B4EFE0DC90EA41B3B69D7185994FC06E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261693, "uuid": "8693c41d-fcc4-4523-b1f2-4a9d1593c2b8", "value": "12288:+BogYOGI7oxOv1ALTZbznElWg1/TSpiz1nT9v50C:+BogYTMokvoZbzOWghSpeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261693, "uuid": "6283c790-f508-4cdf-80d5-c0dc6f7f5c43", "value": 461669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261693, "uuid": "aa55f5f2-c9e4-4fdd-af3a-1167710b15c7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261693, "uuid": "f79ae5e8-fb14-4649-9d6c-177f64b4b739", "value": "New Order 1-4-2021_PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c57159-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617282931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282931, "uuid": "70010bc3-33bb-4d60-be1a-d981fd97d173", "comment": "Malware payload", "value": "8f73c08a9660691143661bf7332c3c27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282931, "uuid": "27f4e7e9-730e-447a-9a74-4f89857d883a", "comment": "Malware payload", "value": "3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282931, "uuid": "e6c54058-95d7-4468-b48d-df83439ce2e2", "comment": "Malware payload", "value": "37fa65dd737c50fda710fdbde89e51374d0c204a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282931, "uuid": "4d116baa-e4ee-449d-820e-e0a1be41fb5c", "comment": "Malware payload", "value": "fdb980dd0bb256306fe9d37cf59e92b29c2736856d78a27e965336486a75f0c09e8c628c4d1561f9f25bf628d6d9c188", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282931, "uuid": "0587f639-4043-4c7e-b018-f4f41b1f8ee5", "value": "06D39D13B284503AC653133EA9AD765897FE7D31876A02C36B1C95D40BB83E1F93978B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282931, "uuid": "5aad83d4-6cdd-4184-946a-51231d64c8a7", "value": "cd277fcaef27e2c4552601c33d459467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282931, "uuid": "95487c5e-a759-4f55-b1ee-2bb4083ecc18", "value": "3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282931, "uuid": "d6ca5678-0c83-4201-9002-f6e210898290", "value": 137168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282931, "uuid": "d12754ff-d5f7-457a-813b-8fd27b66c8c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282931, "uuid": "42638f3d-70f9-4854-a081-3ea1196be141", "value": "3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9582c358-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276595, "uuid": "4a08da8b-f191-4d99-bfde-808ab08c2df4", "comment": "Malware payload (IcedID)", "value": "c991415823b41aa1726be8fb20b06d9b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276595, "uuid": "88c5229d-bfee-46e3-b32f-1795098773f5", "comment": "Malware payload (IcedID)", "value": "4012b5787b1da1021ba3f8fd37410e31cd343b7a51d11e0a27371ebd73d66542", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276595, "uuid": "9718593b-fa07-4e94-b951-a70f29b28c24", "comment": "Malware payload (IcedID)", "value": "97072bdf5bffb574f92f09982edbed95a5ec52ca", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276595, "uuid": "9200cb1a-8d5e-4964-80b5-fb919405e00f", "comment": "Malware payload (IcedID)", "value": "f6ffdc400e6ec8cbae68bbe6bc64f2564d4561fd20fd1e7ce01fbf0426c60cb9beaae53e787ec7610c7487650732eede", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276595, "uuid": "703e5dac-8da3-4f38-9848-a05df26b38ef", "value": "75044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276595, "uuid": "9a841fe1-28ab-4f34-91e4-660a5c64cec5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276595, "uuid": "2a691a8c-326b-4297-941f-b487de4d1eb6", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276595, "uuid": "31eaec85-b7c4-4042-b89f-0edea7117e60", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276595, "uuid": "14e3e50a-2372-4555-b061-d6fd07871fd1", "value": "document-2092014574.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e957a2-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274390, "uuid": "b1ea747c-9fb8-4bf0-bf9e-ab1f8453820d", "comment": "Malware payload (IcedID)", "value": "8b41aa8bef1227f244c8ed2e89a80ed5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274390, "uuid": "1175a1bc-c155-428f-867a-2a81b8f78f3c", "comment": "Malware payload (IcedID)", "value": "404f80d237799fe6ce9d0ba129302280deceef6c75cce57861162f8054fc3dd9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274390, "uuid": "fb1b3652-9193-4fa8-aafa-b71c4d017230", "comment": "Malware payload (IcedID)", "value": "dc195f91673b18ef201788adc56c3ef49f7f2f6b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274390, "uuid": "c99973e1-0747-479e-8d38-23730fc2c454", "comment": "Malware payload (IcedID)", "value": "bf5035957a4f6713e5e73513d09411a3e341e0c430076c989f879a77fca118acfa3a788b5a86581cfe2344a8ca30183d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274390, "uuid": "5e33ccb7-0f0c-4ca6-8a27-37357d8fa76e", "value": "87044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274390, "uuid": "a8aed418-5f87-4ef1-8fff-996262d9b696", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274390, "uuid": "da17b96e-974d-4bb2-8ce5-e8e16a58508b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274390, "uuid": "fc6b2961-f520-4335-96a8-3bfe8d74b90d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274390, "uuid": "2450e01d-4a10-490f-af58-c2e57d28df7b", "value": "document-1754292343.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbdba88-930c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617296608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296608, "uuid": "a99ff13f-52af-41d6-9521-122050694b07", "comment": "Malware payload", "value": "946a444c46b1e672e4eb35725993e1de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296608, "uuid": "d185d4c2-5cd0-479b-a4e8-ac8656d3f144", "comment": "Malware payload", "value": "40879e36f47835c7af7d4e54d844469e5a1f58fda44027a9005ca61bf33d4a6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296608, "uuid": "ca669cdc-5052-4e72-8872-4402fa224783", "comment": "Malware payload", "value": "12482793a22afbf1835887d0368ca0dc363f1ae7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296608, "uuid": "cfbe2db2-09f8-443b-a3fb-954ceb06407e", "comment": "Malware payload", "value": "139cac89a03742838bcea680041d41c48285d59b973ac00b280b19442b24bff3d31ef1147e6b5b54064820b087fdb98b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296608, "uuid": "d9e2e465-8cef-4703-8992-c936a8717487", "value": "B2E30BA2F310EBF2E97586B51F010AAC01977C7057151A4BF1DA360D2AF2BDCE56878B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296608, "uuid": "cb5c4309-4a79-4416-9a52-548da19ae248", "value": "1536:uE3YNgd2V1trE261H7R/F7ogTI+ri7KJWUv691OGPmahFGo6LcsoWFM1SR5MS:uE3bEE2YHd6gU+SrJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617296608, "uuid": "bfd15067-76e1-4a0b-9b65-cd1952d81d6d", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617296608, "uuid": "e52e520d-dbdb-4360-8be3-42f454ae12c2", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296608, "uuid": "2d2dafa9-c2dd-4ad1-b5ec-cbea179a6705", "value": "ot.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ed3a51-92d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617273747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273747, "uuid": "25d97f1a-e2f4-4e3d-a33b-0e0a43714e46", "comment": "Malware payload (IcedID)", "value": "91efff60f932880c1d81f274f827a158", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273747, "uuid": "5281a0d8-d7d5-4b4d-a9d0-afec4fd3da7e", "comment": "Malware payload (IcedID)", "value": "408db16b0e9b1184e493ed4dfbdfe03ad7b24f44e61331e6121518a36d3f4b46", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273747, "uuid": "8c421344-4aaa-460c-a664-4db555271ebe", "comment": "Malware payload (IcedID)", "value": "a66164b562939f977ce4a389c52b6c4a442a384e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273747, "uuid": "6b9f3823-3bcc-41b2-bb58-049fcca3d347", "comment": "Malware payload (IcedID)", "value": "4ec3baec17e246d403f1a4c6ebeaa351ac73f42ba50418266fa048d8c9981a6ff9e4b745ad0881175cb1c92ea9928487", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273747, "uuid": "4564e2db-2588-4477-a267-a289944dfcf0", "value": "2B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273747, "uuid": "3785c2b5-852d-45a0-8ade-dd5e85d0787f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617273747, "uuid": "e69c2f33-00b5-4fc5-835d-48cc85bbe69c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617273747, "uuid": "0d9670fc-a8c3-4615-bf45-88686c183eed", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273747, "uuid": "e4f7fd53-6302-4bba-927b-21e126c4f0a2", "value": "document-1156658733.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8def4e3-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617294720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294720, "uuid": "54cd5d49-1d5a-4ee2-b824-21601c321e6a", "comment": "Malware payload (IcedID)", "value": "244b742dcfc2000e3819fa2a0fbcbe2f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294720, "uuid": "7624a96b-9df3-4f28-b6e8-04b440bcc4fd", "comment": "Malware payload (IcedID)", "value": "409d584f4a4a9b084eadf6172ce99b9512fa8ed4c8789bfc6bdee832e5008981", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294720, "uuid": "b14dce3e-50ed-4d0a-9963-14073cf80e1e", "comment": "Malware payload (IcedID)", "value": "169ef8f3640c58c185991552453fb7010ed50bea", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294720, "uuid": "c20fb8e9-fdfd-497d-be25-8553fb63d285", "comment": "Malware payload (IcedID)", "value": "4d16a36f2190a7d09918d343ef10b0885806da39efad158c7824b595503d3e92e2d91e9ba88f726305f8a7ac2267ebe5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294720, "uuid": "e368b125-6476-4162-99bc-bf90853ea993", "value": "C2838DCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EA62E0D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294720, "uuid": "0f5544f6-e537-4ec1-aa92-0f9169cedbaa", "value": "1536:IB240XZfcaaxf+EQliU2hawkCAIoo8+BNvMhfvI:+2d1cBWEQXMk9o8+nEhHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294720, "uuid": "077c0a51-0782-4085-834e-0698fecc20c4", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294720, "uuid": "57b7a2dd-8ca2-40d2-b202-51b2419883f5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294720, "uuid": "5946e52f-425c-480b-92ef-46f4b6a2423b", "value": "54.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c5dbd5-92ae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617256409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256409, "uuid": "b469f020-9084-4e9a-8267-fffc6d6dd1a6", "comment": "Malware payload (Formbook)", "value": "684193a9d92069975a12088b7fbb61ff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256409, "uuid": "511eba8d-7408-4466-ac06-391d50e11f8d", "comment": "Malware payload (Formbook)", "value": "415a90f921c64a6d394a47ee7d485799e52372f43fb44038d1a8b618c5505689", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256409, "uuid": "5fe8e08b-9f25-4e19-bc16-5f7d277ea157", "comment": "Malware payload (Formbook)", "value": "cae886e78bb14f5c08a7a30a40bc002764d8eb27", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256409, "uuid": "299b87b5-8061-4cbc-a401-18010fca5d0d", "comment": "Malware payload (Formbook)", "value": "675635ab4844441e8648f1042bda859c6f6296638a7c0b128272facdaf2b88f644b5cb4f8a5a05d028b9e03687a27cfa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256409, "uuid": "9dfb65b6-8e7c-4d3f-b02d-80ba202bcd19", "value": "6D84230B61401B22A5C6E575695C4DE2ABE7EF7E8D46FF4315DEB2F890361E08E2CC24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256409, "uuid": "f2f14003-c2a7-41bc-9f81-cbe899590f89", "value": "12288:ecJslyQpcsdTV4iJ2/DrA/dqTjiPcobOCTpz6jjwp0gCprFLXJr:ecJslyQPdmz/DrsqTePcoi6z6vXrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256409, "uuid": "6603114e-923d-45a3-99e6-be1f9824f116", "value": 396731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256409, "uuid": "343114cc-4076-4bda-8d15-48d7bfc00891", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256409, "uuid": "78fd17e3-f66e-41cb-9a3c-ee36071e3bc4", "value": "PO _ETPO.21.0430.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ec1e58-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283540, "uuid": "530a3891-1bb2-41ea-9074-5473f22993ef", "comment": "Malware payload (IcedID)", "value": "47b313b40e4fe0d44fad9b6b7f0ead92", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283540, "uuid": "fbffff71-ef8b-4c17-a586-d61b820f2348", "comment": "Malware payload (IcedID)", "value": "419f944d50464c84ab4aa895b39a9b3ad1827805beb352fb0a51812dc109d186", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283540, "uuid": "64480121-45a1-4ab5-a622-639c76093c29", "comment": "Malware payload (IcedID)", "value": "15a4106c53a5ae0b2bf3c66a3b513595cb22055b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283540, "uuid": "3488fffc-fca6-46a3-bc71-495d78f7713d", "comment": "Malware payload (IcedID)", "value": "752455fe93886f864a378b7652ac8c0d871afc2e4df9dc827735a9a3b93e990c17550fcc3b0f8dce1f7ff930286ac83e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283540, "uuid": "b7228ad0-3e9a-450c-a06b-7d41a278b6b5", "value": "01044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283540, "uuid": "a46ce666-cded-42f0-8a93-9bb9177eacbe", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283540, "uuid": "b2043020-4306-48c1-9277-9eb8b8b1c03f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283540, "uuid": "984a3c9d-8ebf-4937-b5a3-3bbb426d5932", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283540, "uuid": "74fd0dd2-39d1-4d92-85c0-64dfa2b6f2b2", "value": "document-468326463.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0850bb3b-9281-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617236845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617236845, "uuid": "87d20604-ec32-4b16-83da-4711972b0619", "comment": "Malware payload (RedLineStealer)", "value": "98c452f8557d0ed0dfc4749141741cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617236845, "uuid": "35f741a0-da94-4816-954c-85315d231b95", "comment": "Malware payload (RedLineStealer)", "value": "41bd1c7a896dade70b5e81588a20f0737f30c8ec164990f4da3f788dc843d7d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617236845, "uuid": "be2a6cb9-2763-4521-b8ca-c668c8106fce", "comment": "Malware payload (RedLineStealer)", "value": "b58efcd64c1904431ba94adbbd4e83559f9bef08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617236845, "uuid": "fa4852b6-4e7d-43b2-8812-be4197b8e500", "comment": "Malware payload (RedLineStealer)", "value": "8e3c098f5ab7c94872b2d83d52139e35c2d36cc390c247cc7d07df6fdeafbb15a78df724cc42da475c2a7a5d7f131166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617236845, "uuid": "aa79e629-cacc-4cb7-aa96-611537b4a27e", "value": "5F8623412D40CEEDC5761DF22494D6CAE6D3B16C3F1E81FA928D16298DF4121EF16FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617236845, "uuid": "a85448f8-21f6-434d-befc-3c04fa85c7cf", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617236845, "uuid": "0167cefb-1cd9-485b-8ad5-6e6b0527fc54", "value": "196608:75aFAmXV/+lmefLXegGqjQp7hkteWW9KbmnWt:75a2QV2HfhG2QpFkMWW9KCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617236845, "uuid": "cc9c11bd-9f22-4d98-ac79-a168dd02fb44", "value": 8487614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617236845, "uuid": "9400f282-9169-4582-845b-9e28afb4855d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617236845, "uuid": "07d721bf-3bd9-457b-9eb3-13fe8b3df033", "value": "98C452F8557D0ED0DFC4749141741CD7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7275a8e-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276276, "uuid": "a44ec34b-7e7a-4336-ab4c-47d4421be192", "comment": "Malware payload (IcedID)", "value": "db1744fee9ab29903367a7fb45f09e9e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276276, "uuid": "98bcbfe7-d945-464d-8aa1-4f649316e3fc", "comment": "Malware payload (IcedID)", "value": "41e8597432aff9d0391ebe00e268c624a3566f449e1a79feacf3812203761964", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276276, "uuid": "e1cb4d47-a625-40da-854b-6dab88b59bd4", "comment": "Malware payload (IcedID)", "value": "7a9085e7515140a169ce88b6c2732fcd0324ba31", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276276, "uuid": "ff29c853-e291-433f-a9bc-2a5d7b347213", "comment": "Malware payload (IcedID)", "value": "8da02d1552810d2658e13d6284ebb3161a7bd9e87e3dfcaa17d9eecd77754dcd4c7d29c5152bafc369fdc37f4351a236", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276276, "uuid": "84d0fe63-1592-408f-9c33-882328767978", "value": "2B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276276, "uuid": "e27f12c1-8290-4597-9665-3067c07fc4bb", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276276, "uuid": "56f9c0a2-1bc8-4c34-8d80-5ea06d89adee", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276276, "uuid": "55c698b3-a603-4cd6-a7f2-5660d4472da3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276276, "uuid": "f37d512c-c42c-4b8f-ac07-39b929e2899b", "value": "document-1637829227.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ca08c5-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286154, "uuid": "540aac7c-29fc-4d7e-b5ea-cebcea1b2544", "comment": "Malware payload (IcedID)", "value": "db44c254dd13abf2fe20c6fa156ac3af", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286154, "uuid": "e27d4544-4dab-47b2-b063-f76d5199fe97", "comment": "Malware payload (IcedID)", "value": "41f4573c2f1ac2554af86d4fb9693180b0799ac8e27e8d7e18488a460168f38b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286154, "uuid": "06842319-f42b-4a93-b536-9d323cf0f6c9", "comment": "Malware payload (IcedID)", "value": "ae7e00891e32d6ce29c3b5eafabbc6bac2aceacb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286154, "uuid": "f030926f-4a61-49b6-9194-f84ac9929d08", "comment": "Malware payload (IcedID)", "value": "ff5adfd60cebf95c18e2dbf4dad8f0f872ca82fb20e22af4a412ae7df10cb1d5c99f2999990e249fc2ed07d410696f80", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286154, "uuid": "28642da6-ee74-4490-b19a-4740a631df1a", "value": "9C044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286154, "uuid": "9ce0cb12-1e21-4e38-8c51-5250962b2b91", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286154, "uuid": "b8ecb7eb-7329-46fd-a55f-39ce65508bd7", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286154, "uuid": "f9ec52ca-ec7c-4a39-8e5f-e0f914ac9a6b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286154, "uuid": "ac0110a0-d820-4ce7-8831-3402b269a59a", "value": "document-367797371.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac69a67f-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284794, "uuid": "e2d9fef8-a2a7-43eb-b78a-3f09a77afe02", "comment": "Malware payload (IcedID)", "value": "30a95bfda1146c200dd43a761d85fb18", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284794, "uuid": "b5dc7a22-d9c1-40cd-b9ff-aa4b8ebc0f30", "comment": "Malware payload (IcedID)", "value": "426a99616838d1b6f80356f603c18cb4d94e264de85a97ff8e5008967f5110a1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284794, "uuid": "0ba84537-1094-4dbc-b5bb-1e0842025fd4", "comment": "Malware payload (IcedID)", "value": "837f1ed6b8a26e00a84f8a4c0056d12d020c59c2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284794, "uuid": "19bcd619-fe08-436c-bb6e-b385a9469d64", "comment": "Malware payload (IcedID)", "value": "3e55eaa5dbd181a58e7edb597c3300415dd5ad3dde4a6a3bd64d7f49337bfa38d4f5e97884aa542a394071c779b9fdca", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284794, "uuid": "3f29f109-ff02-4e59-afe0-4eb39dae879d", "value": "CA044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284794, "uuid": "944af202-2f96-4505-ab0e-fef32672db6c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284794, "uuid": "3f766c6c-c7b3-4f1a-ad30-92d14866e840", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284794, "uuid": "9519a9d0-dc49-4ddf-9867-8b9fddea3b9c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284794, "uuid": "4aafdcad-15c7-49e3-8f54-bfbfe6ca35c9", "value": "document-1315363159.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c8b421-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284790, "uuid": "6fa91f6b-970f-4764-9e7b-19db8749bc46", "comment": "Malware payload (IcedID)", "value": "19ea9a965414351ae347f84890938008", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284790, "uuid": "f8bedb4b-d110-46ab-aa6f-d7f42bd8632d", "comment": "Malware payload (IcedID)", "value": "42c6a581ea21d475472a8319caa2b9e653df6d8838a90af1f1765da7c3ecb847", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284790, "uuid": "e5d0d16c-6383-4d76-8e7b-cfadd3d032f1", "comment": "Malware payload (IcedID)", "value": "c75dcb938be9c082186dd5599293880f64ed1da7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284790, "uuid": "1c21f2eb-2ae0-4f4e-83b5-455d7ce4401a", "comment": "Malware payload (IcedID)", "value": "33ec4cec9ec1974bd088bbee59a8f4cee614bf1a6a8b42eb3889c43d2e89c31b2261598f1721c355256501bc189be60e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284790, "uuid": "911a70d0-fbc4-4ec0-91a1-e5747434891a", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284790, "uuid": "90324d9c-68c4-4652-8ef9-3759188f7c23", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284790, "uuid": "db6146d2-5b81-4396-9842-9272c56debc8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284790, "uuid": "bed36054-1915-47d9-9728-ec5cd6169c55", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284790, "uuid": "2466c849-7212-4943-851d-c2dd56d04a4b", "value": "document-759334105.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c474a533-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288271, "uuid": "f7e09a5f-30aa-45c5-9ef3-82ccd343440e", "comment": "Malware payload (IcedID)", "value": "7b6555ca1a7a52b5619d2f9136d908eb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288271, "uuid": "ad341913-5172-4a47-a3e8-cc5345f164c1", "comment": "Malware payload (IcedID)", "value": "42eb1dc73084283c09bc9c44e61919b617dd08eb416bb1556a54ad8d92cdee4e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288271, "uuid": "e42f795d-22a0-40ad-bf1f-5995aae832bf", "comment": "Malware payload (IcedID)", "value": "b48cdc2c5ab60a8b85c95413fec8160e4cb4647b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288271, "uuid": "e64c087f-29a8-4935-96ab-998791233c51", "comment": "Malware payload (IcedID)", "value": "adc6c6026ea522b42c62d291cae3fda91c2df3b30cd30190218067581ee54c242af2d2ea5a3f001dd16a59bb6f6fbd99", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288271, "uuid": "b8fa0cba-4080-4b48-96d6-a64dfa3d4630", "value": "A6838CCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EAA2E4C42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288271, "uuid": "ed6a367e-c350-4156-b689-3805db008de4", "value": "1536:IB240XZfcaaxf+EQliU2haw3GCAIoo8+BNvMhfvZa:+2d1cBWEQXM3G9o8+nEhH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288271, "uuid": "7e42c86d-3aa7-47dd-a109-74800a83b7c0", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288271, "uuid": "231da6db-2835-44d6-97b0-b1d1c0d97840", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288271, "uuid": "d5f9c4c8-bb35-4d1e-b27c-f2a101c98720", "value": "2651.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f990a0b9-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275904, "uuid": "1352c037-662d-4f6e-879d-917afbbd92e0", "comment": "Malware payload (IcedID)", "value": "c491db97c1e6ad8ea3547a798f753164", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275904, "uuid": "f0fe842f-b077-4a81-8020-73b880c6fa73", "comment": "Malware payload (IcedID)", "value": "434a106fb59a224cd75e42aaff81bfac0d4d0db5993fe5357ece9385c010a86e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275904, "uuid": "55674820-ed9d-41df-bff7-156acfcc20f1", "comment": "Malware payload (IcedID)", "value": "a0353aab5cdba663ad705ee8229c0e6233c1960f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275904, "uuid": "868558fd-ec00-4546-9725-9b73507898da", "comment": "Malware payload (IcedID)", "value": "a2d7471f69c3d531d91fe9e1a34c35e592a423891589a60ad6ac37abb7f3ad876d4953f05fad23775f4205236692eb16", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275904, "uuid": "a842ccab-8885-4eb9-9119-1df45937ea81", "value": "DF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275904, "uuid": "e681f478-f9a7-4048-97bc-41aaf14ab914", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275904, "uuid": "94c7217d-6172-4ffe-8b1c-a12d4bb2794b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275904, "uuid": "91293b36-f2f5-4d77-8b43-e7b2eedb329d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275904, "uuid": "c280f399-7b0d-4733-be4d-7ad6cd059f8f", "value": "document-906856104.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb7484b-9314-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617300230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300230, "uuid": "71d43335-54a7-484c-92d0-b441c9eef151", "comment": "Malware payload (IcedID)", "value": "f1b3e518d3f652164f5c16687cdd7662", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300230, "uuid": "aece37ea-72e3-4f40-b557-097f3350441d", "comment": "Malware payload (IcedID)", "value": "4350407c648dede6351cc85c39522332b6b626153e6770cce3d8b3cee48d8569", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300230, "uuid": "65f39307-9007-4905-a6c5-e3ce01b7db31", "comment": "Malware payload (IcedID)", "value": "22d84996665f7ac163147877d82deb3e656050fa", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300230, "uuid": "0911e754-d3f2-4c6c-864f-c2de97263d04", "comment": "Malware payload (IcedID)", "value": "2e44cd42c2a3b32c630a1bee9e05ec4f1000e1f55e282184e37100cd1b2fa5696b71b8ae745b31c019b0de23a8780c54", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300230, "uuid": "41a295ea-0e8b-4b29-9b22-0da194a19807", "value": "D204123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300230, "uuid": "8015e04c-7505-46d8-b226-f724e58ac469", "value": "3072:3XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:nE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300230, "uuid": "7b0821d8-61c2-4ebe-aaaa-ab55bbe0dac6", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300230, "uuid": "56b827c1-2fe0-448f-a143-14fa8be2cbf6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300230, "uuid": "78c94180-bf50-43fa-87e5-7efcc8dc9adb", "value": "71443744057-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7388ea-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617282914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282914, "uuid": "712b511f-5936-405f-91b9-2d9d44804739", "comment": "Malware payload", "value": "a2ee53de9167bf0d6c019303b7ca84e5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282914, "uuid": "7644b159-3c6a-495c-a913-3a04511776ba", "comment": "Malware payload", "value": "43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282914, "uuid": "2b7079f5-041f-4dcf-b5d4-d9adce00e91d", "comment": "Malware payload", "value": "2a3c737fa1157e8483815e98b666408a18c0db42", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282914, "uuid": "6ed89ae6-e0e1-4753-9197-4a563b0bef31", "comment": "Malware payload", "value": "e1ae7b62ae4ca23442f5fcd0e366a7cb9b842ef66a80555f5449aebcbf6a5a8fcffb5a260671c592da7c7b7ae72a99d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282914, "uuid": "48b6d121-d6e2-4468-9984-f7f9865e2df8", "value": "BDE37C13B7C090E2CEE300B630BA67764A7FFD31A239C44BA7B459554D225D1FB1AA87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282914, "uuid": "1df43769-5054-4585-a0d9-6be68f749f8c", "value": "4d153c0cea0b76890c21127ac6dbd559", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282914, "uuid": "72f7c7e8-f6e3-40b3-b3f3-3e4f7254e770", "value": "3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282914, "uuid": "cd60dab6-5d7f-45de-94f1-3fcf5c800095", "value": 144848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282914, "uuid": "95ef56ce-dfce-4079-8814-4f9c826a7056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282914, "uuid": "ae4dbd1f-460e-49a2-bd6d-59c0338ed0e1", "value": "6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a1e763-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280974, "uuid": "87e963da-8f36-44b7-9cf0-4e2f6e10dccc", "comment": "Malware payload (IcedID)", "value": "51b0c8e3c7bf9e2368542c6e374e6ff9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280974, "uuid": "dc5b17c7-14ff-4029-874f-6e224f8a54ad", "comment": "Malware payload (IcedID)", "value": "435de9e166a378a95e2ec277b0f9459aa359529f825c2ca85fc4ed5721f2b0cc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280974, "uuid": "1df4bcd9-811b-42a7-8726-b823b124dd2c", "comment": "Malware payload (IcedID)", "value": "a26e24bb76fcc111357fca9b14bdeba630479146", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280974, "uuid": "e7168306-69c4-4952-a65b-21ac09697c7d", "comment": "Malware payload (IcedID)", "value": "691160091dad0ba78d3e5019aa047a412e4830c72970e6b83cac0b5cdac95f6ab506cfd66ca766725136335b344c71be", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280974, "uuid": "78f0e358-949d-4401-93a0-1aa7b5f4da06", "value": "EB044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280974, "uuid": "3197e9ae-911a-4ea1-84cd-3cccdf1319b5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280974, "uuid": "39153b80-d5f5-486c-a094-8a392fea1eaa", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280974, "uuid": "1c95c701-47b1-486c-a77f-b549850c2a0e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280974, "uuid": "8e514517-2fe9-4db8-9e54-522233e74170", "value": "document-900611203.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980aa115-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617298933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298933, "uuid": "d753bd73-6d51-435f-bf0c-5b42abdac87d", "comment": "Malware payload (AgentTesla)", "value": "806f67e84c7f2b466d157912c9f59218", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298933, "uuid": "ad6b1f43-be63-440e-b91c-c2cd0fd94e6f", "comment": "Malware payload (AgentTesla)", "value": "43adba1c6071c96e33c6c3753da01fd4bdaaa4e8be4fe2618784b0ebfcb37492", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298933, "uuid": "e38b52e7-e8c0-4ff2-b854-51ac834d5753", "comment": "Malware payload (AgentTesla)", "value": "6038de27d698f19af936aff8e9c82350f7cd3e8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298933, "uuid": "7c3c46cc-582d-49f4-949e-3273e520856e", "comment": "Malware payload (AgentTesla)", "value": "37b14888f80b3dec2d6d18bc1e7e38cd903a749567479abeb7dde246acea1ab5688e8a3e62c473146c5226b267328d74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298933, "uuid": "32d706e9-fe11-436b-8bc6-377462ae5a7a", "value": "2335AE2A3B54658CC0AB07395864D00C9FE67DA9AAD3C5837EEE33DB6473F1307A4652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298933, "uuid": "6dec345e-0211-481d-8730-3d42be5bf601", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298933, "uuid": "d86a78af-1c2b-443c-8dec-f9b76fca0a8d", "value": "12288:ME1KpEPBz2Wqy+YCthAiWuSnBBEVh0jZ:ME8qPBz2Wezdvcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298933, "uuid": "71473d9c-aa0d-4b42-8801-957433c941ed", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298933, "uuid": "bcbc4561-d1c9-4343-9d41-fd5952175b98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298933, "uuid": "e53d258d-15e7-4c8b-80c6-5f02ba5cb1fc", "value": "uMLNLd9kgPez84h.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912d2ab8-92a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617252536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617252536, "uuid": "c7eb86d7-297f-480c-9728-6f90d61fc82a", "comment": "Malware payload (Dridex)", "value": "45597f47e7d6103992e449707f104eff", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617252536, "uuid": "4de61ae9-e668-4eba-870b-782e4cae5e7c", "comment": "Malware payload (Dridex)", "value": "43b83dab7a0f62969b4384dbb43ff1b75de3e62c55acc850c1c51b8e0b02d9ac", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617252536, "uuid": "072ca08d-6f19-4ceb-84f7-5585b6057c78", "comment": "Malware payload (Dridex)", "value": "7e83cb95c344483032d2f8b32cf229639c44e676", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617252536, "uuid": "63ecd5c6-809f-480b-9da6-5298d597197a", "comment": "Malware payload (Dridex)", "value": "37f0f65bd07c0ffaadaf05e6434661a3d345ec9ab1488731b18999676416abd69c44d27723db7aec87323d2e6108275a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617252536, "uuid": "97ebb2e9-c8af-4c90-936d-3d2bdb768bb4", "value": "2E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617252536, "uuid": "41735ece-d414-4940-a6ef-d61ef7207b71", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617252536, "uuid": "74bdf3c2-85d3-414e-a1f0-7ca0efc59a08", "value": "3072:oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:fpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617252536, "uuid": "10d58e1f-3423-411e-b4d1-a7bcdd746314", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617252536, "uuid": "25cbf632-6788-4ad5-8547-0dd4f4461e54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617252536, "uuid": "c71f72a9-5310-48ff-bc8f-1c4ebccdec0e", "value": "43b83dab7a0f62969b4384dbb43ff1b75de3e62c55acc850c1c51b8e0b02d9ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c69ec3-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617282584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282584, "uuid": "ad74feb9-9045-4531-8bf4-f96090195462", "comment": "Malware payload (AgentTesla)", "value": "2fca382d3e3b480f134902aeac2e4bea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282584, "uuid": "fc8ea71d-11f3-4611-9c41-066f4b42cde7", "comment": "Malware payload (AgentTesla)", "value": "43d26977116e9862e2ff0881465112241c96115d5c542eadf652cb2263407252", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282584, "uuid": "b2bfdb38-8342-418d-bc3a-a67d1da0fd56", "comment": "Malware payload (AgentTesla)", "value": "bf5f4097c28821ffa695edf1843864e9bcd3dcf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282584, "uuid": "a5e42a09-015e-4ead-9d92-2a9374bbd348", "comment": "Malware payload (AgentTesla)", "value": "fe6b6e3d207bf18f57859f799b4cc0d9ea6a17879ea904f4bd1896b5de8753fcb039c93319e9ebb256f3988bd588af76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282584, "uuid": "7edc9ecf-fed1-447e-be8d-974c93d8a81f", "value": "77B4CFB532D85B15F07DEBF87862110093F4A43EE2A6D60D1EAD14DE4872FB195A2E33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282584, "uuid": "f42f9cab-32f5-4590-9518-bf17fde100f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282584, "uuid": "dda01df1-f183-4127-ac76-725b9b43c279", "value": "12288:iQLcyJWgwJ7Vq5rZalWmflX8E3bSDWLOdC9TBU7yF:TLbJHiYaQmlX82L2gTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282584, "uuid": "0f3c0e8f-ee91-490d-8367-80eb78be4aed", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282584, "uuid": "d03e185a-7bb8-489a-9761-befef97ef3a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282584, "uuid": "1942a074-6f87-4923-b27e-70487648b594", "value": "TT Payment for Shenzen Lancer 01042021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be6c4a2-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274754, "uuid": "6721acea-a008-41b0-b29d-4eb03e52d720", "comment": "Malware payload (IcedID)", "value": "d2c16c308cd8bd1d73e2b3e8d3f7320f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274754, "uuid": "331786f0-b55c-42a8-af77-e1ac3a122f2e", "comment": "Malware payload (IcedID)", "value": "43e4577801e743ad2f8bb7e9bfe43a01cf0c4564fb3c0741a4d4aed64e861d6c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274754, "uuid": "80ba2228-c2bc-4379-917f-b0b878999e1c", "comment": "Malware payload (IcedID)", "value": "a513af54f0c627a4c4eaf76f59209046ca7e359e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274754, "uuid": "5a570e7d-5123-4eea-be28-0819f6d46026", "comment": "Malware payload (IcedID)", "value": "4a0c2ef4b9dccd8360a0f7f1a45be32ef5e22330b2478f2500479624e1e09b0b9226190ca7fc9e26e2f34b3cd826d0ef", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274754, "uuid": "a6285c16-cc54-449c-ad63-3ed7d3640588", "value": "F2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274754, "uuid": "516638ed-0e69-4c59-92f5-8a243055bbf3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274754, "uuid": "7431e23e-bc6c-4042-9afa-917ab1fcef7e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274754, "uuid": "d2fa420c-7f1b-490e-a855-dbf3875f9b48", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274754, "uuid": "f1595008-3bc6-43a9-b2c1-4aa876dc90b0", "value": "document-2042944528.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbea7f2-931a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617302887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302887, "uuid": "c885a700-0ea0-4259-8a9b-55406b3425c6", "comment": "Malware payload (Loki)", "value": "73e183aacd897cf94d2cfbdfd1c760ce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302887, "uuid": "6d399e49-d0ba-4a2d-9f70-a1b1ac84d61e", "comment": "Malware payload (Loki)", "value": "44153c015da5aeb82c7f6266da77407d2b4d76f886d53b88f63bee7ed09b930c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302887, "uuid": "4c7b8944-871c-4f1e-a8c0-13d23ea7af0c", "comment": "Malware payload (Loki)", "value": "246e9725387abd343b7b27a9aaf24b542919eb90", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302887, "uuid": "786869b1-f0f3-4625-b46a-8419071789cf", "comment": "Malware payload (Loki)", "value": "d8e200c82d7124a0d20a9803cc55a5b9fd99d3292281a89dc13370ff787526dc37654b3eea1b04dfdc6201978492729f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302887, "uuid": "7bed639f-564e-48a0-b79a-a947015aa572", "value": "0835E7F424F408A1F6C7C840B98DFC650D61F587CAD7F9EC437CDA722A29A636E4A509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302887, "uuid": "6ffc2ccd-13cd-45c4-bf70-882a6f77d8a6", "value": "12288:IVkdP5jmM1Y5jh205jmM1j5jh2w5jmM1I5jh2h5jmM1A5jh23:IO/jsjkWj/jk6jojkTj0jk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302887, "uuid": "a0f6a457-c496-4aa3-a4db-fc6ac9814206", "value": 1091592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302887, "uuid": "40432f66-153c-4271-a2ca-b2649e08cd3b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302887, "uuid": "a260ee5b-135d-4a69-ac00-377a193d288d", "value": "000010052_02906666.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51106e2-9309-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295654, "uuid": "2bf8f96a-08d9-4e62-af00-c31721c8d562", "comment": "Malware payload (IcedID)", "value": "d18ef27a9a565ed05c19e5549440c04e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295654, "uuid": "b50fd3d6-0023-4d28-8570-6cdf042233a3", "comment": "Malware payload (IcedID)", "value": "443b7360aa31feee55aff9277a19cf5a8fd29ebab362647caac72d67846a3cd2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295654, "uuid": "1886388e-6b50-4a19-93f3-ddadc67272f5", "comment": "Malware payload (IcedID)", "value": "a744ac96c8463c9b7c8eb66ca5f7c4d531eb15c7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295654, "uuid": "99d25fbc-64d0-4f52-a715-f8c1ce36f70a", "comment": "Malware payload (IcedID)", "value": "31c9f69d0107998824d642dc9ffd77334690c98a6fec1d839ae2a5c2568ec2195dd8a9a8c8a64809e72e082a43716338", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295654, "uuid": "3953c1e9-c5e6-4cd5-970a-6185e22c0c3b", "value": "17838CCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EA63E0D42FA80A5E79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295654, "uuid": "19030168-0333-448a-ab9a-a2f14403dad5", "value": "1536:IB240XZfcaaxf+EQliU2hawiCAIoo8+BNvMhfvAz:+2d1cBWEQXMi9o8+nEhH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295654, "uuid": "b5957f06-9c05-4ac5-92a4-fa5c2a5fb6d1", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295654, "uuid": "cf8b1aa6-8438-4204-bf29-63f96ef32e1e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295654, "uuid": "547a6d4c-225b-4f7a-a790-6e4d18d70233", "value": "127.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3079c1a3-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291458, "uuid": "fec7a8fc-13a1-4326-bf3c-6b170e5ba7fe", "comment": "Malware payload (IcedID)", "value": "3879fe48684f237fca555886c98077a6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291458, "uuid": "42a789e2-3d26-46a6-92eb-9835215e4994", "comment": "Malware payload (IcedID)", "value": "4445b873bde7c83633609cbbe81e8a6abe67334a5655c689784e16eb3e9d764d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291458, "uuid": "be095a02-1741-446a-8e25-fcba94323f01", "comment": "Malware payload (IcedID)", "value": "4822469a89c584c20ad7a03522347c63a2ce5e7c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291458, "uuid": "92d46abe-2eaf-4b32-82a2-8f2b14263dc4", "comment": "Malware payload (IcedID)", "value": "0daf1e7aa628b75838f0a53f1fb03b47ffd8bb6eb4edc82861834e6a1a49b775863db3ab8c6b9483e61623b376e52e74", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291458, "uuid": "3abbfd7a-0c89-4255-bc78-9467e06897d7", "value": "2604123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291458, "uuid": "12e8975c-0702-43dd-9038-e3e7bfac72e1", "value": "3072:tXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:xE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291458, "uuid": "e806b614-8521-4aaf-9820-483d85f97f22", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291458, "uuid": "7dbef733-daff-4b12-860b-a9eeec95797f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291458, "uuid": "d51d7415-2a7c-4af9-9829-ca9773b61df4", "value": "9369036239-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d391ee-92fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289043, "uuid": "59380139-a88d-40ca-b1c9-9f0d75616640", "comment": "Malware payload (IcedID)", "value": "c642648a5b59633916bcc6f88266d089", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289043, "uuid": "0c1f2aba-c107-44c0-adb0-939613fd6e17", "comment": "Malware payload (IcedID)", "value": "445226e4fe17a74fe845b16cb5f4e5c7b1ac23f9caee8e418d095bd833e9102e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289043, "uuid": "f2e53a78-6792-4aac-abcd-1e63f244e946", "comment": "Malware payload (IcedID)", "value": "e6c9fe8a0c5179b3f52d0c031b950a2d31685ebe", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289043, "uuid": "ddee87f8-876a-417c-b708-9883cd9118e5", "comment": "Malware payload (IcedID)", "value": "1a34c754aafd33c7921614f826caa23899d3902e3e8647a01d9ae3780a687eca47b975e4d13b17540a1237b7d2735283", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289043, "uuid": "84ecaa15-7a42-4a97-a27a-d62c28e1d06c", "value": "DC838DCDC913E1D9C2559FBD5A09308112F4E0B7276FF11B148EAA2E1D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289043, "uuid": "742d9f92-a8bb-44f8-9fa1-6f8d560641e6", "value": "1536:IB240XZfcaaxf+EQliU2hawqCAIoo8+BNvMhfv2Rg:+2d1cBWEQXMq9o8+nEhHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289043, "uuid": "3d02ead6-9fb0-4935-8b71-1143218fcc93", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289043, "uuid": "de181850-1bd2-4351-8534-21e3a73821af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289043, "uuid": "c946c10d-9566-441c-87e1-81418245f7ad", "value": "937.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4f45bf-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283536, "uuid": "a5a8890d-01eb-4f5c-8a81-bf28c2a630a3", "comment": "Malware payload (IcedID)", "value": "7147da0f62447677ce8de3dc7e1488cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283536, "uuid": "9dbc2f86-abf8-4a8f-b05d-5546fea90caa", "comment": "Malware payload (IcedID)", "value": "44a60a1a8cefa22f67bdfe7dc38989fce2180a61fe89d314bb6289f4a54ee9e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283536, "uuid": "2c164d6e-cdba-420b-a795-1cf7ac051a49", "comment": "Malware payload (IcedID)", "value": "6f8b5b293bf6fe334d172870010ef29518069379", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283536, "uuid": "ae5f52f6-8f40-419b-8f3a-e7192308eb1d", "comment": "Malware payload (IcedID)", "value": "3a4098a7f4f18cf2eb53da5b63138fb50adc54cd5e27a0a6a6e8b22a4533fb1d1016e579e375e0ab6e91feec6c623642", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283536, "uuid": "c4823a28-2f37-4414-8a45-5ccfb3291611", "value": "9724C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283536, "uuid": "29449099-849d-452c-a481-d5b757788b5e", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283536, "uuid": "d18338ef-9f65-4900-9038-3d071821c960", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283536, "uuid": "861326ff-8264-4d81-b9a2-a75185eeaf53", "value": 213692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283536, "uuid": "fda1f8e3-92b4-446c-ac0e-415aca02b492", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283536, "uuid": "78d3b1e2-28a2-4006-abfb-b7f111401cd2", "value": "7147da0f62447677ce8de3dc7e1488cc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aff6797-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274752, "uuid": "4f569c95-4e5d-48e1-8dc8-5946066aa781", "comment": "Malware payload (IcedID)", "value": "a82aac218af0461a6a5539ceb6899645", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274752, "uuid": "e425ac17-721f-4535-9841-db400da50304", "comment": "Malware payload (IcedID)", "value": "44ee12c5572e9993aebbbe71254bf5b1a19230b1d3edddcaaba9490f64f5df82", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274752, "uuid": "63944c91-c5a5-4e1c-97bf-473d750d29e9", "comment": "Malware payload (IcedID)", "value": "f150c4dda21e7f3447f64c2dfb95a8a4510c05e9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274752, "uuid": "2da2da55-fa5b-4a59-a824-2ddb702da2c4", "comment": "Malware payload (IcedID)", "value": "a8681ef69880a2069d306c966bd146059d8acaa6985d3cb65f4981f447328bce39907484deae1ed4c6499e6e7a6d8088", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274752, "uuid": "c9e76b70-3a53-4c28-abf1-f25e5adde75a", "value": "D3044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274752, "uuid": "ab42db38-5209-4190-a9e9-6a1e7d963127", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274752, "uuid": "ef123f69-d842-4680-a0b8-3fb042ab43ec", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274752, "uuid": "5379a8ed-8c40-450a-8c71-fba217b5a62a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274752, "uuid": "81ecad0b-1d3c-4dd9-96b2-d032ac3bbc99", "value": "document-342397806.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df83b6e-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617259349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259349, "uuid": "6e4baa4d-a67f-4643-88f1-0a4f99ef1723", "comment": "Malware payload", "value": "132849ec8bca39ad01274736947fcf82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259349, "uuid": "320fcdc7-f567-4193-a73a-cb822a0491d0", "comment": "Malware payload", "value": "4564033ca316b31e192f8dcfca9743756ebfe554c43e952924c4ef6581ef9e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259349, "uuid": "6fd270f9-28af-4b57-8365-4c2777ffde3a", "comment": "Malware payload", "value": "c8a8f4c7ac96741cab64755d88f4696a3828b10b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259349, "uuid": "2fb2aeff-a272-4a66-be09-9d916dc71db8", "comment": "Malware payload", "value": "8cc428b77bb576e46e38076bd26b4625c980b079c5db3007a741f3c2221fe43416410c8a9a64e766ed9357468abbba6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259349, "uuid": "56d521ee-c6c7-4e9f-a817-287512e90291", "value": "A7263332E8924673E11728B3491B23B1F13EFB54171EAD9F75E94E1C4D3670B12A42E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259349, "uuid": "7d4a809e-e589-41f6-b3a2-00808f0e7415", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259349, "uuid": "1c6c5e39-59db-41db-aaf3-07ade399a52f", "value": "98304:pAI+2qSPmQTD5if5ytiU3YHHpA06/W+3rNyraQA1eMtd3OjsOI+t:itPSnIfDU3YHN+3xyuQcF1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259349, "uuid": "61e22301-3063-48d7-996b-4b291720d1db", "value": 4581230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259349, "uuid": "d3049d8c-7068-456c-83d7-25bc2ef2f060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259349, "uuid": "15f6df7d-6a40-40f0-8366-4ccf754f1281", "value": "132849ec8bca39ad01274736947fcf82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68b04f4-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275040, "uuid": "77ff1c35-ef9e-469f-8011-9ffa566a2df3", "comment": "Malware payload (IcedID)", "value": "29c34232bcacc4b5e4c195793bf72edf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275040, "uuid": "ae77c3d9-c154-4a52-8c3b-dc3621c3d309", "comment": "Malware payload (IcedID)", "value": "4572c08c14a639317f073bcab1b2d01b9756bf48a24289a9f065347b170153ab", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275040, "uuid": "13fc003d-2f57-4df5-86f7-6845a935408c", "comment": "Malware payload (IcedID)", "value": "2ef63fe4451a5bdabcb13f38846043f3c3b01e2f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275040, "uuid": "4737eded-0fff-42a4-8433-e65abbd6de71", "comment": "Malware payload (IcedID)", "value": "addc4903cac81150a6b69c2213198d15587984b9faa18ffaafa3adc74220d941116fa8652e7e37990c2384aa55a621d8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275040, "uuid": "56182428-533f-4cca-bd93-e3c02f79ee5f", "value": "21044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275040, "uuid": "6e3c5934-5eab-45ba-80f9-8e5dc2c4ff0d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275040, "uuid": "1422d73b-eddd-438f-84c0-fd0e23ac42ac", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275040, "uuid": "abfd2cfa-6091-4a21-b8ab-b95c0f0be67d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275040, "uuid": "2bf94413-c650-4bb4-9430-9b9711b61419", "value": "document-1055596074.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578bd74c-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279927, "uuid": "cb7c4e13-d49a-4282-bf71-ab449618df09", "comment": "Malware payload (IcedID)", "value": "c6c222c80d3a194d945481807606fd31", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279927, "uuid": "1fc9465a-9d6d-4c98-b7f3-8d79e70a45b0", "comment": "Malware payload (IcedID)", "value": "459242eb8ae3bf011eaa43004495f9e8949c9666d4a02bf11e77ff5927de7c52", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279927, "uuid": "cec2cc53-03b1-44fd-9231-f57a4cc8c1a8", "comment": "Malware payload (IcedID)", "value": "e6b0a78a926e986f4115a83036cc5fa01fdd3f43", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279927, "uuid": "150a3b27-bc43-49fb-9a14-4b70dbf717ac", "comment": "Malware payload (IcedID)", "value": "452dd6858baa5a5257224c9aeb950e831fdf442521548468fc889c0d9d08df8469086b167e949c09dac12bd386ee4a22", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279927, "uuid": "669851e8-83eb-45ff-8f89-d0374b25338b", "value": "52044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279927, "uuid": "06544e4d-e8fb-4e78-b1b8-ac113160eac9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279927, "uuid": "89ec2e66-c501-4879-94f8-a1c37307c3c0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279927, "uuid": "056bd89d-65d0-490c-a9c0-1cf91425f81f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279927, "uuid": "598c37b4-743b-47d5-91e4-e3285fc17952", "value": "document-1252473504.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613fffc2-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279085, "uuid": "eac25866-818d-4048-8584-8fccf07b2639", "comment": "Malware payload (IcedID)", "value": "fbb92ee7e8367c0e59cf6a8e5fd89295", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279085, "uuid": "c47e7010-0e1c-4d29-9920-0e04e0f04234", "comment": "Malware payload (IcedID)", "value": "45a4b232a8ef291b28fc5b4a60d58251ae8daa0897cc1277884a826b12ded8f4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279085, "uuid": "86cc1bf3-3f42-4590-8267-948ca283d234", "comment": "Malware payload (IcedID)", "value": "23112ef4feebb6f1b334acdca9741022d2540368", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279085, "uuid": "cc6fd770-7419-480d-bbcd-4ec0956c475c", "comment": "Malware payload (IcedID)", "value": "ed253a7bb1b5e9af359690615a8a8116cdaadeb6dfea5c86cd96341dd189823d6eff62a01bc8e50880f13bd21325169d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279085, "uuid": "243f48ee-5811-4be9-a535-886ed9fe0976", "value": "05044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279085, "uuid": "e1f76674-d703-4de0-b1c2-d3536e60b33b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279085, "uuid": "aaf6a389-6c33-4e29-aa7e-6034851ce0da", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279085, "uuid": "d2f29e90-c3e0-4358-8423-8c7cb74bc296", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279085, "uuid": "fec0894f-9546-4ffd-bc85-3503f3405ea9", "value": "document-1104702752.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20586db-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617262040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262040, "uuid": "9f8bb55a-cefa-40b4-9646-2b516bc5a287", "comment": "Malware payload", "value": "453db202ff5606e4a28dd8d168b7bf1a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262040, "uuid": "c7796029-5175-49e3-9fb5-51ed13a89a09", "comment": "Malware payload", "value": "45aecd6123f928ed68dd96ff464e22bdcd92ff3872159649edf8a082bbaa5d8c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262040, "uuid": "b09be7a2-d8b8-4436-9b20-9588987eda5c", "comment": "Malware payload", "value": "806a1e8bde11304541d6d395e649ad6813f467ff", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262040, "uuid": "872f381c-bada-4c53-84fa-7b1efea48485", "comment": "Malware payload", "value": "908f10d59a26407da85a05024d1140d8c7c4758f081f0488be418423356fa7caaddbba977470bb4db68da436a2495bb2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262040, "uuid": "82b0571f-e83d-420f-87c9-babaa86f96a8", "value": "576423BC19890F5A5DCD2CF9AB33E9A7039147E71744954C8C9AF3F2C11A207B5A781B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262040, "uuid": "b3b69fe7-300a-409d-9878-b47d0f8369f6", "value": "6144:pvdZhXaa+NQN4GlA9Fm1v/VCOY3nw9lybkAupQeS0y+leiHToXWpyfDYRH:1lXaa+q46A9FmZ/8nubueS0MCkXprYRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262040, "uuid": "1a3b2787-bc07-4e8e-b8a5-b56fcc3cce88", "value": 308217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262040, "uuid": "df5fbb10-c7a3-4a3e-9ded-e3fdfc7004b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262040, "uuid": "cc11e987-5d7b-436e-a314-63423a8f864a", "value": "Payment Invoice 1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2c77b3-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277462, "uuid": "d5dfdef6-5960-4416-8104-f029a1fe6276", "comment": "Malware payload (IcedID)", "value": "8fc485b2de5758f9d2c76cf380448c04", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277462, "uuid": "86753704-e62d-4ce6-a978-7aa9d34909ce", "comment": "Malware payload (IcedID)", "value": "4615984d7a9af117c8937c223d26eebeea8d5432359361be5b87173ef75c1ecc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277462, "uuid": "181a3d46-fc0d-4b54-9cbd-e303295e8df0", "comment": "Malware payload (IcedID)", "value": "89603cf5ce1871a9815d8409faf4353fda830629", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277462, "uuid": "d0061da2-8b40-4f07-8330-1123fa9a19be", "comment": "Malware payload (IcedID)", "value": "2cb7197f607e6d07cbe82b271def7e70ddba4da4a6b8401ec88ba8c6c24114fe7b990d42debd532ddd0b51672e279149", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277462, "uuid": "4e0e0c56-2bad-4cf4-a644-7de4c6ab934d", "value": "35044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277462, "uuid": "daf8eff6-c2b7-4f79-817d-d0f289bcf60c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277462, "uuid": "8016a67b-a3b6-457c-9f13-92697c55040c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277462, "uuid": "a641dc3a-5b06-4d3d-99eb-00b3aaaf1e94", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277462, "uuid": "086102f8-07e0-4e5f-84c3-62c2becdb9d9", "value": "document-128649899.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b0b59d-92fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289772, "uuid": "1b6303c1-3c51-4291-82c3-fb1636606d09", "comment": "Malware payload (IcedID)", "value": "ff9dbb2200f35fac652063f004f2bfab", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289772, "uuid": "7cc0be18-bf47-4753-9c7f-fb9f9030bbc9", "comment": "Malware payload (IcedID)", "value": "461c37ddc22a857061749d3ea27e5bba2e0b0cc6fb81abec48698d780a2ca333", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289772, "uuid": "cb28344a-1899-4c3d-8263-6d65de368f5e", "comment": "Malware payload (IcedID)", "value": "17c6544340bcae3eaa63dd85cefb0da30d3412cd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289772, "uuid": "d5a56f08-4d3e-4f13-a243-a7ce60330fb2", "comment": "Malware payload (IcedID)", "value": "ff0e402d571fe1aab71aaf67b254b2843bbfffae165ec32cfbce528268c47c5eaba212d58885debf1ed845d889be7273", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289772, "uuid": "a76ad462-8be6-4023-811d-137084788ff1", "value": "CB838CCDC913E1D9C2559FBD5A09308112F4E0B72B6FF11B148EA62E4D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289772, "uuid": "6e816380-4b2f-4123-9c48-2be702ce033c", "value": "1536:IB240XZfcaaxf+EQliU2haw2CAIoo8+BNvMhfvNR:+2d1cBWEQXM29o8+nEhHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289772, "uuid": "53c78647-5cdb-46c1-beda-2df1c41e3ede", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289772, "uuid": "ba80eefd-3b78-45ce-b536-db41745d23e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289772, "uuid": "4ee96926-9c84-4b6f-924d-de7f4f91eeed", "value": "1710.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93198742-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617298925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298925, "uuid": "8cdee19b-26d1-4b20-a8c1-d408c859077a", "comment": "Malware payload (AgentTesla)", "value": "476b7634ec9de6d41dc5a4152aeb94cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298925, "uuid": "9d6c0c11-fc7e-4944-949c-c175754886a5", "comment": "Malware payload (AgentTesla)", "value": "4620919f607e9b78453f0b3e2c9459277387000664c39972d344abcb32dea578", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298925, "uuid": "916e4c4c-802d-490d-bb5e-53fdac3041f2", "comment": "Malware payload (AgentTesla)", "value": "02b3bbaf1341bcb3c4263758544f3b0525168085", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298925, "uuid": "c6c5e1b0-c6f3-4345-8cf4-a86c679301ab", "comment": "Malware payload (AgentTesla)", "value": "b5bb210133472324a7c0d2a2ad587d92b8403f58465da2e376c3070689b6185fb4d7eec8e66e3712c566efd2a0716b49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298925, "uuid": "87798b72-6af9-4456-90bb-713630590cbc", "value": "08B423694EFA828C34FC4BC5500C93928A67175EC87622DD643531EFB11CDB37622F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298925, "uuid": "f4616876-f7a5-438e-aa1d-3b6d4271b8eb", "value": "12288:2sZ6jogN+aIMcXx8F6UkEm7+6SyeKfjdyDIanBDlclumjx:MjL/NcB8F6Uhm7+AJj0Htlauqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298925, "uuid": "35fcf7b4-823f-49dd-a267-1444aa78b1f3", "value": 505449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298925, "uuid": "2242a487-5984-4ebc-b52a-71e898a470fc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298925, "uuid": "2f018434-45d8-44ba-b06b-387f8ff855a4", "value": "Documentos de DHL..PDF.....gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff7a5ec-9313-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617299564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299564, "uuid": "7e7a5c1b-12a6-4343-8b7d-7161ca6b22e4", "comment": "Malware payload (IcedID)", "value": "5f7f2cf536586a640ac15996c6c82983", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299564, "uuid": "334cc8fb-69d4-4310-a70e-0177ab088804", "comment": "Malware payload (IcedID)", "value": "468929d95e54416bbc7d6830b20e7f08f46001742fe9c3be1a2ec42a4dd79708", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299564, "uuid": "8a8402fc-9860-49ee-ba9c-61c60fb5d1cf", "comment": "Malware payload (IcedID)", "value": "edf40491c750b5766474eb862f4155938cc97474", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299564, "uuid": "79b9b150-4077-46ad-a986-d1e063ff0e33", "comment": "Malware payload (IcedID)", "value": "5ddbe2bd7eb81c304b7cc7cba6f40e206dfce163e5bb598d77603741d5a3d6358d9faf9608bde2c54b882d9905389e2d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299564, "uuid": "e343ee05-4c95-4edf-9454-3ac1a778abd3", "value": "3F04123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299564, "uuid": "451a458b-b06f-4569-a30a-9c97b90b2e36", "value": "3072:/XE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:fE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617299564, "uuid": "0f5bd4c7-0ab6-4a16-8175-d6256503ba0e", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617299564, "uuid": "3a7c88bf-cb1d-42b9-ab4c-940ba8379a62", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299564, "uuid": "fd2dcd15-01e0-4a93-b8ef-eed85b9b65c0", "value": "9185810393-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65ef618-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617278422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278422, "uuid": "fad7eae2-11fd-4644-95d6-84a49e83444a", "comment": "Malware payload", "value": "6960c89cc1d69cff9521081717a69055", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278422, "uuid": "1ff96319-b5a8-405d-a9c9-aff760742140", "comment": "Malware payload", "value": "469438255a5585b4f6328f2eece8e14a55982cf9d033261f8e95611b6daf0eab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278422, "uuid": "56ca2bb4-0897-4c5f-a6ed-06809d33f55a", "comment": "Malware payload", "value": "57b2ec6fd36d50852c71d9dcbd6463984079d8d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278422, "uuid": "7a580b18-f65d-42ed-b1a0-9f385fb6052c", "comment": "Malware payload", "value": "b543832168de003f6a4845808dffb75a611ac03dda1e352c528f8b994f2fccd3ccfc92d78fb1d4c3c98bdd49f2e785a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278422, "uuid": "f5759848-c541-4db0-8800-66aeaee50754", "value": "9C81CA7163835C7FFB1109B316136CA85332671112AA015EB74B45EF2F1DCD7E815791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278422, "uuid": "7044a269-9059-4bf9-b4ec-0171fa22270a", "value": "200b04217a4fe996f3bfd28f01a49352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278422, "uuid": "139a982d-67eb-4f66-b251-f22078f1d4ea", "value": "48:qvRhJfGtoeKdVxJK48ZZY4KJY0fnQJIuLrA0RuqS:bojRJK48ZZxQo9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278422, "uuid": "437634a9-120a-4c86-9711-75efa56927b6", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278422, "uuid": "ba2db04b-6381-4c84-a24d-eacfcb48be04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278422, "uuid": "4d2e8bf5-ba8a-49d9-81c8-a4fab492dc7d", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.12301.14149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524e3f03-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279060, "uuid": "de236e4a-e5be-404a-9dce-28bd0bbf1dc1", "comment": "Malware payload (IcedID)", "value": "d65a6d5caee8f7fdec0b59fe1f0b28ac", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279060, "uuid": "a94c4b47-877c-4653-a6c4-f13b64150539", "comment": "Malware payload (IcedID)", "value": "46b580f63f8ef1c1651de9a54495422f1d14965647a35e976b24e6d0860ff346", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279060, "uuid": "b609544f-8e05-4210-aef2-609b9df5b290", "comment": "Malware payload (IcedID)", "value": "ffa228e2a40f966ba562f5b83e83116d14aee02a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279060, "uuid": "7ed939dd-59a9-4923-8481-91d770212785", "comment": "Malware payload (IcedID)", "value": "f718ed85d8bd77bec219f25c24f10e3442a1be7b9eff194b5a3ecec767dea3acfc22542a9eb5f57444035489c1773d58", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279060, "uuid": "f77af775-8857-4c57-9c9e-89778f61ccfa", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279060, "uuid": "04f98776-4abc-4c19-8adb-6f47f825648a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279060, "uuid": "07c2aa63-f134-4a30-a975-760f0db92e0d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279060, "uuid": "8a491d4a-a414-4294-9f59-ee77ba17c178", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279060, "uuid": "2b7213aa-b5ea-4d43-b2de-f3cc84d48926", "value": "document-367523588.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69180086-9319-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617302291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302291, "uuid": "82601ad3-5c76-476b-a0bc-69407ef9ad82", "comment": "Malware payload (AsyncRAT)", "value": "6485d4f8c1a93edb02cb3351f9cefe52", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302291, "uuid": "7bc69a83-a5f5-4f7f-b7ab-e213610d2df8", "comment": "Malware payload (AsyncRAT)", "value": "46d686afe1ea52def195a67a13cd2793659e8657f1b641d8a83aca5add65488d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302291, "uuid": "3fe461d0-b730-46b0-8a1a-e89fd084416e", "comment": "Malware payload (AsyncRAT)", "value": "0e1025a14c5c7992a85a430891d0e25d0b6c6552", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302291, "uuid": "d1d94fc6-796c-4d0d-8e83-787735016b49", "comment": "Malware payload (AsyncRAT)", "value": "cacd54eb07f3bcd525f21de33297bcea2434d7e1851fa8aaf66a668cf2fc6fd4f755cd4c51c0c98921799ba0555b7533", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302291, "uuid": "ebc70eec-98ef-428c-86c7-72a7ec6e15a9", "value": "A7017B8D051DB0E71BA561434DCBAE2CC278037EABBA5908825AC0F5342FDF9614BBF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302291, "uuid": "b5cc75db-347c-447d-a4d1-008ff063e2f5", "value": "12:Zn2/GhZoKc8OtmammtucslMMtEi3/stMM42I6ogsOWsMW2zEpFJIflX:ZnnJO80UzlMMS7MMS6ogr1XtrQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302291, "uuid": "e14c5f0d-ffef-488b-8de1-53df23f8a4de", "value": 706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302291, "uuid": "2cfbc95f-1220-4d8e-936d-817a85504e7e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302291, "uuid": "7cb0ef25-e2da-4dcc-a639-a1ed41165c49", "value": "Statement-ID1171154451855.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fd6a72-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275890, "uuid": "500183ee-b85e-42fa-9d9d-ecdad64e4027", "comment": "Malware payload (IcedID)", "value": "4e41dbe1cc4dc39d3bc084feccd0f603", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275890, "uuid": "c8b3bac1-03db-4cd9-9783-ae215121a891", "comment": "Malware payload (IcedID)", "value": "46ed69ee0eea2190bae450abd67326ed343d884ac6fcb20a3dcc5402eb7d2daf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275890, "uuid": "a6f840df-2aa2-49e6-9f3c-c74347225014", "comment": "Malware payload (IcedID)", "value": "da58ce54f89507ac9b2b76cbdf70d792a4a3d97a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275890, "uuid": "f96bd26a-53b4-4c35-8d82-b82cfeda03e9", "comment": "Malware payload (IcedID)", "value": "7e047e7d5859ccb380e4f163c4cd0b37b7fa25834028ad077219057bcaa1e799878d4e946f4cedaec426b4f788b5a923", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275890, "uuid": "f846021f-6ce5-4588-b8a8-4adb554e9244", "value": "7A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275890, "uuid": "3d5de71c-aceb-484a-89ef-71a275b434fa", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275890, "uuid": "789d9608-e762-4b0a-b87f-80629e93b1ae", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275890, "uuid": "e4ef5ebf-564d-4698-a19d-67378748cfd5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275890, "uuid": "99bbf993-e349-4c47-b231-cd5b92e7d76a", "value": "document-542780138.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c118ec-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282468, "uuid": "697ed912-6e27-4da1-b912-0582917067bc", "comment": "Malware payload (IcedID)", "value": "65d0c17563cc2e05aa7836b8928612b2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282468, "uuid": "75c9418c-19ce-4f75-ac92-74aa525983e5", "comment": "Malware payload (IcedID)", "value": "4733fbfe636a4efc8229f1ba5523e3766d7bfe50abe30b367e10b1dc68350e34", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282468, "uuid": "e0fc9b69-60f9-48e8-9084-6990a5359061", "comment": "Malware payload (IcedID)", "value": "56d3259e93dcbbdffd11b78f9351019810db2193", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282468, "uuid": "99c21050-5053-4775-898b-0f7922da8e70", "comment": "Malware payload (IcedID)", "value": "35c4812f15cad94eb19c42f90367a152c7b535176b689be90ff6dad3b912781ba87ae193b68246bb1a7be9889ae5a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282468, "uuid": "9cc0237c-2b0a-40f0-817e-2c9d0defe8cf", "value": "6B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282468, "uuid": "07434f8e-645e-4cb0-a680-916d6d148fb3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282468, "uuid": "b12aeb8b-0af9-4c64-ae49-fb9d1fe72673", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282468, "uuid": "637a7702-9f43-497c-abed-1367d0449a38", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282468, "uuid": "bfe6e020-9b0c-4914-adf7-22ab3fc9a542", "value": "document-1283945315.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f8a1b1-9334-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617313800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313800, "uuid": "b3d22954-3eda-4a3c-9060-692b3a8f8340", "comment": "Malware payload", "value": "5b3751c122a2f18f8d0adcb2f6089f52", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313800, "uuid": "58d8e4aa-bb73-4787-912a-02226675bf8d", "comment": "Malware payload", "value": "476328ee287fee4aeffa1cd30ca2825d268857371012ffed6dcfc5f1c0476845", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313800, "uuid": "edcd6b28-0a63-464c-9e02-fcdbc4b928c7", "comment": "Malware payload", "value": "50543c4edfd2c6173f077d57ef6b05d337addbe3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313800, "uuid": "1f089309-0de6-49e7-acbe-fe693bedcfbe", "comment": "Malware payload", "value": "91d98a5838fed738424a1c20864a9ce1968b53d21263ff39ddd98b3b091699dd0a5aa27b607488bb3b3e1b1fe2b5c03d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313800, "uuid": "cd03a56e-dd70-4432-9ac6-54195dda4766", "value": "B114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313800, "uuid": "a71a5c3d-aa42-4435-894d-37f914626546", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313800, "uuid": "50f64ad9-b3aa-45a7-b82b-7b6552103ec0", "value": "3072:u1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Gi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617313800, "uuid": "f43bebec-1698-48ac-950d-01e9f04e4fc2", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617313800, "uuid": "c9a003e7-0b28-4345-8db3-e71ad8118f0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313800, "uuid": "3fb20a1c-243e-4358-a013-75d44b5e098e", "value": "476328ee287fee4aeffa1cd30ca2825d268857371012ffed6dcfc5f1c0476845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b1a8fc-930e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297644, "uuid": "064b34af-5fa2-46b0-bb28-8a02177f1c74", "comment": "Malware payload (IcedID)", "value": "e16cdf6cf40cf77371c3f094b08bfbf8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297644, "uuid": "9e3ada4e-187f-4466-b67c-ac1977e569cb", "comment": "Malware payload (IcedID)", "value": "477183deeace02f1fb13a8fa5452e6d65c5bd65d124b02d4fc73e05bc34b6711", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297644, "uuid": "78902e0d-7af8-483a-9418-862dd96fff15", "comment": "Malware payload (IcedID)", "value": "bb20205a463d10c0e6f32c2c52a9d3762c60d3e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297644, "uuid": "b9687338-bcf0-48e7-b9ab-b3113e4c7b04", "comment": "Malware payload (IcedID)", "value": "242658a40e433872f9cc527b530ea4357c21d17aaf9311d326f311bd33e56d3570fdb7e30bd77eea488c92881acb2960", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297644, "uuid": "14329c51-9fa1-4bd2-9069-0ebd7e9467e9", "value": "7F1408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297644, "uuid": "622b4d23-e7ad-4ffd-a5d6-781a9bcdcc32", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297644, "uuid": "8b71e1fb-ced8-4e9c-b56d-3c4bca0e484e", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297644, "uuid": "c1156579-b8f8-4085-bd19-b978e3b46664", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297644, "uuid": "037de6b0-4130-49a6-a49b-3144fcd92a0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297644, "uuid": "6043410f-3b6c-4c60-98b6-0bf7c102c249", "value": "477183deeace02f1fb13a8fa5452e6d65c5bd65d124b0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1956b388-9333-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617313324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313324, "uuid": "8daba97f-eabd-48a8-9daa-638c41eebd96", "comment": "Malware payload", "value": "fe8374e6d018647f9b18525fded0587e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313324, "uuid": "b9f0343a-fd3d-4918-8247-b1dff75611f5", "comment": "Malware payload", "value": "47929ede53f8b5821a3d52e42af3cc6405f98b61b26de7a11b449bf4b35d0a44", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313324, "uuid": "125fedba-6ef3-4745-9a1b-db72d4efa1d4", "comment": "Malware payload", "value": "1b54ff983206ecc48e7a116cffb9a61d9fee3904", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313324, "uuid": "9fc17a1a-e736-4335-8ce4-80109d5b61da", "comment": "Malware payload", "value": "54b8a092a2d1ec99d0806f6b92a86ae91604cfac211963e706b81176e29ac25f234048e1a91bf5dd2310668021639e63", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313324, "uuid": "e67c691e-d90c-4b2b-b204-7689eb93ce19", "value": "4F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313324, "uuid": "dc2aa664-0994-419f-8b6a-fcfcdff4fa6f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313324, "uuid": "f7312514-062a-424e-bbe8-179033c807cb", "value": "3072:gopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:HpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617313324, "uuid": "b0016613-1046-4ff4-9817-aa6e281eede5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617313324, "uuid": "f5f12037-c5a7-43b8-964a-ac52302711b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313324, "uuid": "eba039e2-e538-43da-849f-b01e74d7bd1d", "value": "47929ede53f8b5821a3d52e42af3cc6405f98b61b26de7a11b449bf4b35d0a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17f2b30-9334-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617314062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617314062, "uuid": "e670894f-8570-40c2-bde4-8542a5f45a9b", "comment": "Malware payload", "value": "9ea9132dbd28f48e95a4ed68377e8eae", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617314062, "uuid": "0b4e0418-6cce-4925-a3f7-e41fe0b1cec5", "comment": "Malware payload", "value": "47b089c833394d9bf5c6b7ed1af788ac5b17bebd8c71dc54c3cba8ff599674a1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617314062, "uuid": "8e880ed0-35c1-407f-b6a4-8680bb0e611e", "comment": "Malware payload", "value": "72978e862173cdccca67b3d6cb61dbc0f950b88a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617314062, "uuid": "114cc2d7-ba9e-4deb-8a86-635e1ff7ec2f", "comment": "Malware payload", "value": "55f211e6ed350d5c7b0fc13af044a3049d1f536bc917dd903e50e1cf1801c72ed62d6772ba52cba13e937c9bafc96e7d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617314062, "uuid": "58c3b660-9ce2-4986-9e97-3b7033fc7c2e", "value": "A114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617314062, "uuid": "431e1968-ec6b-4200-a7e7-caec464adb1d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617314062, "uuid": "d01450b5-af92-4a4e-9f0f-7952ac516967", "value": "3072:Hopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:IpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617314062, "uuid": "145b472a-d633-4312-8318-354d21b17ac4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617314062, "uuid": "a706b16a-63f1-40d2-96ac-ca092ca7d4aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617314062, "uuid": "4c9bc38b-02f3-4b51-88e5-ac2e8a44182c", "value": "47b089c833394d9bf5c6b7ed1af788ac5b17bebd8c71dc54c3cba8ff599674a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2eecc9a-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276296, "uuid": "458e3fc5-ccf6-4f42-b8a2-dad39792b6ff", "comment": "Malware payload (IcedID)", "value": "138917470012343f5c6a265cf57d56a8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276296, "uuid": "0ffb3a94-1df0-4161-b995-4e68295d715b", "comment": "Malware payload (IcedID)", "value": "47f955a51ce127fdaf6b21d30824c5752b4bc50c8522e6484f86458640853b86", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276296, "uuid": "4fc9bf1c-d688-4cd3-8d6f-1c8295c584df", "comment": "Malware payload (IcedID)", "value": "1d89e56bac3966f562d41db9064c295083e539e0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276296, "uuid": "76d2bdae-1320-436f-a0db-d31beeebae92", "comment": "Malware payload (IcedID)", "value": "942f0c3819adcae4d7984a124aad40cdfa91e61419d85d532d1e0088ad5ac3bc9f78328dd792dc71a7b99e4e6d1f58fc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276296, "uuid": "4688e97f-342e-4414-a134-980cca327a40", "value": "84044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276296, "uuid": "bb01d7c7-6a31-450e-99ce-25e20adc6984", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276296, "uuid": "faf5c491-89bf-4492-b9f6-10e067f23dd3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276296, "uuid": "6b54a745-d161-4aad-91fb-31fc75d4a57e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276296, "uuid": "ef2dc880-4995-4c40-8f5e-7d69a5f07308", "value": "document-365887191.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e9f4ca-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279876, "uuid": "8b8207c9-728d-4607-b78d-4e3beefe4753", "comment": "Malware payload (IcedID)", "value": "09d41d14738707c2ce1e28b2313e1e5c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279876, "uuid": "07618531-fb2c-4f1a-8a6c-946a106f6dc3", "comment": "Malware payload (IcedID)", "value": "4844dc6311611acbba6d5afd762bcee79e3b4a5cc0d3d89b0ddc9c486f7b8d5e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279876, "uuid": "f78066a7-b8ef-4ba6-a947-ce4f223d2007", "comment": "Malware payload (IcedID)", "value": "5714bc70d7d24c3db8c939c89fcea4b1d62736df", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279876, "uuid": "97c3285e-59b2-4f56-9916-a922207481a4", "comment": "Malware payload (IcedID)", "value": "e20b89275cffe45119dac65f1fff02ec119371cf4b5547ee1cd273145d822f65fd02829c7e2e91bda8fdf16c5aa33eff", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279876, "uuid": "4f578297-6dbc-47e4-84de-82318ce3a5d3", "value": "C2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279876, "uuid": "d69ec8e7-30f8-46ec-bd73-2f30ec3cb4ab", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279876, "uuid": "91fa0cb1-dc4a-4683-b687-292dfb71375f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279876, "uuid": "0f194fed-f818-4759-bf97-2175d9bce24b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279876, "uuid": "ababb9d3-1445-42c2-94d1-075e24537058", "value": "document-1370071295.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55096256-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279923, "uuid": "ace374b1-0bc8-4652-98aa-25a0c24e6248", "comment": "Malware payload (IcedID)", "value": "a682c271f3d5c3a1838e170aa04e7e8f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279923, "uuid": "f6abfdaa-006e-43bc-a08c-ae5351a78bcd", "comment": "Malware payload (IcedID)", "value": "4885a32a109f7cf10d3995b200a109fd3fc2fbe60723cc8748c9161562eb32f0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279923, "uuid": "c65ed4c5-3ea3-4624-bb9d-68e9dd461546", "comment": "Malware payload (IcedID)", "value": "349b7bb198bdf4a108cf8e83ae915ec78d25e01b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279923, "uuid": "10090f91-07dc-4b33-9a46-06d2e17e097f", "comment": "Malware payload (IcedID)", "value": "b75a79570dcf4baae307fe5967e15293490678aa2a249b7ba49242c7a82d576778ac6855b4f422e9976736e4afd9d84d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279923, "uuid": "ecf8cf53-46c3-4574-b5e8-acdb824751d3", "value": "BB044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279923, "uuid": "92f44604-0d1d-4cba-8dc3-c2dd0fecf0e4", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279923, "uuid": "51ebd20a-6ec4-4b87-89e0-7d6e997ec283", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279923, "uuid": "a05f7eb0-42fb-4581-9f87-dafd38a7d6ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279923, "uuid": "db811990-e260-4cfb-9eed-b3c7a080caf4", "value": "document-86584084.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43569539-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279034, "uuid": "07f2caa6-f961-4391-b6c1-c9c7ef061f14", "comment": "Malware payload (IcedID)", "value": "c2fb9ecb28ee1efe97e063d21cca8942", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279034, "uuid": "d6a0a923-c9b4-479e-8a55-643a52e8ed5e", "comment": "Malware payload (IcedID)", "value": "4899314120559721e8994ef3da70e0d8bd246420581986c36eb7c561ac453018", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279034, "uuid": "5d721466-76f8-42e9-9f32-e47732348ffb", "comment": "Malware payload (IcedID)", "value": "1ccccc245f3c73afc64237989bf38d89d2477acf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279034, "uuid": "6e93d105-f43d-4c7a-8a5e-461b178e5e34", "comment": "Malware payload (IcedID)", "value": "12c09ade204ce89978ba968260d50e2e719c3074bae2fee5acf982c562803032b9d3c01615580d32faaa078a479cf547", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279034, "uuid": "eb2f39da-09ba-4e47-9199-45478fb00929", "value": "1E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279034, "uuid": "cf108150-7421-4e58-88d0-da5b6c1ce204", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279034, "uuid": "e6fe4793-63fe-4131-8665-40000e8cdfc8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279034, "uuid": "bcf3580b-fd48-4466-80a6-b098f171a7f2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279034, "uuid": "54079957-b554-473b-aeb6-e310a4a13d86", "value": "document-787520459.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4573a300-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274743, "uuid": "af72b724-68f6-4cc4-933a-febcb2b9794a", "comment": "Malware payload (IcedID)", "value": "e5da301dbd17f04c16c7a86793d2cdce", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274743, "uuid": "6c6f903f-3dc5-41b9-9258-4a7822b9e605", "comment": "Malware payload (IcedID)", "value": "48a9e69ed595b7c215bb343bb6fb38bf479adc77ef9407032805252bf70b0a1e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274743, "uuid": "8bbcb2ae-83d6-406c-93b6-9ccc11f31fbe", "comment": "Malware payload (IcedID)", "value": "a7bdefe06b20ecf942904c11af72878c9f57332d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274743, "uuid": "bd94afbd-0ff4-45a8-9aae-b6b5fe561803", "comment": "Malware payload (IcedID)", "value": "c1447793164272b9b899d1b1a76cba071c7737a610e6df43aa122462ad42b90f1d8d8b1ba743249c2533627cdba6ba59", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274743, "uuid": "b6f19582-a6a0-4e58-8a6e-32231b43d4b2", "value": "F6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274743, "uuid": "75128fd0-e8f6-4f21-9698-a411c58f0d28", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274743, "uuid": "19b1ef5b-a3cb-4c53-bd67-64e15bc8e5df", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274743, "uuid": "d210c8d3-3151-4237-89b4-97224017b17b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274743, "uuid": "5ab1cfd2-fc5e-45f5-9d45-f7a3da3f22c6", "value": "document-1342055899.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8b4887-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284793, "uuid": "dcac6b84-312f-4c64-914a-4e735c57f8a7", "comment": "Malware payload (IcedID)", "value": "3033b8ce461fc842f3e79fd1772ef6c7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284793, "uuid": "07f49735-5f52-422c-a2fa-abc73de43830", "comment": "Malware payload (IcedID)", "value": "48e7969174be6b3d0aad00ad6d2fb4d49e4d5a6fc8e44633655abbbad6c14dc1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284793, "uuid": "d797122f-4d2e-40cc-9bbc-5704493244ab", "comment": "Malware payload (IcedID)", "value": "1fd129b4465761e6d89f132e8b98f3fe0d170b4a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284793, "uuid": "01693c88-a583-4beb-a424-b98dd7e6b220", "comment": "Malware payload (IcedID)", "value": "cd737920c145863bd40ddea2d18bb3f28165796e297abe5a448918c58130fa919a3fa69618873bc6b9aef9d183abf110", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284793, "uuid": "953ed966-81ab-4d57-a031-330dec763d47", "value": "D5044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284793, "uuid": "2ec39529-1d6d-4297-9bc7-d4b83878ea6b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284793, "uuid": "7e1ea2fa-ee57-413d-a97e-3b3bb6061793", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284793, "uuid": "36278ce0-8f1a-4cb8-997c-9dc38d2fec69", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284793, "uuid": "8ae163de-9ff3-4660-9768-0d2d47ca717e", "value": "document-1597268706.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448cb026-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274742, "uuid": "c92f52c7-fedd-4163-96f6-2478c252a57b", "comment": "Malware payload (IcedID)", "value": "deb5b59aa971fba13e39945efc7b3521", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274742, "uuid": "0beeffd1-8e5e-47a1-8099-1fcef99d1bf1", "comment": "Malware payload (IcedID)", "value": "48f274eb8a714fa7f55df0d6ec20744b77d60ee47e2431bcd00448b1afa8fccc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274742, "uuid": "175166b0-1c76-40fb-af26-4aae4f27380e", "comment": "Malware payload (IcedID)", "value": "25014456dc248ce5b7e3109063bb67b86718a0e5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274742, "uuid": "3d74012a-6613-4a92-a7e4-83c1b112b801", "comment": "Malware payload (IcedID)", "value": "127895c2c0c3ae5688690dfa96dc42acfe23c4172815aeaee3a0e1457cfacf7626bf48486ec5e47e8fbdbe753217d625", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274742, "uuid": "e85df13d-927b-4972-bdfe-64fd79a0137a", "value": "82044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274742, "uuid": "4bcb41c4-28f3-49c7-b64b-8d17d5147b67", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274742, "uuid": "66d7ff4a-f607-4957-810d-c07a7e343d72", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274742, "uuid": "68ffd168-abc4-43f3-8ec5-b64e140aa5e0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274742, "uuid": "5a4cde89-464f-4687-82c5-7a547ce2d5b0", "value": "document-1477590300.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52eaafab-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282497, "uuid": "f63c74b8-1ced-4346-8210-cf304d00b0d1", "comment": "Malware payload (IcedID)", "value": "0ec1608037a1c3cf85c94f5fcd244b5a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282497, "uuid": "3f6611c4-2044-4e86-9c32-96fac903262f", "comment": "Malware payload (IcedID)", "value": "499a01bb48974cd5e326cfd3be3825e38c382334b5e129cacbefa3703c5cc710", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282497, "uuid": "bf6ab675-c1c2-4e33-a38f-f9124d80166f", "comment": "Malware payload (IcedID)", "value": "a1d20545cb0a1162a76c94a171b3ec9892e53a9e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282497, "uuid": "a1691c6c-62b3-4cab-bbd1-1491cb0575c2", "comment": "Malware payload (IcedID)", "value": "1f9b69aa47b7f6e71aa6e8cf5d1f8431f621a8d7f5a719f4f121ac48b5ada5ddd601753f41f8cb5773479b12a9e4a0d3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282497, "uuid": "1a942e01-53a2-477d-8eaf-c1d0eee165e1", "value": "82044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282497, "uuid": "43845b35-234f-40af-b4b4-0e264f82d530", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282497, "uuid": "1218dd50-fce8-4f9f-b80f-55be9c7f0b3f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282497, "uuid": "e4eaf497-0b41-4ceb-9415-8f9f1fc4b64e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282497, "uuid": "4afc5799-624d-4039-a80c-6ef8fb9dca8a", "value": "document-1145143520.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457fc0fa-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261858, "uuid": "68b50e6e-291d-43dd-9ceb-b65d4bd46f4e", "comment": "Malware payload (Formbook)", "value": "921d2aed79b6f2df1b51020743f436c2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261858, "uuid": "54052834-b0fc-4ce4-a02c-480df0ddbf26", "comment": "Malware payload (Formbook)", "value": "49d423618a124a488614951fdecc1b2593c8e32b5052d0a541069b3ea4d1720b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261858, "uuid": "a20341bf-2902-400c-97e4-9e1b4cfbd862", "comment": "Malware payload (Formbook)", "value": "5189bef9072be52a046b51370c6b9a70a8455622", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261858, "uuid": "50001eac-684c-487c-8f3e-c60c91cc111e", "comment": "Malware payload (Formbook)", "value": "a8528dc5f37d4ef2d85691549cce4ebfac73b5b2d738afbe18b93956536c4ceb7ca02c58e3026404e0cf1e127f260d32", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261858, "uuid": "b013c6ad-821c-4309-9704-7faef09651f0", "value": "2F94238CC52360633C2E5E5D281261E372099C56759D98A9E5FBAC02ADECDDCFD4C0DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261858, "uuid": "f8289e29-bc7f-40e1-935c-0c287417dce9", "value": "12288:DN3Z4v09vnyyiHxf01QCC6Yn4v0DCJdKHS76EI58Lzvo5lCEh:D1+v0oy60OOY4v0WJ8HSuRGg5vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261858, "uuid": "5856a10b-ecbf-4d48-8544-df432d29de96", "value": 413059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261858, "uuid": "62c40128-a111-4a7d-9beb-c3137a9957e8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261858, "uuid": "43daec57-0e6f-476f-965e-338d11173650", "value": "QUOTATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1bc16a-9315-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617300771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300771, "uuid": "0d1a36a8-be9a-4547-85a8-ca699a0fba60", "comment": "Malware payload (SnakeKeylogger)", "value": "a70c3c45e8e193f62c00cadbf2348de4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300771, "uuid": "cbc9cf33-3e97-4284-8702-528fad308327", "comment": "Malware payload (SnakeKeylogger)", "value": "49f1a6edb36cfff9b0dfc2d9e9ef7d9888bffbcce1759c80e028661d137da467", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300771, "uuid": "05f6f435-a130-4d99-b12d-b5b278bc4e13", "comment": "Malware payload (SnakeKeylogger)", "value": "bdd9ad01cea73d93ee7719fab8caf9a344c13508", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300771, "uuid": "9e43567b-5f2d-4f02-b74e-dd80a1439c4b", "comment": "Malware payload (SnakeKeylogger)", "value": "154b87a2820582b1be1dcf8186c0ea6534c27736af30bffd7f453c3876b7ea4ef8effa2e09c2a1d1528dceae2c871412", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300771, "uuid": "4d3d3085-06a4-40e7-9f63-ac7fe3d29324", "value": "33C4338EB48E1ACF8E3A93E11B908F926CDBE0F1751F187AF7CA404D6856235C3059D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300771, "uuid": "1a1251e0-3066-4421-9784-257298092dff", "value": "12288:gXy1uJgbuSs7Y3Zkl4idq9WUKw7I25YWa3Q5srHGdPp9dF0SO3NWgZ:gXE/b6M3Zkl44qsOvYWaA5srHO7D0SOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300771, "uuid": "3fb09e46-46b6-4b35-ab71-934ba88782f9", "value": 572240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300771, "uuid": "af6fde82-75cf-4243-9222-56ae18a18e71", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300771, "uuid": "9d6525c8-b1f3-404d-b602-55d791cfb102", "value": "Image0001.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6f7ac6-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283534, "uuid": "d8b104d4-e3e4-46a6-8eec-bbb7e80b530a", "comment": "Malware payload (IcedID)", "value": "db0dba7ebaed070443b305546a0555f6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283534, "uuid": "794b06f6-2e99-442f-90eb-5f3171fb707f", "comment": "Malware payload (IcedID)", "value": "49f24c9fe2ad43e982c21a0ba7d0fa01c3bad34f1ae5b7c2ab814baac61317e0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283534, "uuid": "4f18ef81-67b8-4fb3-97e2-810db77367e2", "comment": "Malware payload (IcedID)", "value": "e39de0a7e1e0a754c3d720aeeaf56e4e55f17400", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283534, "uuid": "8384f9a0-b3ca-43ab-a984-9c2e372d8c86", "comment": "Malware payload (IcedID)", "value": "7ae49958ac5d0c61869a33348bd4a5f5a2e45ee0895f26ecbfec926a9860ddf4f3b5712a4ff61db94d0d10bfc511ef1c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283534, "uuid": "d327a4e2-86dc-451d-b179-b5cbaf8242f1", "value": "05044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283534, "uuid": "bdc9392f-8801-4bcd-8178-8f92eb48fdc7", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283534, "uuid": "da5c0c13-5e70-4529-a20c-92966d6ead8b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283534, "uuid": "30026203-1fe6-4163-b755-ba387660b9cb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283534, "uuid": "562e109a-35b4-40b4-bd5c-c5bb898c7789", "value": "document-1367488958.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342de51a-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617290176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290176, "uuid": "d0b57934-34fb-430c-abeb-34005bdcc73d", "comment": "Malware payload (Dridex)", "value": "1382ced568526b45d35aab2545dfd5af", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290176, "uuid": "ce53bc6c-cf7a-47e6-af18-21fb4f38f08d", "comment": "Malware payload (Dridex)", "value": "4a1d846969b018f5a47db7019e76b8dced665267575b602a8f04b90e9d3b674f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290176, "uuid": "d8001631-bdb8-4326-a17e-cd8a68827985", "comment": "Malware payload (Dridex)", "value": "21effec49736ce375240c090cc46f095dab02b26", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290176, "uuid": "8071dbbb-a41f-4d3f-a40d-f0d875de2b25", "comment": "Malware payload (Dridex)", "value": "cefb990cc1742ab3d8e9e0b05f3ca4f0fdcfd8935717b9c691b31c17c2e8e920ba23b897e923d02d7e317cfe7c3e0c2d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290176, "uuid": "cd9fcb08-470d-4d78-8f38-4399e9919015", "value": "A314BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290176, "uuid": "d80636e2-7d8b-4c6a-8db4-1d1fa2e90f83", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290176, "uuid": "47637910-4b83-4336-8229-dea56f4f2f9c", "value": "3072:zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:0pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290176, "uuid": "cc970ccc-50b6-4580-89a3-5e08fedba25e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290176, "uuid": "60f83a0c-ee93-4b69-8102-f32e0a9ef9d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290176, "uuid": "22d06a15-6415-4fce-831c-2376ee188fec", "value": "4a1d846969b018f5a47db7019e76b8dced665267575b602a8f04b90e9d3b674f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38273df-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283544, "uuid": "9fd6ae1e-e6d1-4d84-8c74-03e2f5120925", "comment": "Malware payload (IcedID)", "value": "400ead0d4ca590b452e5f3f973c9e4f4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283544, "uuid": "39520529-ff68-4c1e-ae95-ef506f84a866", "comment": "Malware payload (IcedID)", "value": "4a53fb2693d0f3e1484c81823c45dd940342d4d27ebe2c4078631bc7be1daed2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283544, "uuid": "43498c38-a9c6-4f9f-b216-130dac2a6112", "comment": "Malware payload (IcedID)", "value": "808774051d3e9551c46478bd02a899ddea6e9530", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283544, "uuid": "9bf98380-bca7-41b5-a582-a35a27806730", "comment": "Malware payload (IcedID)", "value": "0b6c13b14db00b12efa76a442c4631b4585490287f97e2ba79b6f99a64a8084f3ba46933d70d38f776ea09ac9d70a65f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283544, "uuid": "10d176a7-b813-4c03-9173-b40a66023b9f", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283544, "uuid": "05da2a34-af2e-4499-b4e9-80bfa2382b6b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283544, "uuid": "faf4a722-fd3b-4791-aeee-71e93cf9d5aa", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283544, "uuid": "08d697a5-15f6-4ee1-b124-2ddb1fbc7e9d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283544, "uuid": "8c6cfbba-725d-4710-a764-1ec3efa37ba4", "value": "document-1928492991.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7334d9-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281758, "uuid": "7c670a1f-a667-4ccb-857a-21172e55e5a7", "comment": "Malware payload (IcedID)", "value": "f868bec5f26548f795014e9bb1bd6249", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281758, "uuid": "6e1015b6-5b94-40db-ad3b-15a5e2ed7204", "comment": "Malware payload (IcedID)", "value": "4a6a0ee57646da834ce65dfc4fca5d241bd21b3de270b09dda0c493df664d615", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281758, "uuid": "26b009da-ffd9-45dd-b22f-ea310e321708", "comment": "Malware payload (IcedID)", "value": "923f96350efec3092ab1cda98232cbc34892d9ad", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281758, "uuid": "de513f3a-47a7-46eb-b99b-86a690d4399c", "comment": "Malware payload (IcedID)", "value": "6d3b17ce9c08888acc999e333749b69fd7f8468b2b3b2a30b62a7c2c23fad1ecb68791737ac6a4cbed686753c1330ff9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281758, "uuid": "8a9dffc5-e725-4a0b-94a7-1042e5f00ed8", "value": "11044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281758, "uuid": "89505cf6-ff63-453d-af34-ac9146eb2efe", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281758, "uuid": "19a61905-8922-4d1f-9845-45b548f7cedd", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281758, "uuid": "15104fb4-ff5c-40bb-b23c-ce3c16f9dc50", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281758, "uuid": "4ebefec3-21bc-435e-8d19-602b9f008c5b", "value": "document-532669418.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c7fb71-9317-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617301369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301369, "uuid": "3aeaca0a-f1fa-472c-b256-40e7e8b38c0c", "comment": "Malware payload (IcedID)", "value": "44988e5de52d64d99dd0c92f1c36ce7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301369, "uuid": "cd9d5526-664c-4484-bd68-64a9acef616a", "comment": "Malware payload (IcedID)", "value": "4a6ecab4c22a7a6d8ae800b1f9065e86fc2af51c6cb5729ae6a478476d336ef1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301369, "uuid": "cd68f085-324f-444a-8fa7-a208a7bb4b90", "comment": "Malware payload (IcedID)", "value": "b6681661ddbed3825c38b7fea3cca3be7441c2c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301369, "uuid": "971656af-b32c-48ec-83f1-0faed402c2dc", "comment": "Malware payload (IcedID)", "value": "686ac40fb3fbd0b496d76512990fe5da0af31d6af5519f3e4da8bb077ce7ea632743d1b6ceaf7a28b7873bbb90f0f88a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301369, "uuid": "f6a71d7d-ac8c-4c54-978c-36bac91682fe", "value": "C91408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301369, "uuid": "652a9298-65ef-4542-97ef-ea72256dd67d", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301369, "uuid": "6c941b7a-e619-4fdb-97fd-7fdcb8226889", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617301369, "uuid": "325121c5-f3f7-4ed5-b6a1-165e3244a26c", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617301369, "uuid": "9af2d5c7-fd51-4cd3-b60f-77b1f3f24edb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301369, "uuid": "bfb866e3-0512-462d-9b05-bea1faa5c153", "value": "4a6ecab4c22a7a6d8ae800b1f9065e86fc2af51c6cb57.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62453b4-92f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286529, "uuid": "96c0264b-91eb-4fbd-8877-52b795a5296b", "comment": "Malware payload (IcedID)", "value": "022dc199a1fb1bd1116ea7bb82c6376a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286529, "uuid": "892b5724-58c5-4043-b2a4-c229f8132be0", "comment": "Malware payload (IcedID)", "value": "4a80ad44287f37659e717ae6c6dec4274f057eba0e76cb0fea08a40b42c9a93e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286529, "uuid": "573fa626-27b5-4810-96fc-cdedea56b6e5", "comment": "Malware payload (IcedID)", "value": "ebad7e920cbabb29f383556a9ac85d6174f52a06", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286529, "uuid": "83464909-20f0-4336-b5c4-281782a64c3a", "comment": "Malware payload (IcedID)", "value": "dc5f0d145dc3a839a6948432f29be66ad2f34cb0cc646d3291c6a1c7a031e8e351a400b01f056da57ed1e0dc0bd5004b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286529, "uuid": "70aba5d8-e472-4528-b432-ef8979218cff", "value": "90838CCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EA62E4C42FA80A5E79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286529, "uuid": "29930425-94dd-4767-889b-4b8b42a80c62", "value": "1536:IB240XZfcaaxf+EQliU2hawYCAIoo8+BNvMhfvN:+2d1cBWEQXMY9o8+nEhHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286529, "uuid": "9067e0a7-414c-4ecd-aaf4-356a8d27e3d5", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286529, "uuid": "6ca2aa31-e882-47f5-83fe-06486138fe1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286529, "uuid": "e3e2367d-5ff6-4334-bb67-35ca6ac1dc40", "value": "2759.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505e4536-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274761, "uuid": "6438bfb1-9731-4a95-b4d2-0b3e5560e1c9", "comment": "Malware payload (IcedID)", "value": "e900bcaa48f9564e24cbd553b07b03b4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274761, "uuid": "ad3be618-6d9b-4a5f-b419-3ea3d8472d16", "comment": "Malware payload (IcedID)", "value": "4abe28cfd33f8b9db411a7f5f541a76af8edaeccce0ee8f60cf9b11217e30dd9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274761, "uuid": "39420652-7208-4e68-9107-faa1b637c8dc", "comment": "Malware payload (IcedID)", "value": "cf0621a6f85bfbe17cdf4cd2ca26c621ae10360f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274761, "uuid": "9ab375dd-7dda-4e17-b156-8abc5fce949b", "comment": "Malware payload (IcedID)", "value": "028a2bca03aa1432029cd04f4eb7d34bacde970467cb8285f03a01c946edd87b5ec3ef9c5027ba5afc4eb704178f4a7b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274761, "uuid": "f4f9523d-c4f1-47fd-b9ee-783f490cf2dc", "value": "65044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274761, "uuid": "204a8947-739b-415e-9443-a542d80df13c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274761, "uuid": "5b81c745-226c-48a4-8d43-be6f6a675a7d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274761, "uuid": "de2190f8-cab9-4bcf-b498-3d2d8c8498cd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274761, "uuid": "97053032-7901-4b59-9cb0-978564b70b3f", "value": "document-610890956.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d4af8f-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292355, "uuid": "9fbca6f6-ce3a-4b2c-a436-ab669b6571b5", "comment": "Malware payload (IcedID)", "value": "c5e524ba42277534b06e1caf08b49f69", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292355, "uuid": "d542e27b-5de1-4875-930c-3d2f62ddcfa9", "comment": "Malware payload (IcedID)", "value": "4ae851a0e888cd86f147758c582dab1d9a17bf79f7234d57830f7e079ff49a12", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292355, "uuid": "4baeb656-6556-487a-88ea-779b4d901b81", "comment": "Malware payload (IcedID)", "value": "43f75730110185c19a8f67d358b150f1c0bf72aa", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292355, "uuid": "14fffeb8-62de-420a-90b0-0e9c4c5691ac", "comment": "Malware payload (IcedID)", "value": "7828de4a9b57228ba0eaa384a080472e408001cdb0353e9d972c79cd7113a8d03d7f3aab82649b28c75582629b1a714e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292355, "uuid": "d5673529-972c-4bbd-bf62-9782c6e5da2c", "value": "B5838CCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EAA2E4C42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292355, "uuid": "3864cb49-374f-42e1-9c01-835390ec37f8", "value": "1536:IB240XZfcaaxf+EQliU2hawFCAIoo8+BNvMhfvC5:+2d1cBWEQXMF9o8+nEhH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292355, "uuid": "3d0c62ae-0c6a-4d2c-b74f-e310e017292b", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292355, "uuid": "7257d8bf-d3cd-4e77-8ff8-465f2f76434f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292355, "uuid": "0b38fa51-3fd4-4b87-9293-c57977044693", "value": "2390.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d334ccb5-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276269, "uuid": "0317168d-d7b2-4a55-84cd-214bfd8dfe40", "comment": "Malware payload (IcedID)", "value": "0aff5b23aa1e887f56ffee0e77db2e60", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276269, "uuid": "58160572-9017-4fcc-a8c9-ee5474d69204", "comment": "Malware payload (IcedID)", "value": "4b1a3da6747a076d8c299bc54775bcfd8d4df799d959d16b92dbc8c896acad88", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276269, "uuid": "aef07140-4f54-4126-84ab-b835881e281a", "comment": "Malware payload (IcedID)", "value": "777e48a0970e045e0261d181ff3fd6fc852c3249", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276269, "uuid": "ef8c9f9b-2cb7-46df-80e6-0b436bb82ecd", "comment": "Malware payload (IcedID)", "value": "e31fb142b04b0287aa3dd065c988daf73fd2befe5244c18b5237aa9a32c795b96b072c0b336b9ce57084135ceaf8d033", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276269, "uuid": "9fe652e3-fd11-4c19-ae76-3f83b9d521e3", "value": "4B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276269, "uuid": "eea84a3d-b501-40ca-97e7-83434f8858ee", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276269, "uuid": "44ae4a69-c13e-4139-a001-810f52f1d544", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276269, "uuid": "0b5d98d0-6b5d-47aa-af8e-6f460d8a3961", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276269, "uuid": "cadcb994-de2b-411f-b70e-ec66208eed96", "value": "document-610805978.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a00318-9290-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617243558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243558, "uuid": "5492ab3c-efdc-4974-912b-dea3cac18c0d", "comment": "Malware payload (Dridex)", "value": "7c54d2959d3d6bee9c5b79c67c7076f3", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243558, "uuid": "5cd7a003-aef0-42d4-86dd-7534c91ce4b8", "comment": "Malware payload (Dridex)", "value": "4b2cdc3fa6ed4bc76c8f19b0dfbc7fc013b4e889fabcacf57bbdda9138777f94", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243558, "uuid": "d93a1ec0-04a6-4be6-90dc-de5f0fc5a99b", "comment": "Malware payload (Dridex)", "value": "419689438ff2cc6088adc279cb9f92e06fdf9819", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243558, "uuid": "4b293b78-e91e-4d43-9379-3a3565f8e71d", "comment": "Malware payload (Dridex)", "value": "67b0964f12f3d3d805b73381b3bfa515437963b6cacd7068370aa4289d20d9acd8971e5cbd5ba573827464e4306e1110", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243558, "uuid": "5cff2695-1f63-4a15-a30c-09b7b494adfb", "value": "9F84D143ABD54472F6721F3804739B104BEFBDD64E308DAA6289211D2F673C196787AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243558, "uuid": "3b17ae20-b75e-454d-b587-156474b2b9bd", "value": "61ef004a8c2946a166c67bb888b0e53e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243558, "uuid": "a043c7b5-6a6d-4b99-b838-17ea7bac1cec", "value": "6144:wOhxWpCcRexubjH/WNQoGuBF4CEejyK0nnTaftjWnFGLOk0zEj/LDOc+gpHU:wOKcubjfA5BFiTaFjaPcvOcjpHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617243558, "uuid": "d65841d5-be26-4fc9-8dff-8ec92b5cba64", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617243558, "uuid": "fa6b0ccf-b788-4021-bb66-d134531fd284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243558, "uuid": "7394c576-e047-4ba4-8ece-9db4b52cb668", "value": "4b2cdc3fa6ed4bc76c8f19b0dfbc7fc013b4e889fabcacf57bbdda9138777f94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b47e0c-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617286090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286090, "uuid": "9bdb730c-3883-49dd-b462-f231e9e6b917", "comment": "Malware payload (Dridex)", "value": "1a9892bc28a968042ea5cadcb9407ab0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286090, "uuid": "2f9b228a-79e6-45a5-be0c-8b202c7d92ed", "comment": "Malware payload (Dridex)", "value": "4b2fcd9f21a7626255fd91d6d62289b6ac632b67c47d820ecefe27d08f4396f8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286090, "uuid": "cecf4486-b590-495a-b31d-9ae501c79a15", "comment": "Malware payload (Dridex)", "value": "e82260804c3f9a004ed90b45804caed68b622174", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286090, "uuid": "2ddbc242-8745-459a-a111-f6448ee6e95e", "comment": "Malware payload (Dridex)", "value": "24f2cce805e05d87269477c735facb8781fb181e48818a597d0c5c6218d251d1aaca6480a1fda75f7e38c0a452fc45ee", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286090, "uuid": "70e51344-7a10-429a-962e-57efbf843c05", "value": "7714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286090, "uuid": "50abeaa7-76f9-4edd-94b0-19a57fc5a910", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286090, "uuid": "5273c0a1-8b5d-4a1f-9ae8-2fe4292b7ac3", "value": "3072:l1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286090, "uuid": "859900d4-9775-4851-aedf-cc33e948b682", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286090, "uuid": "3781271a-a720-440a-b1a7-f217c1d46974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286090, "uuid": "2c64f249-42ec-4358-8f6f-efe0eea38f5d", "value": "4b2fcd9f21a7626255fd91d6d62289b6ac632b67c47d820ecefe27d08f4396f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff3eef3-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281686, "uuid": "1da11230-41ce-4983-ae94-cc4ae9ef5bdc", "comment": "Malware payload (IcedID)", "value": "8e48f2515bb4b949fd48ea2b94250f64", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281686, "uuid": "8980dd1b-28ae-47c1-97f0-3e953c24f0ff", "comment": "Malware payload (IcedID)", "value": "4b418b62318aa5cbcb69eaf348dcd2ab4272b045c9fc4a5ce8d52a864e04732b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281686, "uuid": "e741c42b-13c7-4282-bade-8872c6dfd770", "comment": "Malware payload (IcedID)", "value": "a36bde4689990b60bb86b691dd48b77a07723e9f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281686, "uuid": "14b58f66-7794-4aba-b842-b2b587af5487", "comment": "Malware payload (IcedID)", "value": "132b3f20a5201a0b95dbd9f5c1921caec9817165d48e220acce06fdd6d67424b6da0c6feaafd6b238fb9c258e71bb005", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281686, "uuid": "e551a2aa-6bae-4494-928f-95f9a4bdf9e0", "value": "B2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281686, "uuid": "cc4b4669-2318-4efa-824e-c7155293dea2", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281686, "uuid": "bfb65e34-17a8-4e46-84f5-168627c4a4ce", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281686, "uuid": "42d0a3de-19d1-4407-a101-c4394d14aa3c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281686, "uuid": "7e851918-223a-4282-b54a-611ee880e1fd", "value": "document-507596214.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd09b6a9-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286164, "uuid": "81dc6483-9f8f-4583-b21e-e66dc3a0f948", "comment": "Malware payload (IcedID)", "value": "f5941d57214ef5d5695f4d154d406ced", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286164, "uuid": "296b34ed-e882-4d3d-8cbe-dc91de9d831f", "comment": "Malware payload (IcedID)", "value": "4b71e3967416f8883ec523eef4ced299a9d2aebcb4660bdeb7822d349127f031", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286164, "uuid": "7a5ad8e2-288e-4864-a070-46fa09672ce7", "comment": "Malware payload (IcedID)", "value": "8f072f41de5cb32600c9fd4c71951d7851460658", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286164, "uuid": "acb964f0-0e39-4e49-8d32-64a7a9be5182", "comment": "Malware payload (IcedID)", "value": "2185fbf290beac73806fe5aa483dd52d7c0f46f1afe5cc2a45de221d505640cb6cdb28f56337f7ef2b4e79870b9035ce", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286164, "uuid": "7504f806-c269-4659-9a2b-4705aaf2daac", "value": "58838CCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EAA2E0C42FA40A5E7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286164, "uuid": "3d7da182-c4b8-486e-99c1-5cb92bc22091", "value": "1536:IB240XZfcaaxf+EQliU2hawwLCAIoo8+BNvMhfveT7:+2d1cBWEQXMwL9o8+nEhHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286164, "uuid": "86ba8c5e-0dda-42c3-9ddc-01abc174509c", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286164, "uuid": "be818b18-419e-4b76-9254-392fb3478dee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286164, "uuid": "770bbd9e-4f3a-45e4-990e-48edda089290", "value": "3023.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa6e2db-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284791, "uuid": "5915ace1-5d36-48fe-b009-317b49a9887c", "comment": "Malware payload (IcedID)", "value": "fa06994401f8b5a20477ead664efa78c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284791, "uuid": "053baa6e-d2a0-45ff-a886-8675e198ba0d", "comment": "Malware payload (IcedID)", "value": "4b7bf88183c64caf0b8826b86c0b73d1af3ed0575c0dc05d52568746af39bec8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284791, "uuid": "17e4ac8b-c277-44e7-bc22-181aa5572aa1", "comment": "Malware payload (IcedID)", "value": "c722c64ffa3cc25efdb751e6e0a12d7fdfaefc66", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284791, "uuid": "a267c487-72c6-486f-9160-0bbb7df20c55", "comment": "Malware payload (IcedID)", "value": "d87915193657057d33d47ca57566d4fcddb4ebeaa63b9f5980ebaa4f64207c527e073fab6844d2f12cc72449d92bf87b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284791, "uuid": "4bc6b5f9-ba80-48ee-a975-d925cfab9793", "value": "7D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284791, "uuid": "ac1e38ad-7409-4644-b652-3bc68926abb4", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284791, "uuid": "80fd5d3d-43c9-4d00-88f8-2090deb9f893", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284791, "uuid": "0f6d7049-46b1-40c3-85f0-aede4d540ebc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284791, "uuid": "64471a6e-593a-441e-bf88-67b748dddc44", "value": "document-1784086484.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e82434d-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287214, "uuid": "62fa7357-fec1-4364-b81f-8be5892689c1", "comment": "Malware payload (IcedID)", "value": "187b03d29b8ddc038c37ba729f9ba788", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287214, "uuid": "55aca420-27a0-4ebe-93f4-3a05f0d74abd", "comment": "Malware payload (IcedID)", "value": "4b866bfc21e5ceff401ef0725b59805bf6d225fe8182e37342e8b7f0bb7513e5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287214, "uuid": "d41334d6-48ee-4565-bfb8-92fe0fa1d363", "comment": "Malware payload (IcedID)", "value": "b94bae6728ddfd424869cada1f66af305aef7638", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287214, "uuid": "cdb0799a-3f4e-4511-b249-964a1aebd961", "comment": "Malware payload (IcedID)", "value": "93ee35183502f78a84a8f0480c1bd1abfbb32f70472f0115cf938ba75fece8b955aeba33ba1651910f4bbbad203b6716", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287214, "uuid": "eeecb185-0543-4035-a76c-a9546ad2c121", "value": "E4838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287214, "uuid": "cbdcc355-48b7-4b13-b34b-bb88e18bc985", "value": "1536:IB240XZfcaaxf+EQliU2hawnCAIoo8+BNvMhfva4:+2d1cBWEQXMn9o8+nEhHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287214, "uuid": "338f055d-0a73-4db4-a6b4-205e0af3973f", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287214, "uuid": "ff1df6a4-f396-4e03-90fe-5495bca92796", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287214, "uuid": "0f255ee5-5848-42e5-8531-440c2f85e4b0", "value": "2515.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa2adcd-930e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297631, "uuid": "c7f0133d-5389-473d-a755-ecc38f8fbdec", "comment": "Malware payload (IcedID)", "value": "4687ae23338247d145af493378e0fcde", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297631, "uuid": "46c79a6d-83af-4b3a-93d8-3773a7245ece", "comment": "Malware payload (IcedID)", "value": "4b9f640c6aa415313a2be2e97006ccc660eddbe181c01ebfe43d605de47c9abd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297631, "uuid": "df355956-d905-42aa-bdd9-912ec3937afa", "comment": "Malware payload (IcedID)", "value": "c47faa4798420e23cf4cffd02f3cce9b9c705727", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297631, "uuid": "d220f8e6-ebac-4590-86e0-a3c134718baa", "comment": "Malware payload (IcedID)", "value": "8ee9568bc37d9c39a40b5d4d3fe1fc02245013dcbaa304276a7f243cd8ee4f6b5833c73743af70a4e649e6df7318f953", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297631, "uuid": "33d4fc33-d89e-4f74-ab00-b8619f6dcf52", "value": "87838CCDC913E1D9C2559FBD5A09308512F4E0B62B6FF11B148EAA2E0D42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297631, "uuid": "ba2126ed-f637-4d4c-b375-b823978565e8", "value": "1536:IB240XZfcaaxf+EQliU2hawcCAIoo8+BNvMhfvwC:+2d1cBWEQXMc9o8+nEhHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297631, "uuid": "0420d263-d3e6-4d43-805e-2844e825df4c", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297631, "uuid": "5353fbc9-63a3-4570-894a-28076ba73595", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297631, "uuid": "d46d44ba-85fa-4719-914f-e618f8190495", "value": "1529.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6692b14-9290-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617243552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243552, "uuid": "ccf20fd9-d974-46ae-b162-cb2930082887", "comment": "Malware payload (Dridex)", "value": "c87575a00ac99c93aef90c6d60ef8f10", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243552, "uuid": "acecba5a-bc3f-4ae8-b9b3-9dcdb1d310a5", "comment": "Malware payload (Dridex)", "value": "4bb9b22224e3833cdbfbaa7844af39ed7f3aecdbbefc1eb87b99c58e247dcba1", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243552, "uuid": "577568e4-28a5-4ee5-81fe-236afc45e227", "comment": "Malware payload (Dridex)", "value": "03bbd8fa4d2f5fee337ffb05237f5901cf1e7c2f", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243552, "uuid": "c00808db-12d7-4659-8cde-28817c08565f", "comment": "Malware payload (Dridex)", "value": "b6aab2a332d30b4dc662456100b261517a1c59abb91d973d9f70f230f6e6885eed25bfd9ae6b85c81c84a91c1f6fbd16", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243552, "uuid": "4998d4ab-d7b0-4282-aa5b-7acfeb3081e8", "value": "9184D143ABD54472F6721F3804739B104BEFBDD64E308DAA6289211D2F673C196787AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243552, "uuid": "212c479e-4609-420e-9b6d-7e277d125c2d", "value": "61ef004a8c2946a166c67bb888b0e53e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243552, "uuid": "e4d96349-846c-463f-aa3d-2fb1599b644b", "value": "6144:LOhxWpCcRexubjL/WNQoGuBF4CEejyK0nnTaftjWnFGLOk0zEj/LrOc+gpHU:LOKcubjTA5BFiTaFjaPcHOcjpHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617243552, "uuid": "7c75c5d2-ceb5-4aa4-896a-ad7beaa6d556", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617243552, "uuid": "5b03374b-92be-4add-add2-eaccc0166c0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243552, "uuid": "48d607fe-8c50-42d1-a6b6-5d2fdefca416", "value": "4bb9b22224e3833cdbfbaa7844af39ed7f3aecdbbefc1eb87b99c58e247dcba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1a5075-92f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286542, "uuid": "9f459a40-f803-4291-a1e9-e6a4f71ea08c", "comment": "Malware payload (IcedID)", "value": "c89808c57b1404763649cf8f98f51c60", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286542, "uuid": "ea0db852-45e9-44df-946f-2dbec21ea052", "comment": "Malware payload (IcedID)", "value": "4bc8dd3509aa268c5c6279670d1c96b7b326a3f69be8b04d652765848834425f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286542, "uuid": "187f9602-eab6-4804-b3d4-44d7e084cca2", "comment": "Malware payload (IcedID)", "value": "8e949af6f906029b3d96567a4a579f483984eb8b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286542, "uuid": "ac3bd262-b4ae-44d4-8eaa-b24d3903d1da", "comment": "Malware payload (IcedID)", "value": "1b9414cd733e9d0b4a490fa17fe12fa735326c0de753deaf91d715a71fb80b786d244c38c69b0301603073caf8afed4c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286542, "uuid": "b4291c26-306c-4e17-b965-db39a9bbc535", "value": "B5838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286542, "uuid": "5257d505-bbcf-4be6-8c50-98ef4a7c3b21", "value": "1536:IB240XZfcaaxf+EQliU2hawvCAIoo8+BNvMhfvu:+2d1cBWEQXMv9o8+nEhHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286542, "uuid": "25b046b2-0e61-4f83-94ac-90c340a55e95", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286542, "uuid": "41bc2472-5305-4fb1-9c73-5829ac73f0f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286542, "uuid": "01a364ca-fa9a-4513-863d-c3bc6211672a", "value": "347.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05b3055-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276291, "uuid": "9a6a8a7b-248f-422a-90bc-0fc09c81b9fe", "comment": "Malware payload (IcedID)", "value": "01e6150499058605555ec6123c7aeef1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276291, "uuid": "b9fdbc4e-9d7d-4efc-8b77-970eff557392", "comment": "Malware payload (IcedID)", "value": "4bce4af97d3c27334b88930eca4d4280a22eaf90f8026a77399c3b2dcc383a52", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276291, "uuid": "f2bb703b-d451-40c9-b428-97c2e293c701", "comment": "Malware payload (IcedID)", "value": "51616e8732906f16f495d45aca5d8853dd06604e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276291, "uuid": "cd487e29-fcc1-4870-886f-d7bed42c9a31", "comment": "Malware payload (IcedID)", "value": "ee0bb84924c7c9573acb388179f14e4ce856df218fa64bc56d2627d27ebfc39666aada292267943c606feb6358e68fdd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276291, "uuid": "ef93a6ba-a82b-4064-bfeb-2f41e4269f8b", "value": "78044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276291, "uuid": "f8612ac7-c600-4ef4-8703-767d1f441281", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276291, "uuid": "eae78b5a-2a71-4e2f-87a9-f18868668ad2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276291, "uuid": "518c2cbf-1436-48ac-a129-83812e01bd27", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276291, "uuid": "7c37b9cb-0b0a-4e51-b227-346142c4ff52", "value": "document-275332067.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79f2a39-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617294718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294718, "uuid": "fdc69f1c-33e5-4d72-90c8-03169656f8a2", "comment": "Malware payload (IcedID)", "value": "bfb3be7c1480267c7c0e777b798ca5d3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294718, "uuid": "fdfa625e-b915-461a-83a6-e7f3c865ba6b", "comment": "Malware payload (IcedID)", "value": "4be96609cecc83a362faaffc5a3b39fe83d38dae8366f6c062e7e24dfcf119a7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294718, "uuid": "ffb5f040-f92f-41ea-abc8-083cc9be4934", "comment": "Malware payload (IcedID)", "value": "903aa3ad57db7f9614abab498a0ef47e29629c40", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294718, "uuid": "3d290325-dffc-481d-9de5-88542b53a651", "comment": "Malware payload (IcedID)", "value": "28be788abcde0f30535a5c47a045ff16532a1c85264b0eeb9d7af8af3ff8bdabbbdceca1e41c6261cb305d231ceb2bab", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294718, "uuid": "a6ca2ca2-3e95-4a59-932b-381f135edf56", "value": "4B838DCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0C42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294718, "uuid": "42378ca6-1c90-4583-9982-74b9fd388fd2", "value": "1536:IB240XZfcaaxf+EQliU2haw4CAIoo8+BNvMhfvM+:+2d1cBWEQXM49o8+nEhH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294718, "uuid": "3742e2fe-edb7-4545-b8e3-5e7307081fc5", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294718, "uuid": "5fd4cf4d-2893-48f4-bafb-44c457f43665", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294718, "uuid": "f1aa32d4-89d5-490e-a0d0-6b7722f39b81", "value": "440.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b072f2a9-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280936, "uuid": "d8ededa0-067b-40e2-9316-692082effd51", "comment": "Malware payload (IcedID)", "value": "bc69be2b255e915a004a3a0b1486ebbb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280936, "uuid": "6e1e1577-04e5-4915-8ff9-40d065f191e7", "comment": "Malware payload (IcedID)", "value": "4c7dbefb3b20d49428dcec58945f3c9413431dfd9371ebd3702057ded9995d86", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280936, "uuid": "eb0265b3-b49f-4c6f-924c-28de8e7901fe", "comment": "Malware payload (IcedID)", "value": "489f2af5086518089518fac28be9ad123e555e75", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280936, "uuid": "a852da7b-c6cc-42aa-ba57-977855f3ebf7", "comment": "Malware payload (IcedID)", "value": "fc6dc31e0aa5b589e0221761c2b5131e766e9794ee426265832b317c5fa0455f39338a565946614222168727e5908e70", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280936, "uuid": "56ddf3bf-fc0f-4150-8863-0e49864cd414", "value": "BE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280936, "uuid": "6abf2021-3457-49ef-918b-637c44a8abd4", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280936, "uuid": "368c685b-f827-476e-990b-40fbb55e17cc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280936, "uuid": "6e500816-cfbc-411f-9088-cb2c1afe504e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280936, "uuid": "859a2b26-a211-4bf0-8460-d9030e1c96fb", "value": "document-1575329892.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ea015c-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276591, "uuid": "51ae99da-8cca-4e88-9b67-5cb258ea4608", "comment": "Malware payload (IcedID)", "value": "5130359a0dcfcb355fb230d22334be5d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276591, "uuid": "42ff5a89-6c75-437b-a74d-544e3690046e", "comment": "Malware payload (IcedID)", "value": "4c856b5a72acd9aef79cfe6230c2c37d343041ecc460857c5b92412e32d611e3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276591, "uuid": "6ad103b7-cfcd-4d86-8dcc-d3703586e29e", "comment": "Malware payload (IcedID)", "value": "028335577c6cdb32922f721664886c765210ff13", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276591, "uuid": "763f4ffc-fb45-4c4b-b788-27efdd4ece99", "comment": "Malware payload (IcedID)", "value": "54037a4b08a9eeeba1c8d2eb3cb46ff6680933b70f08b7f589c3d1bd05023e03cc61a21f78bd4bcff93c3421246889f8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276591, "uuid": "2bffa476-4c5c-46e2-b695-8ad1472b6887", "value": "0E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276591, "uuid": "64b6382d-444f-4855-9cce-a5774c472119", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276591, "uuid": "7570435b-ec69-4843-a601-8fdf419868d2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276591, "uuid": "eef1a815-067e-4a72-8247-13d7623b98ce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276591, "uuid": "79365ac5-2d7b-419d-b5dd-b290595a4600", "value": "document-1812579554.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ef006d-92ab-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617255170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255170, "uuid": "1ca48226-be45-44a0-937a-970e8ff29c2e", "comment": "Malware payload (AgentTesla)", "value": "c1e8182f6b590af535049e0d0b3dfa51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255170, "uuid": "67d60e8c-df34-4191-9b7c-0dcc01b02acc", "comment": "Malware payload (AgentTesla)", "value": "4d22471b270864c0008e8ab25451bd4b2d91f5929252ed4143d4112f497e3083", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255170, "uuid": "533ba6e7-d8af-4033-b33c-d02a8e1ec332", "comment": "Malware payload (AgentTesla)", "value": "57b501ec3c6ed1c5c428077466695d4eb964333a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255170, "uuid": "1325d15e-1a6c-4deb-bafc-34b70a04b771", "comment": "Malware payload (AgentTesla)", "value": "283b77a07219a6c289814d379bbcda49f9385f394651829d8ec3671ec5a4f8e6c19c68ddaa09fec18ee64625903d3863", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255170, "uuid": "eafeb009-9b60-4d0c-967c-bc226641f4d1", "value": "DAA4F12263886731E17FA7B90520192033F1F26AD723E75D7EA441DE1A97F8186B7F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255170, "uuid": "12af27bd-64d9-449d-8af6-780c37800f14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255170, "uuid": "dfdeec80-5e7a-4063-8b07-8f0d8bd66b16", "value": "6144:o7b9GmWMzrl0048J3fqRxVrfvZvSp3hOzvWQmnN492CDGg66BVcuv5bKfYd/QDEb:s9GErlv45hzvpma60bKfgCQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617255170, "uuid": "35d1b556-ba0c-4866-9a9c-86664bd85e3b", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617255170, "uuid": "5716fb96-f67a-4b01-945e-c689cdf2c584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255170, "uuid": "189f97bf-90f7-49c8-a64d-0d11b0d5e1d7", "value": "INVOICE.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d93a6d-9329-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617309399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309399, "uuid": "1e3cdf58-d7c2-4be5-8db6-113ac3c2c47c", "comment": "Malware payload", "value": "df222ec505953bd0d09fbe53f3d275cd", "object_relation": "md5", "Tag": [ { "name": "5544", "colour": "#5F8D52", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309399, "uuid": "f7849214-ee1c-4569-b3f6-63574680a0f0", "comment": "Malware payload", "value": "4d75878a57bc2deaae723ccb8ca2a41f13b85649c12dfb7e57a3133181785d37", "object_relation": "sha256", "Tag": [ { "name": "5544", "colour": "#5F8D52", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309399, "uuid": "ee2d409a-5891-4289-8d69-96e5d684c40d", "comment": "Malware payload", "value": "62999c2f6e755f98eb9cf471cbd788451e32a024", "object_relation": "sha1", "Tag": [ { "name": "5544", "colour": "#5F8D52", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309399, "uuid": "73ed971f-b77b-46da-b9cb-3ff4ad7797c7", "comment": "Malware payload", "value": "0f8837a86b5fd12d92df08cf6e98eb07dd65aaa5f6f59bb9d18947120efad00f9a82c80955ea165589d3108967e8b0eb", "object_relation": "sha3-384", "Tag": [ { "name": "5544", "colour": "#5F8D52", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "ifsb", "colour": "#50DF42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309399, "uuid": "8030155f-e81e-4dcc-95b7-8ebd88aa0050", "value": "1A83F113DF64AB41E9996279BD8B1FECBF02281C599774CF06404B8B7D343321A0E6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309399, "uuid": "9692ea97-b645-4784-b130-d235cdaa3c6f", "value": "1536:slUGUHtfjITTBe7E1UyY9ZXlk8qtZ0xaPgoy8+JmipkmvvtQSFBR0PfyI9LMRfWX:sqGUyTA7E1MZ1k8g05oyDJmipk4vykYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617309399, "uuid": "4822b6fd-35d9-4f7f-8b47-3022130dbc1e", "value": 82263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617309399, "uuid": "7438ab42-208b-42f2-bf47-44b9d03dfe9d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309399, "uuid": "156b4026-fd3c-42fd-8514-b156e624cc0e", "value": "ingresso.04.01.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb31bb69-9309-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295664, "uuid": "62916311-3a3c-4858-baa4-6d69b523def5", "comment": "Malware payload (IcedID)", "value": "18e6237f74b33eee1ca806138e6fae06", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295664, "uuid": "fde49b85-13db-4d60-b138-9d440736041f", "comment": "Malware payload (IcedID)", "value": "4d863c6bc377c14620ddbe3f28be70e69c2e13998dde9fdaef15a749618e7418", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295664, "uuid": "19720fe9-3c62-4ea4-b448-f6cf0863f3b9", "comment": "Malware payload (IcedID)", "value": "84166ec4a01ee3f108d371307da51b141d88b08b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295664, "uuid": "e99e6219-38c9-4af7-ae41-9703a95a173a", "comment": "Malware payload (IcedID)", "value": "76ce2d4be18cc948d31fa46bc39dba8304de14f3a5ec6c5d99cc17854a74bab6b044ff6bf628360c5064d0dcab766c5b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295664, "uuid": "82a3e81c-15ff-4f62-a7d3-1534e0df62a2", "value": "19838DCDC913E1D9C2519FBD5A09308112F4E0B6276FF11B148EAA2E0C42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295664, "uuid": "67fbde0b-064d-4b92-80da-aa9c79709c43", "value": "1536:IB240XZfcaaxf+EQliU2hawNCAIoo8+BNvMhfvNW:+2d1cBWEQXMN9o8+nEhHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295664, "uuid": "c22a0899-6974-46a6-8f72-6c02786944b5", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295664, "uuid": "685fa562-2078-48cc-9d7d-e0b6077ad945", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295664, "uuid": "d77cc3e3-4024-41db-bfdf-482c8651121f", "value": "888.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94781dea-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617282607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282607, "uuid": "30c95f8a-89d1-492d-82df-baa4ecd28c63", "comment": "Malware payload (Formbook)", "value": "9795d152a0b4aa30d09b77ab5eda678e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282607, "uuid": "62e754da-932e-43ca-bf49-9158a53ee110", "comment": "Malware payload (Formbook)", "value": "4d8a482a05fd92a0186ad2c0f3e77a86740f5c5c7850de4f5ed93e03ed640026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282607, "uuid": "9ded5cce-05b0-4a80-a1f5-306308d80e25", "comment": "Malware payload (Formbook)", "value": "cc7c3824f12f268f60f9f4c783e9c31c67819f76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282607, "uuid": "38dd0907-6a3d-46a2-bec7-00c1f7c90c59", "comment": "Malware payload (Formbook)", "value": "b5aebdfc599f32a38f61564a348a1f86cead81d5f70adfb6bb51bd328176d852126b731edf56d624e5f69303913ca9ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282607, "uuid": "e3028343-419b-4a67-a6d6-858c48c242c4", "value": "6D84F11272A0C4B6CAD4313E4FB6D6B84769DC884C526A0B37D83F4F38FE1970869697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282607, "uuid": "f8123fc8-a009-44af-b24f-323f50483e22", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282607, "uuid": "91c047f6-8800-4318-9969-7b77f904a7bf", "value": "6144:P9X0G87H0ORpDYmEIkBmsKVoL/UI3AoP9:50vPRpDrERss8oLvQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282607, "uuid": "7ae198ec-4aec-4ebb-8630-542c882312ae", "value": 376873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282607, "uuid": "47282e82-f07d-4794-ba38-24b47164e789", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282607, "uuid": "34467fd8-36b7-44df-b00d-970ccc4060ab", "value": "Swift 76498,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45d309d-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283546, "uuid": "e287951d-a197-44c6-8fb4-79a8137ed737", "comment": "Malware payload (IcedID)", "value": "3ae8f780b341a8919e4bebeacf04ef28", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283546, "uuid": "12b04861-1ce6-45bd-b0b1-04b91ccda25b", "comment": "Malware payload (IcedID)", "value": "4dc9a023f70e606c7ffbdc7080d60b2b40f680f6d7077d9e326541fcbbb5dce4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283546, "uuid": "a2989dc2-95f7-45eb-ac28-368d37bfb2b4", "comment": "Malware payload (IcedID)", "value": "1aa0fd7e7abfb77eb31bd8db5fae4b1116bf841d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283546, "uuid": "10b82502-3ebe-458e-8f43-1234ce2a649c", "comment": "Malware payload (IcedID)", "value": "5edb678bc71427da0c252c65768a00fcaf413283e7e148c3764a4fa67a3b7790a71401ed3b4992e6c2361035d0cbfe60", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283546, "uuid": "d6975d55-3e4a-4758-846d-176941c32263", "value": "7F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283546, "uuid": "cb4e2d60-2221-4389-a389-a7229dac5917", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283546, "uuid": "4fe5bbf4-1f8e-4be0-b03c-986ed32878d8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283546, "uuid": "26f0712f-6b67-4f0f-b399-3ee8bb5567d7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283546, "uuid": "46ca9834-ac1a-4ef8-a310-81198ac44cce", "value": "document-331637210.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2c2bd9-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287778, "uuid": "b8dbebdd-5ecc-4bb7-bafb-40ac4c7557c0", "comment": "Malware payload (IcedID)", "value": "ab6de163f386c974782add340084deee", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287778, "uuid": "6505803d-58a7-45e5-a3df-85f10d138346", "comment": "Malware payload (IcedID)", "value": "4e151e90b4500e245cc5bfbbd8dec9c2d3604e715a19a3406d084f4fb2d66b2a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287778, "uuid": "c3b7d6ed-1efa-4b00-a15e-4a3477c6a4ac", "comment": "Malware payload (IcedID)", "value": "ab0481cf38fbe474e8eb024269d6c061ecd759cb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287778, "uuid": "6c441f75-218b-4539-b921-a8092cbe4ccb", "comment": "Malware payload (IcedID)", "value": "4138e1060ebf71e2c26febf20fc09f4cd06c8918d47da394a72be9dfeae20fb3e7751356aa4da13f31c1125c60b49461", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287778, "uuid": "0d75d1bc-f323-45bd-a3b1-bc4d9eaa7b56", "value": "5C838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287778, "uuid": "c20530aa-bf86-4b18-a1cf-76c13f504db6", "value": "1536:IB240XZfcaaxf+EQliU2haw7CAIoo8+BNvMhfvy/:+2d1cBWEQXM79o8+nEhHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287778, "uuid": "8da0bf91-9ce0-4329-85ff-c4fedf65f0d8", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287778, "uuid": "33bbf33f-a587-455c-9c18-e1e01157922c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287778, "uuid": "c3dc273f-4638-4863-8aec-ee98cf96a61a", "value": "2363.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d23c01b-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617261871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261871, "uuid": "2ea133fc-1cbd-4994-89ea-e7a950416bac", "comment": "Malware payload (SnakeKeylogger)", "value": "0b0d890483b5acd0a22a2dc2f639be43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261871, "uuid": "baafaf22-78f6-47c7-a907-5a0d6a5c1c1f", "comment": "Malware payload (SnakeKeylogger)", "value": "4e5889dabf93d7e1e6a2880155bffdda4cb1b2f4de8b9924aa1820714fabbbe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261871, "uuid": "d37f1870-99c9-4a4b-a34f-375435fe35bf", "comment": "Malware payload (SnakeKeylogger)", "value": "8cc79e975a2f679907b2471d12f8bfddb55949c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261871, "uuid": "14334e68-fa1e-4a8d-b165-76919cd88874", "comment": "Malware payload (SnakeKeylogger)", "value": "82c80a8d5ebc04daec188052a5d960deaff7a9c60f424658090e3148d28aefdf9588a829e72513ea409d37326fcbd6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261871, "uuid": "d0965630-248c-44c1-a2bc-3e2f940bc8af", "value": "6113E86872D4D134E53BF9B617C43C7D8B7A2E62E040D86AA48CE6CB44E6F444FE242D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261871, "uuid": "dfd26571-f1c7-4642-b484-a8fa9987d21d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261871, "uuid": "799448ca-5ec2-4386-b799-72747a19a52a", "value": "384:LfYYWLZBO7Cgpgr2N3+HxNRJUNftVZ3VM/m0rl3LUJfl8KVM:L7WVBO7Cgpgr2N3+RNRoFQX9Gfl8cM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261871, "uuid": "551aa43c-5a39-4229-91d2-ffe6333a6ebb", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261871, "uuid": "5d49eb08-3491-42fd-ac0e-f76e55c70027", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261871, "uuid": "636cbe2a-c2d2-4719-9b4f-9e5b8946a03b", "value": "IMG_110_63_078SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b7fe0b-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276621, "uuid": "d31176b9-7083-4871-a087-c686444e6f22", "comment": "Malware payload (IcedID)", "value": "a5b7dd6df5819a5df5f80155f57021ff", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276621, "uuid": "a8c06383-1b28-4632-a39e-fb5c30e541f9", "comment": "Malware payload (IcedID)", "value": "4e9e63a18153a13084bd5f2f429ebc9028f0c209e12903cff94c47797a826bf7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276621, "uuid": "bf4c1c9e-5913-4e42-8268-f7c9bde91187", "comment": "Malware payload (IcedID)", "value": "de115e2dc695a75a8ff75796b65ec47f67f6df00", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276621, "uuid": "9ab2c8e1-c95d-4b0b-9ded-879e56c20a41", "comment": "Malware payload (IcedID)", "value": "01d1588db1734014c30bf0b4c47c4f1ee32bbc531f3e120ca2d5ce8f1627cd4d3259f644bfdff94fdb6c10be3e08ed61", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276621, "uuid": "610897d7-9a24-4a06-b59d-7e47dff94567", "value": "71044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276621, "uuid": "cc0e9a36-76ac-424d-89f6-eaf98c4fe27f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276621, "uuid": "07cc6c6c-5630-4924-bc74-edf735fc26dd", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276621, "uuid": "cae462b3-f977-4852-9d2a-7f262b68dfc8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276621, "uuid": "f08e4e07-c2ec-442f-be40-e8edd9694359", "value": "document-1962318555.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5ab7ef-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279880, "uuid": "2c78c70d-a821-4349-87b4-dcb6c0d7aa1a", "comment": "Malware payload (IcedID)", "value": "56a1ff8ec56784d44fccd01486bfb017", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279880, "uuid": "b9931fd3-0bea-4594-aabc-0b3c2ad23e81", "comment": "Malware payload (IcedID)", "value": "4ea19c0db2d9bcc7d39cffd7aa23e7bfd8091545b13f4a9bcd35d4527c8d4dbb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279880, "uuid": "372e2fe0-bd8a-4b8f-bba5-a15de44be4a4", "comment": "Malware payload (IcedID)", "value": "676c304a7cbe247a958699aec5014ef4c1e5ce49", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279880, "uuid": "34912f16-6066-4b0f-af6f-dd79d60945a2", "comment": "Malware payload (IcedID)", "value": "4231bc3166c790055398a2a12f1e6343b43f5276694f012f917d898b6c384416f284bff15ba9bfa0eefabdb0ee7a7404", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279880, "uuid": "bf603744-5bff-4efc-abe9-3109a44b6c43", "value": "07044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279880, "uuid": "1b729c64-6d76-42ac-8360-de35e265ea2f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279880, "uuid": "f2b7af1d-9ac3-4f56-9955-849bb63ce5e2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279880, "uuid": "390d04d2-3d9c-43c3-b167-0b1c3168815f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279880, "uuid": "df5e8e3f-6718-435a-8a73-356e7f2191cb", "value": "document-1320073816.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f22f45f-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282463, "uuid": "c1c83b17-9859-41c3-a0e0-7bf05c31772f", "comment": "Malware payload (IcedID)", "value": "af7dbfe44cff9c996d00b105d6dc62ef", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282463, "uuid": "35581826-3645-4438-b290-375ba0ee4002", "comment": "Malware payload (IcedID)", "value": "4eac961c4186f04dd15cd41ceb828fec07bcae6fbc722876f984e38c60019f93", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282463, "uuid": "0afc8be5-7fdb-499c-85c7-436242b95018", "comment": "Malware payload (IcedID)", "value": "5f31f2038ff7c62a502301c212d1c33876454a31", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282463, "uuid": "9569701a-55a4-4f11-8fc0-a601725aff53", "comment": "Malware payload (IcedID)", "value": "99caeb479cd03183531b19570c8c2032a0892b525ab85b78201f5d3f8116501e2795d5232b332910b69ecad36dc1eedc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282463, "uuid": "622b8fa8-8abc-46e4-a98a-a45c0c2f3e26", "value": "C1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282463, "uuid": "4286c54b-ddc3-4f49-ad7f-6d8578493b80", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282463, "uuid": "bc102f9f-07d3-46b4-bef3-f2f695ddb28b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282463, "uuid": "981e4ba3-52aa-48b1-aeeb-40e6c1dc3ab6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282463, "uuid": "91ef5235-4ec8-4b49-b368-1f128fa20038", "value": "document-658254986.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d6fe47-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276598, "uuid": "efd0daf7-805b-4cb8-8855-8bd10f2cb4f0", "comment": "Malware payload (IcedID)", "value": "25607fa8d5ba54ea5fc143637c575a5b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276598, "uuid": "1005b3e1-8423-42aa-ab17-7590ae9bcc5e", "comment": "Malware payload (IcedID)", "value": "4f005367e540add68aaf8de42e3dc19005d87d0e264c569f39c74092e31f0cc5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276598, "uuid": "3d7aa0b0-3688-4692-8ac3-2f9d20bd7e62", "comment": "Malware payload (IcedID)", "value": "c7efb555d5ccd6bc60144d1744bbae2564e61c9d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276598, "uuid": "0948da7e-7c33-48d9-a2fb-2f75274f3ea6", "comment": "Malware payload (IcedID)", "value": "1c7e5f94a35b28958201390734adb0d3ed04169d128524b81b4e1a17eb4f9624be3913cb64249544bdf26524faa6cf3e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276598, "uuid": "7a99d22f-2ccf-4d74-8be1-2ba6ba9fd8f4", "value": "CB044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276598, "uuid": "62f9fce3-f5b3-4dc9-9fbe-04636517d1ea", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276598, "uuid": "a7639c2d-6361-45b4-ac6c-c92cde06c240", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276598, "uuid": "75176b42-2816-44ef-b510-9ac0d50b60cc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276598, "uuid": "ab369ffc-92ad-4768-88db-d0d6a2a2f2cc", "value": "document-1909326188.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be404940-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280959, "uuid": "9d340b64-43c4-4d29-8760-525d775636fd", "comment": "Malware payload (IcedID)", "value": "e9d4d873789e4a723dff2c60f673c109", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280959, "uuid": "5712a3d4-0d4c-45e3-bfc5-2fce5d777395", "comment": "Malware payload (IcedID)", "value": "4f01ae5b0467779b1a98d0abe404ec2e238e7f62ee1bec557350661a271ef40f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280959, "uuid": "bc4d2fd4-0874-4733-b8bc-ddb3ffe25917", "comment": "Malware payload (IcedID)", "value": "bd214ba6ae95ecff550f5c8f24e0eae93efccdfd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280959, "uuid": "4fd95384-f8e3-4b99-b268-8ede2dd799ac", "comment": "Malware payload (IcedID)", "value": "97a3226b69e75786611de22eb00626bccde3def58e389358164e297a0fe649bb68bfd4160d0e064fc36539fa29a592fe", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280959, "uuid": "f614af94-7f1e-4d53-9dcd-7cea27fb190d", "value": "1D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280959, "uuid": "fc1b1ceb-0b7d-4d3a-a361-1c0987fe67ea", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280959, "uuid": "f0993cc4-c44f-4dd6-97af-6b2142c42348", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280959, "uuid": "8a41bde2-4f33-4b8c-92cf-9b0c57a26eac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280959, "uuid": "defedb16-59c6-466f-aafd-728691fa87ee", "value": "document-668647276.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c55519-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276948, "uuid": "ab7e5ac3-b83d-4743-9376-298182de2077", "comment": "Malware payload (IcedID)", "value": "4eb6a83c527d459f39f08a25fc991ce5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276948, "uuid": "32abb3be-13d6-432d-87a9-2c61637eb955", "comment": "Malware payload (IcedID)", "value": "4f5252b6bdab9c85c23f2fa3ef5766e874887b2b52578c294658d406ffc54167", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276948, "uuid": "351a125f-e250-4ad2-be03-edbc2ebb3092", "comment": "Malware payload (IcedID)", "value": "5a6b87f812b1cee61ffcc18fc7cb00108b617345", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276948, "uuid": "4cc07f51-efac-4321-8024-4553092e7e67", "comment": "Malware payload (IcedID)", "value": "0f7d403dd9f2dfe11cfc161bc42a3faca6248937191cb656815cc7bfcf63282066cce2c531e41f9169be1a40748448c5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276948, "uuid": "7deba9af-25b2-493d-8515-840f7e867873", "value": "2A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276948, "uuid": "832c6423-5b52-45a2-bc65-e353e5902acc", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276948, "uuid": "9c62ccf1-fd91-4d8e-b36f-8cdcfa0e073a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276948, "uuid": "9181e263-d388-4f07-ac77-3d34a3e0d5b2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276948, "uuid": "673b53a4-471e-4d8b-8c93-d6b82b38b721", "value": "document-1454568435.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528f84cc-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617261451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261451, "uuid": "a8863123-f292-4f9f-9977-9a2d17b3252b", "comment": "Malware payload (AgentTesla)", "value": "a7a47d3fddc746718498451ad83fdbee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261451, "uuid": "6d3256a4-228b-425e-ba69-4e8a4434d88e", "comment": "Malware payload (AgentTesla)", "value": "4f6fa9c79a519e7f23da7e9af07462772ac70e4ec05d973074cadb7faba03d0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261451, "uuid": "f2e4de22-0aa3-47ac-bcec-a50dbde1f13d", "comment": "Malware payload (AgentTesla)", "value": "d883a053cf2a1a0c1b137a9f54ab548e1616d4ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261451, "uuid": "3b5befd8-ae2c-4c6d-9d3f-de90b20dbd9d", "comment": "Malware payload (AgentTesla)", "value": "9f9446565b2381b643889d53e34781f4cb3f66a1212e3b315b20fb79d74a7ac9dd96216a8a1f86f15e7f80750d894746", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261451, "uuid": "fd93454e-a727-4758-b981-964b6c0a4268", "value": "E8B4D0B536E44715F07AEBF87871110083F5B03D82D6EB0A2DA854DE1972FB199A2E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261451, "uuid": "6b8c8438-6251-423c-96ce-1f9e8a60204d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261451, "uuid": "f2b9c9fc-ac2d-4479-98c9-18291b35b74f", "value": "12288:xLB2LzZw4RepKVSLVrZFY5jJ21IXRXSzmRf:iZdKN65jA1MSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261451, "uuid": "87a16316-8c7a-42cd-a8ab-5c36c637ed10", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261451, "uuid": "f6f5ab57-2a84-4bfb-a03f-eaeee01701f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261451, "uuid": "1adbce80-0415-4879-9a4f-9951cec24f20", "value": "New Order Quotation..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60e20b1-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284784, "uuid": "4e3cc8aa-675b-4928-bc88-b3c151c9ef12", "comment": "Malware payload (IcedID)", "value": "87a5f6334faf88afd2642001862c54bc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284784, "uuid": "3d8f6195-5904-4e3f-a9d5-2b4ec28797f7", "comment": "Malware payload (IcedID)", "value": "4f83263a0f84db6c127cc992e76bddda095e6b81d9851cda6c4e332af26dac25", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284784, "uuid": "3f09c44a-cc91-4a90-b000-da47428e6153", "comment": "Malware payload (IcedID)", "value": "7b95adb8b16fab3b6ec172f4e6bd22f0575eb27b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284784, "uuid": "57c2226f-079e-414d-8197-1818b571ecf8", "comment": "Malware payload (IcedID)", "value": "6190130380d37f1e09e467c363ef311b956a57ad827995dd4862ed59dac27b42e5c15eaefc71a076a9c330dd682e96a3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284784, "uuid": "6a4960c5-83d7-4062-ab62-4485d091d511", "value": "82044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284784, "uuid": "c21b4b9a-3325-493a-a15d-e735496d0e64", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284784, "uuid": "7cfbf9c9-6a25-4351-aa51-cc41e0a0d234", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284784, "uuid": "a1162987-595d-4ac3-b8d1-27a5fe83d623", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284784, "uuid": "8d8aa5d7-8562-49b3-af7b-d5290707bb1d", "value": "document-329940446.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8824723e-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284304, "uuid": "55c07ccb-a3fc-460d-87ee-138ad50a5204", "comment": "Malware payload (IcedID)", "value": "4e0325c416e5cc51b4e7413b3f7338ad", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284304, "uuid": "834e5351-5ed9-4ccb-8c6d-7ed6c0b66eab", "comment": "Malware payload (IcedID)", "value": "50706a8584ce4b0f478c039ca44b43acdb4a1b25f776d17bd63959694e404c72", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284304, "uuid": "ff2d7283-0019-4b3d-9792-dcfa7a5cc25d", "comment": "Malware payload (IcedID)", "value": "b7bc93f64c3f3594893410edc5fd5134473a7d49", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284304, "uuid": "49a532bc-f7cc-41b8-9692-7a02b64d07ef", "comment": "Malware payload (IcedID)", "value": "e5a021d91c7ad7c3db17ee7a535e601bd413d65135e8efc3ba462032b250daf63b3caa6b5df5c52e28222eaa6b44348b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284304, "uuid": "e01cc308-09fa-414a-bf7f-667fed3958f2", "value": "24044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284304, "uuid": "1e16e1f0-929c-4cc6-b470-31d8d7d6ba70", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284304, "uuid": "7bffcfb3-9685-4a8a-a48a-bc3cd05a2fa7", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284304, "uuid": "48638a27-b294-47fe-854b-c6ed9ff410ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284304, "uuid": "80a924fb-fff1-48db-9756-6b1ce5e6d3af", "value": "document-2136742146.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43caab2d-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279894, "uuid": "a9b59e99-ea74-49e8-b99b-baa234241c64", "comment": "Malware payload (IcedID)", "value": "d49275bcf244fd3eea147990777e09eb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279894, "uuid": "8245b120-9fb7-4598-afa5-ccca46ef7d9c", "comment": "Malware payload (IcedID)", "value": "50816af886f2ea0a433c150ba54178394583456c457be0ae009b53d2fe4278f1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279894, "uuid": "768b7968-d5e4-45e4-84c4-137b4b7a7523", "comment": "Malware payload (IcedID)", "value": "0639bc61acd921f400a58d712486caa3138f9878", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279894, "uuid": "2c5e5998-1140-465b-abe4-de1b37da38f8", "comment": "Malware payload (IcedID)", "value": "9e8b70e7ea3b85c882b3647efe2f849113e3b1b676f01d98b0dd5ab84c51da5acc0a0d7deec23618849c204ad45e23b6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279894, "uuid": "5243d944-87dd-4be0-b72e-ffd06fc8fbb5", "value": "00044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279894, "uuid": "14a91498-c402-44b7-a505-46cb4f193fdc", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279894, "uuid": "fda1d859-ab14-4da9-bdb0-338610290770", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279894, "uuid": "fca0dcc8-75fc-4191-bfa2-49eeafbe9cb4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279894, "uuid": "79238ccb-68a2-4fa5-966f-c47d46495b25", "value": "document-997754822.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbc19c8-92d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617272613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617272613, "uuid": "b5ed9e95-e68c-44e9-91ad-a3809015ce5f", "comment": "Malware payload (Dridex)", "value": "ea0a7070fc856d90f005aababb6ced29", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617272613, "uuid": "9cfd1f6e-540f-485d-a3e7-f3cec266d420", "comment": "Malware payload (Dridex)", "value": "5091d1ef7da46e857561a7ff45f0f3d886bd8ac8756faf52161c3c97280accd9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617272613, "uuid": "0b4fd081-b18f-424a-9f94-461afd06b91d", "comment": "Malware payload (Dridex)", "value": "333ca080c29ba109faafc22edb2b4ea51f303af8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617272613, "uuid": "0705d5d7-3b53-4b54-9ae2-49853cfa044d", "comment": "Malware payload (Dridex)", "value": "2cedb0835eb45d984377364717da01cf74f92263ee887eb436a54de46fef9e037e160936ef9a61785779e066386e649f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617272613, "uuid": "a6386799-3187-43d2-8498-7fafefcead0a", "value": "A614BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617272613, "uuid": "30061d4f-2548-4d70-855c-d9352ecd4d57", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617272613, "uuid": "0ecbad1f-6dfd-4b71-ae46-40e6ed235b01", "value": "3072:eopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:BpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617272613, "uuid": "94060f32-cab2-4106-87ba-9f323cd0a7e9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617272613, "uuid": "21bb33d3-a0fc-4ce8-944d-63c36b968adb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617272613, "uuid": "b7e7a1d7-e332-47b9-977d-d1c14baa4965", "value": "5091d1ef7da46e857561a7ff45f0f3d886bd8ac8756faf52161c3c97280accd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7761ae06-92e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617278692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278692, "uuid": "d932f269-f50b-4346-8367-292ec6e487bd", "comment": "Malware payload (Dridex)", "value": "70c4f60b9b0c51c643b90cb9b126dd93", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278692, "uuid": "f5761a8f-3df1-4254-8166-f286b8181406", "comment": "Malware payload (Dridex)", "value": "512d52f73a8ced8d17d99cb75c72f35197704eec780e131767e509acd2d4bf5e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278692, "uuid": "f8633161-c0f8-4a38-b3b7-310f48c0f10c", "comment": "Malware payload (Dridex)", "value": "1ddb9d313526e178fa43cb91ea5398f5858e6cbc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278692, "uuid": "e6250298-77f9-4465-b251-88ec01ae8ab6", "comment": "Malware payload (Dridex)", "value": "40942cd3135a231cef9a772b4cd471214f9784b4c60525b75a9ac9a3f9f64dc9df0ee025185f0c06c9abc8f8c51b2f02", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278692, "uuid": "2b53abfe-51f4-40d5-9042-54f9543d2eee", "value": "8814AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278692, "uuid": "2fa25dec-b215-4647-90bf-f78e708c3c3d", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278692, "uuid": "d2b70655-3600-4c40-b291-9535bfdff7fa", "value": "3072:f1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:9i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278692, "uuid": "28dd2c2e-2f52-497f-b150-53a12a0b37e9", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278692, "uuid": "a22e66f2-ad06-4389-8f98-8ceb9c0bb8c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278692, "uuid": "9a15dfe9-7bb4-4702-a5d7-e9c6e7f158c0", "value": "512d52f73a8ced8d17d99cb75c72f35197704eec780e131767e509acd2d4bf5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6391db-92c0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617264205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617264205, "uuid": "693d14e5-631b-4225-866f-243d704e16bd", "comment": "Malware payload (AZORult)", "value": "c4a9173037aca60543085477cacfa5e7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617264205, "uuid": "876a8fc7-bbea-4cac-8b0e-11e43a3fac59", "comment": "Malware payload (AZORult)", "value": "5159183c50d03b79bf325655cefff8b847ffbb4b1d1f1f8228e4dc1dfe7eec8e", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617264205, "uuid": "1cedfa1f-dec3-4ad3-9405-1caa48418970", "comment": "Malware payload (AZORult)", "value": "f5743f9ea19365b0602528215f9c128a18966e68", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617264205, "uuid": "b4002232-1dc6-4a3d-8964-87f1612d4826", "comment": "Malware payload (AZORult)", "value": "846ede207bcbca8437b09f00a820ad1550c4d1f0d1c31d88503663a8e5ce59fbbf5541454239ac9818610eb183def808", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617264205, "uuid": "f4938ede-ea91-4981-9b91-4129425389ac", "value": "DED401B13DD1CBD1EB2C13FB625520460BF4EBE62043DB449988E9F6669AF4C4DC6683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617264205, "uuid": "9cfb065c-e3d1-48b5-ab83-e3c21057fedb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617264205, "uuid": "91fbbdcb-effd-49be-a0cb-466c20c625a5", "value": "12288:UHmYgryVUxoOUjrbxjZcIBSE/zgDLdrBMCw9sX2I4qswQw/LNa2iNo:LYgr4Ux+rbxuE/sDLd1MCw9jq7Qw/ha8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617264205, "uuid": "477dd70f-97dc-4fcd-9680-933ce8a60ff2", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617264205, "uuid": "6c2e1d9f-4c10-4636-a119-3546dcefd529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617264205, "uuid": "a3998f70-82e6-4289-851d-c1c9f8ccb164", "value": "Dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eeb6dac-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279000, "uuid": "7e1db528-b02d-4e75-a432-d9347bc83919", "comment": "Malware payload (IcedID)", "value": "014853c539225b44a5c9f036c8fb90c0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279000, "uuid": "1df374b8-c566-48cc-8f31-77036ba5f2f8", "comment": "Malware payload (IcedID)", "value": "51db77f52812c40247c456778cce2d6d6d930ac80e486b38a9c93d725f02e7b2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279000, "uuid": "6b3f19e4-265d-4f2d-9dbc-340b5c948e65", "comment": "Malware payload (IcedID)", "value": "e92e7a62f9db63a2e694452510613776749cb213", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279000, "uuid": "1b2ba1d2-d614-4039-8560-9a22f7da5530", "comment": "Malware payload (IcedID)", "value": "7c7e29283e81d74cdcbc829069b8d5e998d522a87c6c83034ac3562b8c9036906c4d1d33cfc25cc291f3d6de94e59564", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279000, "uuid": "c311362c-1583-4929-8803-e9e285d7f9fb", "value": "16044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279000, "uuid": "e2dc6c5b-eb5b-4a3e-b6a4-c8b562287f82", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279000, "uuid": "3c6241bb-72ad-4561-aeba-ed166a6014d9", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279000, "uuid": "4203b307-0365-4ea8-9793-6a8116b78d9f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279000, "uuid": "b1fffcd8-1bd6-4158-aa42-300b07e2333d", "value": "document-1110882140.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484db137-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282479, "uuid": "52fc5b5f-a59b-4cff-8719-da54703b0ff6", "comment": "Malware payload (IcedID)", "value": "4d861ed62de9fc39857bbce32b77086a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282479, "uuid": "562d840c-b9db-44ce-9019-d407612e6c18", "comment": "Malware payload (IcedID)", "value": "51dd350c16ebc08194718b80c74ef37309bb8c0502e3e510b1d1a2c9b86ac6d8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282479, "uuid": "7941fd01-ace4-49ce-b96f-3c2dd822e760", "comment": "Malware payload (IcedID)", "value": "8f89df5dd7451551243b4d0f89af5aaea68359eb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282479, "uuid": "07ce7209-bba2-4937-b32b-8960fd6c4584", "comment": "Malware payload (IcedID)", "value": "fb36b68259e778f5b7c73cd5ede8a8ad81caa07d3cc3292c0e74aedf38a67c04e3fee8c7c8a0e65b09d0a3ca6c2aaae2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282479, "uuid": "2dbb4a39-5ecb-45c5-995c-d4d76cc32c5f", "value": "FA044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282479, "uuid": "0b5209ab-3c28-4d70-a12d-93283c623698", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282479, "uuid": "3c80dc7f-3487-433c-b762-568e516b5146", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282479, "uuid": "8e36c916-c318-4209-bf5c-a5ce28331522", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282479, "uuid": "49086831-bf4d-4c1c-95e4-c502ae9e356e", "value": "document-131360572.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dd0861-9333-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617313538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313538, "uuid": "3eeb7509-3e15-452f-91b0-7c3483a761ba", "comment": "Malware payload", "value": "476981106b5ae10c29e2a262439de9d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313538, "uuid": "d3a6873c-5201-4031-a259-98c2d888ebe9", "comment": "Malware payload", "value": "51df125508a755a551c3ab275f82c1aadf1a0e518c925afb33848b6201fcc174", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313538, "uuid": "73b2b36f-5a19-4ec1-94a1-8da522bd42b9", "comment": "Malware payload", "value": "86eb9d97381c4099ed4bb36c9082c496b1e95933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313538, "uuid": "2f155a63-2297-42bf-a75c-d2a50e1bcc9a", "comment": "Malware payload", "value": "0aae14cbbb2a2c5b533fdac29bd166630e0112c566f2c219fa6485bda0827f04aa4e32037c239133b8e0a676880fa428", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313538, "uuid": "d256b0a8-e774-451d-9189-79c717721dd0", "value": "64D3A82A2B12DFABF19CC3304FB78A70579827E326D4D685E26CD7881D3129D185FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313538, "uuid": "f05e5e84-f8c4-42a5-bc78-757dbe952023", "value": "1536:Z4yM+3bcXaRxGSDd9Ys+wGpuzqCqIUmOnmc+7zMqqU+tV2gR:qyMLhOiTTpufS03MqqDrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617313538, "uuid": "f85aab91-100b-42e4-991b-93b0a22d212d", "value": 141256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617313538, "uuid": "971de7f7-12c0-436a-a46f-585aa659f1f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313538, "uuid": "08199c0f-f7b1-4973-9325-9481944bb157", "value": "dmex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41e1dcb-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277506, "uuid": "7dfed33a-1179-4e8b-93b2-91671fc0f3e2", "comment": "Malware payload (IcedID)", "value": "c8974cc7f3db8c50254a34357c1fd021", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277506, "uuid": "f238c253-c3fb-425e-b8a6-0f154db1cf22", "comment": "Malware payload (IcedID)", "value": "5255ccc6bface0b1b856289cf43f112620f2093e82ef57dfc8a5b34b346672b9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277506, "uuid": "f3605afa-31c5-4a92-9b34-9abb027987b4", "comment": "Malware payload (IcedID)", "value": "035e80f4c6bde9f14d9337a7410fd75ed122d1d5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277506, "uuid": "9ae2eddd-1cc2-48dd-b18d-f36caecc6b00", "comment": "Malware payload (IcedID)", "value": "8e0686af6bc9f6af7f036073bcbab161931a068c3889c8d6f883117338af8c27840e8d2a0757d439b8ee88c76ec205f1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277506, "uuid": "72ba7cf3-0608-4fa1-91ee-5e68d355d541", "value": "21044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277506, "uuid": "3a0e919d-7afb-40bd-8e36-cae7e717ce82", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277506, "uuid": "6bb429c2-314c-4683-aea9-22305fe5b189", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277506, "uuid": "0dec3f1a-eed3-4f1d-bc35-80173e61812c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277506, "uuid": "8039a903-26c9-4b9e-84e9-999673f2ea6b", "value": "document-1475786229.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4129d5c4-9317-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617301365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301365, "uuid": "b14ddfa6-1f61-41e9-b3eb-9f7b72a9e3d5", "comment": "Malware payload (IcedID)", "value": "fc032140a0e8c90fd81041cde44acdec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301365, "uuid": "e56dbca4-dd79-4b01-bd1b-8e69b20bc4f0", "comment": "Malware payload (IcedID)", "value": "5264623f5d44ca9a2ff057eb5ca58fefa48b0cc7a0b31f7fd13eb103b3314376", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301365, "uuid": "dd423df1-b899-4ad2-91a3-0078b4061f21", "comment": "Malware payload (IcedID)", "value": "630408c1b09fc6b1af1c475d95951260df4bdfc9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617301365, "uuid": "47478281-4d3d-423b-91f6-ce303ba3c0bc", "comment": "Malware payload (IcedID)", "value": "388bcf138af43df14e79f139e9faa017fef4bffb2c36e1898afdbd382f8066ba45027a847c98a8707c8ab459897510b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301365, "uuid": "e1aab176-2dcf-4a24-ba72-7423d63d7508", "value": "251408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301365, "uuid": "a1905b16-addf-4f4e-aa48-2b0379169c21", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301365, "uuid": "943e6af5-6c40-4ac3-9e3a-4ee41343b971", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617301365, "uuid": "dad51c7e-23f2-4bc9-b332-64a07a607286", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617301365, "uuid": "d6ed6786-38ef-4469-a115-4b7837e8bd53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617301365, "uuid": "30e87628-5f79-4bcc-8b88-5af7e7bd777a", "value": "5264623f5d44ca9a2ff057eb5ca58fefa48b0cc7a0b31.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe54dbb-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275022, "uuid": "cd757d24-07d9-49ee-823f-6d875e8c7fd3", "comment": "Malware payload (IcedID)", "value": "2b044c4dc2fa45c0fdf74ec277bd6d99", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275022, "uuid": "fe61c926-a8a4-48f9-a346-a1e85325e76f", "comment": "Malware payload (IcedID)", "value": "52b6b36de3f942cb065f7b3ec32cb282dca5a6351c5cf62da777248652bf53ac", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275022, "uuid": "83afde08-b2e2-443c-b873-16b87bfa9b23", "comment": "Malware payload (IcedID)", "value": "358d44977838dd08d57323782cb8061a820c5fd9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275022, "uuid": "443cba54-d239-4593-a4e4-0650d9dfa345", "comment": "Malware payload (IcedID)", "value": "8392c2e657e0139b8a2dd3a36860eee32ad60c5ec10c962a7641cdf04ed86b4629913a8871cf522446793a07dbab2ac4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275022, "uuid": "c497318b-800a-4e15-a5a3-5517804f89be", "value": "EC044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275022, "uuid": "106f6c4f-4831-444d-aa1a-77e7c5ff5b42", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275022, "uuid": "eca23c99-f1bd-442f-8d8b-0ca3f1528067", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275022, "uuid": "c790fdaa-756f-4f95-b365-225b7a743dec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275022, "uuid": "1037052b-653d-4bf7-957c-74e90f078bb4", "value": "document-1051788486.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33607303-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278149, "uuid": "23a19b23-e5b1-4367-bf8e-42a172f7ed05", "comment": "Malware payload (IcedID)", "value": "c30d956d01f6b7901e60e6883dd1c615", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278149, "uuid": "02ec2fad-a8bc-4b17-ac08-4e2062f4ce29", "comment": "Malware payload (IcedID)", "value": "533637e9c2e9a57cc76233e5a9942a121e5a57a388bcf9cdc91d6fde2070c95b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278149, "uuid": "23eb2dbf-02ad-4136-b46a-85d6e125f30b", "comment": "Malware payload (IcedID)", "value": "122e101f1f7abcbd26b02528acf4f5127cad3c92", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278149, "uuid": "b4b894bd-0f15-46fe-b5d8-e4dde6b7982a", "comment": "Malware payload (IcedID)", "value": "978737874aad657158e4ab5a1ea820645dc053f728e00bd0b3359bf71309160143d0f9aaa10fbe07565610be454a814c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278149, "uuid": "0919643d-374e-4fd0-b6f1-17521c397493", "value": "82044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278149, "uuid": "736ae1a1-5941-44b0-b7fc-b1279ccdf3a0", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278149, "uuid": "815f9f28-e0db-40bb-9801-d29ee6cc41be", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278149, "uuid": "13686582-5dd0-474a-a56f-8587750dce60", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278149, "uuid": "f57d7e54-be70-483c-b8a1-556bb220d64a", "value": "document-865301601.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e909cab8-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261703, "uuid": "cc6d1152-14e0-4cc2-9999-e51bf4b9a979", "comment": "Malware payload (Formbook)", "value": "102afb274fcf6a617d068fb1b4a6a680", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261703, "uuid": "20fedd72-f9cc-4041-a822-292655e49866", "comment": "Malware payload (Formbook)", "value": "53a18ab6014c056935d33e91b00fd823f1e2e93c5b5d6ed6da8bfc305b231f8e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261703, "uuid": "e051d9dd-ef4f-418f-b80a-4ee6be76808b", "comment": "Malware payload (Formbook)", "value": "efeecf4157020affedcd2c7a4e5a66de092343c2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261703, "uuid": "00ddaa6f-e97e-4ddc-83ff-e94f2854c40d", "comment": "Malware payload (Formbook)", "value": "76a5262e1c73c3f2ed95a0ca49211667026f13e32be887ad926c3bc3bf63f21bae90735fd0492e5b191940ee6a3718bb", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261703, "uuid": "c9b61bd3-03ba-4702-a696-c4750a586863", "value": "82942391E5F9A1FBA0F6EDF8B9D13029FC40CA7C99349058E80346BA583EA74DD07265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261703, "uuid": "79dc7761-94ce-42fd-8f29-662fed91c0dd", "value": "12288:bxAmjhnKR96DmdEDgUdUHJwFIN5N5XqA1L:bPjhnayEGS6E53XqA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261703, "uuid": "e51e559c-3d2e-4af9-86a4-2c3f773de6f9", "value": 418719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261703, "uuid": "a6fe5dec-f4d6-49d3-9519-a899fb08d422", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261703, "uuid": "55f48bf4-a6a6-4b12-9d4c-d6dfba67466d", "value": "ORDER_ 42683.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc09f37-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279884, "uuid": "ed5aa58f-bb76-4029-8ec5-7b10b837ccc4", "comment": "Malware payload (IcedID)", "value": "9e9f7670a295664075ffe357bb456120", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279884, "uuid": "34c1394d-8d9c-4547-9c66-7bfae8071d45", "comment": "Malware payload (IcedID)", "value": "53ce72a6074e1483c9ad00285c277b6cd56bf07112e66617b472c52ed278e057", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279884, "uuid": "34ed2008-a091-44df-b736-597963db6cea", "comment": "Malware payload (IcedID)", "value": "0f1fd4c2276756540763fc1e6ff184005ed1f293", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279884, "uuid": "1b8733b6-9201-4040-b4d7-84b0f4cceed1", "comment": "Malware payload (IcedID)", "value": "2b7b05132a9f95dbb7ff72c48af7d9de093a1db1f9b0dcb93cf5d146302f27c59da93a6f3bcff185279ef65c0b70beff", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279884, "uuid": "25cd9b86-b42e-4ed1-ab23-f78543e1074c", "value": "62044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279884, "uuid": "d6acb0a6-1cd1-429a-b0b3-00257d177494", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279884, "uuid": "1048e825-4237-453d-89d3-a08cd770122b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279884, "uuid": "6e1c1005-b017-4667-ac40-471bb292a5cf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279884, "uuid": "67e07cbb-3464-4fb7-aeeb-7eb71650bc9c", "value": "document-1729033050.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde94ac6-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286166, "uuid": "545fcf6e-e15b-49f7-ab96-bf1c6c98db15", "comment": "Malware payload (IcedID)", "value": "823ed1cf6226791d5cf818454fa689f5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286166, "uuid": "a06b7f38-98eb-4009-871c-73264a3b80b6", "comment": "Malware payload (IcedID)", "value": "5412162dc672cc843d7dc7d7f47c557747bcbe081285fcec9a4f406a4ee3489e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286166, "uuid": "481140b2-46c5-4e84-99cc-5c4c6ecf0e03", "comment": "Malware payload (IcedID)", "value": "3b10d4879a6536931d9dbf6599a5f49e6f4dfcd6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286166, "uuid": "ad6fae5c-308b-4e9e-a9b2-97107febc30d", "comment": "Malware payload (IcedID)", "value": "79b1f1ece266e137c4aab7e8d68ef3ebab7c5406849a99384893609eb2f6e57d9beac1d6b8ee1068fdd5e3fe5798094b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286166, "uuid": "6c9a67cc-da55-4f48-9fcb-2f739e495135", "value": "31838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E0D42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286166, "uuid": "775afbaf-f31d-4ec3-a3d2-8078a3686c81", "value": "1536:IB240XZfcaaxf+EQliU2hawXCAIoo8+BNvMhfvm1:+2d1cBWEQXMX9o8+nEhHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286166, "uuid": "27ca4084-6de9-4439-a8e0-b60de91d1de6", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286166, "uuid": "25b8cb5c-e5a9-418a-b798-fa37f862589a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286166, "uuid": "1baf58fd-9b26-4fe6-9a7e-84a785f971cf", "value": "2638.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51846e5-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617294714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294714, "uuid": "d2527064-5bd1-4b86-a8f7-a55ab2ed44f5", "comment": "Malware payload (IcedID)", "value": "68fdc6623f363e374d81162294a8d922", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294714, "uuid": "e7c036a5-4fd6-4e01-b017-36b5b9249c3d", "comment": "Malware payload (IcedID)", "value": "54398ddefad7be42916c1400643cbf314d72c1dbc6a74f375121879d5713726c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294714, "uuid": "eabd064f-ea47-4264-a101-9f1ccc3986ec", "comment": "Malware payload (IcedID)", "value": "d614fc3115289e471233de644df0f8d759c42e45", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294714, "uuid": "d5f653d6-e7b2-43f6-9e46-6e46b05095b0", "comment": "Malware payload (IcedID)", "value": "717bdaf9f7357c2cd2550e05eeacaecc797b035856b56e51a113aeac8a1ad2859ce474d8bb07547db144d4727c4e2a99", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294714, "uuid": "e9731fad-a196-4676-b9d7-0c31186adbf7", "value": "BF838CCDC913E1D9C2559FBD5A0A308511F4E0B6276FF11B148EAA2E4C42FA40A5E79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294714, "uuid": "ebf61ef9-f3f7-44d9-8a1b-298dd135fe8f", "value": "1536:IB240XZfcaaxf+EQliU2hawcCAIoo8+BNvMhfvwM:+2d1cBWEQXMc9o8+nEhHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294714, "uuid": "f6444fe2-4bd1-4d5d-852b-b1f84932ee2e", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294714, "uuid": "cefdd507-e8ec-4fd9-80fe-4281aa9c2c1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294714, "uuid": "87f4175b-fd08-47c8-82e0-0f4f23184b80", "value": "1528.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29d3228-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287784, "uuid": "56095d03-5141-4a68-82ab-19a1ed2ecd55", "comment": "Malware payload (IcedID)", "value": "d0ebb17c1c09756f7047250231323023", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287784, "uuid": "c9304775-48a7-400a-8a95-713f838d6a0e", "comment": "Malware payload (IcedID)", "value": "545c72bc8e5fbd72e7a7a589824fcd4496a79e2dea5b9d4b39352ed0794d5919", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287784, "uuid": "e057bbe8-e1ec-44ce-82fd-34cf42fb0b7a", "comment": "Malware payload (IcedID)", "value": "62e95675238e7a19f07660af1e0305b7b8356159", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287784, "uuid": "301a1854-b0db-448e-967a-5355f3064e89", "comment": "Malware payload (IcedID)", "value": "364d802072d12998292d8144946d86623b1b6188f50b02798852dcb5ba0e0e6875d460c016912de76a17f351d4449ab8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287784, "uuid": "72ad6cbd-5c04-4841-b8c9-8110f211df40", "value": "D4838DCDC913E1D9C2559FBD5A0A308111F4E0B7276FF11B148EAA2E0D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287784, "uuid": "70cd59e0-2d55-40db-9008-bfe4f712d3f3", "value": "1536:IB240XZfcaaxf+EQliU2hawaCAIoo8+BNvMhfvbY:+2d1cBWEQXMa9o8+nEhH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287784, "uuid": "9521d5d0-1e63-40e7-9022-f552957d48a3", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287784, "uuid": "de414dd1-cdc9-4b5c-bd5f-37df26a5372c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287784, "uuid": "ac28f66f-ce08-46b1-b09f-6512c9f7b196", "value": "3253.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e05c73b-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617261846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261846, "uuid": "fdcdda40-7f2b-4651-a276-fec2a2aa0b46", "comment": "Malware payload", "value": "ebe19768a5489ee4fa2d6e8d19290666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261846, "uuid": "37bd1cba-8b91-483e-8242-20f74459874e", "comment": "Malware payload", "value": "546e5320773891c160621ec99d48fb4d90d6d58bc26ab01d7e5a3f16fec9636c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261846, "uuid": "a549b2a4-cf15-472e-9aac-2a8f0daff53d", "comment": "Malware payload", "value": "2371e638682b62b64ddb753bafa4558ab320e587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261846, "uuid": "79e84bb8-fbf3-4484-ac70-59a3ee29184f", "comment": "Malware payload", "value": "798c5e5b02aa870dc8e4316574801c50f1a412a07f37585c43341867436f74566fddb19da4512f1308130e0016d057c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261846, "uuid": "09b3f124-7860-482f-85ad-03c57ce4ec37", "value": "DF06334305EB2EE8D53816713A770FEDC7943A824782E4AE7C8561490BF918D7FA72C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261846, "uuid": "357ea462-d9ff-4994-84d1-d3425ad864d6", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261846, "uuid": "a263e3eb-f0fb-4f54-ba4b-0c2fedc5847a", "value": "98304:BRHA3hfl5fjJFa4wPu/1Nf1QTGRhkfh4A1D27+k:BRHA39J4Bu1Zch4427L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261846, "uuid": "e1146ab0-40ec-458e-a665-042661eadbaa", "value": 3769647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261846, "uuid": "17962f18-6572-43e4-b50c-50db74bce03e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261846, "uuid": "00f45745-b2de-40a0-8f1b-32e2ae2b1fa6", "value": "PO_4000010871_RFQ_PRS_1000024753_RM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6845bea0-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274372, "uuid": "613b9d06-be37-4e04-8afa-2f2d13162bc5", "comment": "Malware payload (IcedID)", "value": "a755783cf691d3d9810533f5820171be", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274372, "uuid": "9694cf1d-ca6a-4d02-969f-bff4ae25d9d6", "comment": "Malware payload (IcedID)", "value": "5494a7634c678652b2768420d8029119cb9cd25f165eb3fe3e66889fb10e173b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274372, "uuid": "f115972c-a51f-4c66-9a9a-b64569233d97", "comment": "Malware payload (IcedID)", "value": "7075a51d3d46e3838a54183f3ad30dc125bd0bed", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274372, "uuid": "c111e804-eea1-457c-ab4b-2290fe7dc1f9", "comment": "Malware payload (IcedID)", "value": "276cb3146dee23586398fa950ceab9235250920fc0b3646dff4a31f2a01c3287fc706f7f9491c3bd941c51bd3ffb0795", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274372, "uuid": "7438f50c-5650-4032-b651-1101cf81690d", "value": "A1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274372, "uuid": "d2f39f8b-dc64-4d96-8f86-6d6e62fc658b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274372, "uuid": "76cf3ce4-ec8b-4c6c-b290-c17444d4fada", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274372, "uuid": "85848e3c-8e20-4fcf-a3c8-d95d461e48a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274372, "uuid": "4b5634ef-f748-4aa8-9f64-6283281c5825", "value": "document-1963876393.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016c252a-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617276776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276776, "uuid": "14211f5d-349a-4071-97a3-af14af503794", "comment": "Malware payload (Dridex)", "value": "ae833367afc84264f30a6c675016fd09", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276776, "uuid": "cd8bde03-48fa-4bd0-86aa-bda8ad7a698b", "comment": "Malware payload (Dridex)", "value": "54a320a98531376c42b96a1f346181b61866f6e3c0f840c11ff3cd1ee240f694", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276776, "uuid": "643ee931-b160-495e-9a0c-86eb8b7868c2", "comment": "Malware payload (Dridex)", "value": "f207a04fb3891c03a5a9eeaee6f4106900ba8c4f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276776, "uuid": "1f03e02b-fded-40d2-a141-2c94d12aac38", "comment": "Malware payload (Dridex)", "value": "9ed666b9681e55687ff64b7ade93fc9f114adc86f7f66a53ba3a01a2911d238a5c604f68db7c3ca4fc76d62284fc2499", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276776, "uuid": "7b6cc1cb-eded-43b6-b827-a14157eac48b", "value": "40248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276776, "uuid": "1c198ac0-6688-41f9-b58d-6060ceef0da2", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276776, "uuid": "16f01139-9434-4048-8d23-24b120c319a1", "value": "3072:k6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:koMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276776, "uuid": "f373df13-d57e-44c5-95ce-9206ab8aab1a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276776, "uuid": "d8d0f3e5-dd7a-49a9-8260-b83cdd725e1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276776, "uuid": "f25c7713-ac2c-4e74-b46b-74eba1d86864", "value": "54a320a98531376c42b96a1f346181b61866f6e3c0f840c11ff3cd1ee240f694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5cecc2-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292366, "uuid": "61734234-9f0a-45e2-a29d-c4d519318ad6", "comment": "Malware payload (IcedID)", "value": "6bb42cd7abb03c1943fee87fe0c1f6e7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292366, "uuid": "f8da30f6-6b00-45d0-8f30-918fa338f4c5", "comment": "Malware payload (IcedID)", "value": "54df16667775989d037a4436014d5858eac277b495af8c8ef0470afbf2e96977", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292366, "uuid": "9768aaa7-1f1f-4afb-a13e-f817782df229", "comment": "Malware payload (IcedID)", "value": "f654213dd36bd78a02a95ae5a4a4259db3df183a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292366, "uuid": "2ece7b67-504c-4666-91b9-13b931aef054", "comment": "Malware payload (IcedID)", "value": "9f01c7e2356080c7ffbb34e72cccbd282aa65f261271301e55b24eeec8e042d782c907f7018ea134efeb905e9605a37a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292366, "uuid": "2db8081b-4c2b-4d75-bc91-dcddad2fe3ac", "value": "CA838DCDC913E1D9C2559FBD5A09308112F4E0B7276FF11B148EAA2E4D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292366, "uuid": "2efefc48-07e6-471a-bdc8-94fe56cd105b", "value": "1536:IB240XZfcaaxf+EQliU2hawxCAIoo8+BNvMhfvmF:+2d1cBWEQXMx9o8+nEhHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292366, "uuid": "1aeec2cd-1ff7-4338-b6a8-ed951a81d0da", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292366, "uuid": "215d6bda-3b14-42d3-b227-780cc72ec2aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292366, "uuid": "007a7a79-df7f-4974-a2af-7cc862dbeb69", "value": "2726.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e43ee6d-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287777, "uuid": "4b6dceb2-0245-475f-93fe-a74e8437adfd", "comment": "Malware payload (IcedID)", "value": "5714ce6918bcd66ae6c9abdc61eaaa33", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287777, "uuid": "bca6fbd5-0f91-4f1a-82bc-5caed5368205", "comment": "Malware payload (IcedID)", "value": "54df58bd3654d48b5c0f6c6c847a61332ddc437c579d0c90b37ef9dd664edd51", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287777, "uuid": "0fd7ed0a-d2b9-407a-9209-db1fd313119b", "comment": "Malware payload (IcedID)", "value": "a2697854e23bc862330da8bb9cf2efe272bc39f7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287777, "uuid": "67726373-abee-47eb-a2fc-682b400c98b2", "comment": "Malware payload (IcedID)", "value": "f083184c162b89858f29ea7a725a58390dd3cde5760c04c39cb213263a52d4b47448269266e94e5d157f8b7febfa61e5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287777, "uuid": "e562d9e0-01e6-4bd2-a66c-e507cda4f008", "value": "25838CCDC917E1D9C2559FBD5A0A308512F4E0B6276FF11B148EAA2E0C42FA40A5E7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287777, "uuid": "a257f9e2-ae41-4f40-b881-0db38c39e947", "value": "1536:IB240XZfcaaxf+EQliU2haw9DCAIoo8+BNvMhfvyL:+2d1cBWEQXM9D9o8+nEhHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287777, "uuid": "2e280eac-964f-4e90-b39d-847069e82d26", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287777, "uuid": "fe9d15e4-671a-4551-9ff8-6b16999efad5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287777, "uuid": "dbecbcc0-1d74-410b-a5de-2d9cdacf754a", "value": "3048.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f1d2b9-92d1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617271207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617271207, "uuid": "bb92121b-eb4a-4163-aa63-22c2e70848ec", "comment": "Malware payload", "value": "91d4bd22ed5811a4dc55cc0367df38d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617271207, "uuid": "b84096e5-5c62-4dfd-b767-de7c0355ac31", "comment": "Malware payload", "value": "54e64e0330cf0c720ce3481eff4b5e6c42d66b193889ab5f3873d7a4f91cdf6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617271207, "uuid": "d0a87243-78c6-46a3-a92d-c17b41b506f0", "comment": "Malware payload", "value": "2425356e1270bc10f2b44d74e52fd79baa8d7aeb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617271207, "uuid": "c57b9b3a-0c74-42bd-ad07-55124f0208e6", "comment": "Malware payload", "value": "6a2b140d3d84c707deda6c01068e6ce5efb7356008216cc7c88e76748396b9812bc787f408e63f2d3f434cfe0b42a55a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617271207, "uuid": "d04f6ff7-dba0-4477-8495-d1ff40950321", "value": "32730242F2F9D37BF8051B315C635BD09237FAC2E8689B6D2D48920D8E659C61C63FA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617271207, "uuid": "ec4224ff-2164-41ec-8f32-73b0db6d881b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617271207, "uuid": "5d31538d-82e6-4206-8d5d-aa2347e56fea", "value": "1536:mLIW4yst1nUaqOtpF2kfZ6CeCsg25kl7MO55nlkPAAYTL107:mLIWCt1UgOZjCJll7rfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617271207, "uuid": "e77cc9f4-3371-4d2f-8eee-9f6b1bf9d64e", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617271207, "uuid": "c87c71aa-671b-41df-b2b2-c9bb01d04352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617271207, "uuid": "a212f994-a0c7-4ece-9478-ae4dac6ee2af", "value": "virus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ecc39b-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617286204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286204, "uuid": "b3de30de-58fe-414a-bf7e-c120ee0ad3dc", "comment": "Malware payload (Loki)", "value": "122832f0124f8e8f22a2ea0bf118d247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286204, "uuid": "3051a731-26e3-40b3-8abc-fa83eeb6358e", "comment": "Malware payload (Loki)", "value": "54e65f3e7a6a79c350d9b4082f5e5c7f08bd383e00f944c00f6c43e6d05de523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286204, "uuid": "4556ff18-198a-4e8c-b527-a3cf41699582", "comment": "Malware payload (Loki)", "value": "b8e30e0392b3cec59723a647f4c67d6420caeaa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286204, "uuid": "f4321d0f-72c1-4e76-8280-3681caaae35d", "comment": "Malware payload (Loki)", "value": "b547d3cb5277775e778dcf688cf9e6ee80c693b083387b6b5fe1df0c751c1353413e70dedef2219b76338a81137fd898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286204, "uuid": "1a404b39-8587-446a-b73a-956c564cedc1", "value": "BC159D293F24658EC46706395458D04C9FE67CA928D3D2C27EEE37EBA0B3F5303A5196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286204, "uuid": "46009063-2c4d-478b-880e-db1cd56f34f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286204, "uuid": "947da715-5042-46a6-811a-f34c5e56697d", "value": "12288:OFCZi2gONCaYWCx8QCEGitsH0ZEGHua2gnaJZHWE:kCZrtYDx8WGuK0ZEsujgaGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286204, "uuid": "d7e188a6-6536-47bf-8efc-6a672146cfcf", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286204, "uuid": "72a0bbb6-854f-4268-98b6-0eab910c353b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286204, "uuid": "51c111b4-2821-4b67-9678-c064f18a9396", "value": "nueva cotizaci\u00f3n.PDF.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb9f357-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288580, "uuid": "252a9e01-4a90-478a-a71b-d0037a1075b7", "comment": "Malware payload (IcedID)", "value": "3cfa90c1e3b4ea29f606a5c534475cea", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288580, "uuid": "06094566-52a8-4d05-9614-5f6a026d029d", "comment": "Malware payload (IcedID)", "value": "55504789c775286430dd4668b9675f1a46ca1826e1ed056d448efd166618ef35", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288580, "uuid": "2d4adf8a-ba85-43d0-a1f2-3a1337248729", "comment": "Malware payload (IcedID)", "value": "aed0c2696417bdb43164437723f47330eee95ebc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288580, "uuid": "b1d9a4df-89d0-4563-a2d2-f1ab67d76724", "comment": "Malware payload (IcedID)", "value": "c884ed3d9420e66026c8993b03fc44d6c4bfc7f950257e6dc3f361a130f4729cb4adca0276782a843813aa825d915d27", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288580, "uuid": "4e61fdd3-75f3-4709-b4e7-aae2423b8e40", "value": "9F838CCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EAA2E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288580, "uuid": "5eed5177-8f50-4c0a-b5a2-9f959df1bf3a", "value": "1536:IB240XZfcaaxf+EQliU2hawtNCAIoo8+BNvMhfv6K:+2d1cBWEQXMtN9o8+nEhHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288580, "uuid": "54cbba4b-8fc6-462e-8452-2dd5e103a877", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288580, "uuid": "0571de37-c029-45a6-92e4-ef65e3547192", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288580, "uuid": "82268f26-93cd-454a-bd63-ef8f49a1ea0d", "value": "3324.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445cf450-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282472, "uuid": "b2cfe41b-3f75-42ea-b408-ad3cb4d71fc7", "comment": "Malware payload (IcedID)", "value": "a6b90d5eda89d909bea2fc039c9c705c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282472, "uuid": "b3214dc4-bf49-4e9b-97c4-d2c329bf97d8", "comment": "Malware payload (IcedID)", "value": "55772cf05231886439cccbe35ecd002b8fa2eb5121955d4e4bff37c1ae65fd31", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282472, "uuid": "bca0040a-7c53-4e99-ae66-c8a0955fc7c3", "comment": "Malware payload (IcedID)", "value": "ad087461066a2b1253f1e66601e06b675361a2cd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282472, "uuid": "05780740-1984-4adf-88e1-61fa537a51e0", "comment": "Malware payload (IcedID)", "value": "52767a7e3f7a981aa9fd767201c52f55c43b9b479f494665320e9b1173be5987b5c394e39fd94c16c8ea280d62d5409d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282472, "uuid": "21ad0465-e000-4dba-83cd-ebb0086496a8", "value": "F6044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282472, "uuid": "2defd475-4fd6-44e3-9107-508caf96b368", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282472, "uuid": "e7981729-f4c6-49b8-826a-c5384f028952", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282472, "uuid": "1130aa8d-63e1-466d-b559-5919cfb26fbb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282472, "uuid": "573a1798-7792-4890-a635-219bd6823433", "value": "document-696812552.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7289e32-9326-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617308059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617308059, "uuid": "584184f9-502a-42c4-bc79-d364f51d54cd", "comment": "Malware payload (IcedID)", "value": "0ec1f3944f74a649f0e7c4ad9eb93f8f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617308059, "uuid": "5a9dcdf6-b24f-4dd8-9492-ceb3cc22e504", "comment": "Malware payload (IcedID)", "value": "55b419bb9f56cba7fffd7b7cfb80de86b68d140af748bebb595815e9d667d6d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617308059, "uuid": "19cac820-5024-497b-9e0a-007f53f8d04d", "comment": "Malware payload (IcedID)", "value": "4eb616bbda6ced1c5dec25feaaa2d7db0b9f76fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617308059, "uuid": "5c165a47-06a3-4f93-887f-8b440a6a4c3f", "comment": "Malware payload (IcedID)", "value": "7ff5829ccf88a926484523a90a2fb55d07956d1443be9693c29f99aea418ca2e378a5ecbd1cadfc9113bd18809803978", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617308059, "uuid": "c29b9567-c25a-4ed9-a65d-b264b3252a7a", "value": "C514F7935CCFB663D42F90F1A8A1547D7F30BCC413E297DBA9084B1AD993792A972318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617308059, "uuid": "3db2a23f-cdef-4e29-b69c-cc7efc6c082e", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617308059, "uuid": "98fcb009-9954-4922-9e42-6be9cbf39830", "value": "1536:Vq8ByBeZnwLGM+NoV1XjeNSaziIz7Ja5j/Nj/IXoZcq+M6qaCZZtr2wS+FJZLT:Q8+Kjv4RECZnrDSGZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617308059, "uuid": "1318ee78-3e3b-4b21-822f-13238fee725f", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617308059, "uuid": "2ca7347c-a9f3-417c-b3f1-5a3b82af61a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617308059, "uuid": "d2bf2f76-3bb4-4878-ad11-289979eb7065", "value": "55b419bb9f56cba7fffd7b7cfb80de86b68d140af748b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b323df7-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291449, "uuid": "959b1e56-9979-4db4-9a5d-d0a69615192f", "comment": "Malware payload (IcedID)", "value": "a6c53e567c7fe3c9978bb417e435f627", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291449, "uuid": "5aca57b2-5c13-4839-ac4f-17561e0248d7", "comment": "Malware payload (IcedID)", "value": "55c05a9cef1b4daa25e1acc259179852f8bc31b353d5665f1ff29fa1b10126f5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291449, "uuid": "9a91c5d5-db66-411d-a8cc-ac4a1d9f82d8", "comment": "Malware payload (IcedID)", "value": "2810faf57eb0c7fdd7c33990d39d6b6dc7f7a703", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291449, "uuid": "9744a1e7-584d-4a42-92d8-dc11155f024d", "comment": "Malware payload (IcedID)", "value": "a561b935abb96eed500d9454f8a71a175ed950a7d8c7fb8c1050e71353abb2f887aa58017a83053fccda5ad2cffc73a2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291449, "uuid": "b472f869-fb75-4dce-8802-1bcea0424daa", "value": "D0838DCDC917E1D9C2559FBD5A0A308512F4E0B7276FF11B108EAA2E0D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291449, "uuid": "b666153d-2eee-469c-b1f1-48ad0e4509d7", "value": "1536:IB240XZfcaaxf+EQliU2hawZCAIoo8+BNvMhfvKq:+2d1cBWEQXMZ9o8+nEhHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291449, "uuid": "dc218df7-0bd4-4aab-b154-31ee32e4019f", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291449, "uuid": "06ab36cf-e4e5-4457-b7e6-454eaa3f9ce5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291449, "uuid": "3814112c-05a7-4e38-bfb9-ce18ecde153c", "value": "3274.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd89ce8-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275643, "uuid": "a79729c4-7e1e-4822-96a9-9c132c532155", "comment": "Malware payload (IcedID)", "value": "62e3bf30baa9f361cca434c3ff9daa75", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275643, "uuid": "ef73d43f-f2b4-47dd-8d2e-4d50637961f4", "comment": "Malware payload (IcedID)", "value": "56023c4a675fbd9bfb572c014a401c50fdcc819e6f7f267c9fef0db777037aac", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275643, "uuid": "7cc308f3-91c9-41fb-8609-903988ce79a6", "comment": "Malware payload (IcedID)", "value": "c86e734e816006b24f4d864729736b32984ec380", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275643, "uuid": "32a97d52-75ec-47dd-94cb-33572cefff2c", "comment": "Malware payload (IcedID)", "value": "a18cc1bb3fc02e28eed50ce9f778be783df4873047deb6294eb56d0ba1c147f87bafe248fbb7a35483027df847888347", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275643, "uuid": "5106b545-d337-4b58-90c9-711b72faed77", "value": "88044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275643, "uuid": "47c7aa42-7d3e-40fc-97cc-14c2104f0d52", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275643, "uuid": "3436610d-f74d-4e63-b20e-69422fef16b9", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275643, "uuid": "26cc8567-32fc-4813-9dba-51bb35e0ca0f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275643, "uuid": "19758bef-2dd9-4c47-97e8-8eaecdc3a9fa", "value": "document-1901433760.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec72f21c-9305-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293921, "uuid": "9a309f25-38f3-4b47-bead-05997be34c88", "comment": "Malware payload (IcedID)", "value": "b27ef1868310912d5382e8126f760474", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293921, "uuid": "bb5a3a9d-a0bb-48db-8eb8-da89b0155a2b", "comment": "Malware payload (IcedID)", "value": "5613127114ec89c5134d4111ca4c362ca3fa86ebd1abea8a9974e1710bb5ef0f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293921, "uuid": "9f0c1f9c-1238-4a7b-a5cd-3a461c27784b", "comment": "Malware payload (IcedID)", "value": "9791c19b9e0e66f3e92235a69fc4aebcecaeda34", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293921, "uuid": "5a62bee6-04ff-4514-829b-bd7729efa1b1", "comment": "Malware payload (IcedID)", "value": "8b226fad6cdf533c5d39e6a922e76a3e285adbdc62be2c178ce60a3a869a12b3042a6056354cf4285cfcc315a8f7d9c8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293921, "uuid": "07951db5-e1a6-4fd7-a583-6cd2855216cf", "value": "F4838CCDC917E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0C42FA40A5E7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293921, "uuid": "7536d4c1-0515-4586-81f7-ebd18c92293c", "value": "1536:IB240XZfcaaxf+EQliU2hawpbCAIoo8+BNvMhfvsZ:+2d1cBWEQXMpb9o8+nEhHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293921, "uuid": "b859ceee-efe7-4679-bb9b-06c7ed8bad71", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293921, "uuid": "6352aa2b-994d-4ccd-b6fb-426e11df92e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293921, "uuid": "525407b9-e92a-475c-9c56-e10354a7e6c6", "value": "3082.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc1c32c-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274755, "uuid": "3709af39-0991-4e57-bece-6614dee7a73c", "comment": "Malware payload (IcedID)", "value": "bb5ce17466a2885960dc7eadf9530d4c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274755, "uuid": "077e6df2-5e46-4776-bf4c-46fb0275c672", "comment": "Malware payload (IcedID)", "value": "565a043e200559f7e03f7f43d813de0e8ba808115235e8d44696d3bece8dc1f9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274755, "uuid": "449f88a8-2804-43ae-a937-238cb8f7daa4", "comment": "Malware payload (IcedID)", "value": "42a747c676b6a0df677b09321aa503e17e4ef8dc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274755, "uuid": "506a9fe8-2ff9-4fac-8818-e732ba1fa580", "comment": "Malware payload (IcedID)", "value": "ef55b9c038e458aa6195ca7f3bbe4484843c05557053d5efe1c7445db218c14c08f22daad536002a135aa4d67bfcae56", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274755, "uuid": "4fa8ebff-9ccd-4fea-8e59-3920871a62cf", "value": "11044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274755, "uuid": "91d19b3a-ce19-405c-948f-15fca2c33569", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274755, "uuid": "39699acc-b174-4734-81a5-6708427b27bd", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274755, "uuid": "f613bd80-6ab3-440c-8242-e841c3fa0e72", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274755, "uuid": "c61d085b-acc0-477d-be4b-a7f9c945f457", "value": "document-1093103344.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5e74a1-92fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289035, "uuid": "3fc6d72e-b8eb-4cf6-8746-b9b8d023004d", "comment": "Malware payload (IcedID)", "value": "d11d06a51780779d54e8377fa629e7b5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289035, "uuid": "05fccb43-3a75-4ed5-8a18-f6927af53f7f", "comment": "Malware payload (IcedID)", "value": "565dfd3200e21dfd7b4386da57389de7ef487a886c4f605fd4d5ae58c761c5eb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289035, "uuid": "5a2ea614-64d5-4cf7-89c5-971f53be6a67", "comment": "Malware payload (IcedID)", "value": "f999f091985727ab69660283a8e7422ce407756c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289035, "uuid": "6c5ff5cd-95d9-43f8-82e7-4dccfd4ec6df", "comment": "Malware payload (IcedID)", "value": "2961c5c45061be50d7bea8d90503a2c7817041478c5b870ded3d89936ec2ae539a86bdeb199de5e06b5fd6ffdf1b53ac", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289035, "uuid": "4d4f145a-e15a-40c1-911c-71b25b5b55f3", "value": "63838DCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289035, "uuid": "ae9e6178-fa22-406f-b425-8eca2de12dab", "value": "1536:IB240XZfcaaxf+EQliU2hawECAIoo8+BNvMhfvUR:+2d1cBWEQXME9o8+nEhHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289035, "uuid": "4176821e-6614-4b47-a2f3-69e9dbc75a0d", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289035, "uuid": "3f8922e0-b6d3-477a-a902-03439db64f45", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289035, "uuid": "9e0ed9c3-52dc-4d8b-af8f-adad00806c4c", "value": "492.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa75f75a-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275906, "uuid": "7c48f02b-7087-424c-904a-6e7f117d0ed1", "comment": "Malware payload (IcedID)", "value": "5c3e18d77dd8bf41fd2cd81110dd4210", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275906, "uuid": "94bc8a36-d4d2-4319-bf24-6044df55d369", "comment": "Malware payload (IcedID)", "value": "569ce78b2147ac73430c0fbfe8ac3ccdc9491f10b2ca6e13b4a3581a7455c590", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275906, "uuid": "55db4ac0-4f2a-44cf-8075-d9bfeee7d86a", "comment": "Malware payload (IcedID)", "value": "737dc401fc2b5b25ae9c606a77369184f1202e7f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275906, "uuid": "9eca376c-c96b-4f46-b328-5173041513c3", "comment": "Malware payload (IcedID)", "value": "eafbe231b5d21c5454674335eae099c1d04d764d3299206d7b19cb93ee21c8078818738b309920ebeaa3e61301712234", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275906, "uuid": "4949d112-5a30-4b1e-a14a-1e4306ec1e78", "value": "1F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275906, "uuid": "e83871a3-295f-4233-9961-b31833821554", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275906, "uuid": "e100871c-e3fe-47fb-be58-e88cc752e77a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275906, "uuid": "629d3c75-40da-46a2-b317-8b9719e2f0ea", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275906, "uuid": "ee57647d-e0bd-45d4-9e33-4b01ee861059", "value": "document-1694945605.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4749e071-92af-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617256707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256707, "uuid": "fd96dab7-670e-42ea-9bbc-16144f11a41f", "comment": "Malware payload (SnakeKeylogger)", "value": "4adf9215db11fd4bb2295806cdde9143", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256707, "uuid": "88da8461-0b7f-4d61-ad4c-8a59d8a1908b", "comment": "Malware payload (SnakeKeylogger)", "value": "56ee4cc9c6704cec58e6717aa171ca3efa13843fd4028254a74d23448614ba8d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256707, "uuid": "c3d896fb-5c1f-4c7d-a1a9-2c936668d272", "comment": "Malware payload (SnakeKeylogger)", "value": "145957e8225393859ea37cd02e5efc9113145732", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256707, "uuid": "eb638d81-026e-4816-a20c-3d52828cc430", "comment": "Malware payload (SnakeKeylogger)", "value": "5a3c2a848ce43b39b73cd793cf2415dca12de0a303d1b03d864f118cb86a63d2050bf066f41e3a388e4b7472a218af33", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256707, "uuid": "cfc6cc78-fbb3-4b1e-8344-c252c44d3cfd", "value": "A0B4231A677D2751D332ABE389C3AAEAE7D4936BCEC0E1746C18451412548B78B7FE02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256707, "uuid": "2ca3f463-50e2-4640-be07-0b4e9d9aa8f7", "value": "12288:2yVCKGFK6fjnl2CHWhFsmSov+tX7v/GXZpDZK2:IF5bluFPv+tD/KpA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256707, "uuid": "cd2647ea-0623-4024-8062-2048d1eefdab", "value": 494530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256707, "uuid": "c80a5145-1846-40b8-9edc-1df7ed470d82", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256707, "uuid": "1bfe0784-116d-4ebf-87b7-6e60df47d690", "value": "SKM__C20192910887888001990.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd589b4b-929c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617248772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248772, "uuid": "2fb1fc2a-e33a-41fb-a963-dfa82926711d", "comment": "Malware payload (Dridex)", "value": "6819bcbd58df5ccd5c1461c62f19c8e8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248772, "uuid": "671d1de9-f54f-4cc2-8c14-8dc8f1e5cd2e", "comment": "Malware payload (Dridex)", "value": "56f484c487862db6fe12e79d1f35caeee026c7f2448b0bd1f77175f9114365c8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248772, "uuid": "e7186ca0-3403-464f-810f-06753173dd98", "comment": "Malware payload (Dridex)", "value": "97a166804b9ffe29d08cd101f39c730e24349741", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248772, "uuid": "c1bae800-d80d-4b29-8801-d71cb3a2caa2", "comment": "Malware payload (Dridex)", "value": "7222cfd168a59b77e06c86a2e7c4fa4c40b456df6935d702bd886597d08b637053e0570947d23cb2f9ecdbea056c5dd1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248772, "uuid": "26feb874-a43c-47e3-b9be-18b3cb941a42", "value": "CA248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248772, "uuid": "45758d01-8692-473b-8c15-566dff655b7a", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248772, "uuid": "22cfa635-7a03-4a0c-99f9-897685c86c7d", "value": "3072:h6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:hoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617248772, "uuid": "1bfa68d6-f81c-4afc-8d7e-2322923df53a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617248772, "uuid": "dce7bb2a-f7c7-45ef-b9c9-4f4739e4763c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248772, "uuid": "dbdb66e6-d5c8-4206-8e01-988c5e84cb3c", "value": "56f484c487862db6fe12e79d1f35caeee026c7f2448b0bd1f77175f9114365c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c805e7-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288279, "uuid": "9dd5cffb-02b0-4f61-903a-67cfbcfc8ee5", "comment": "Malware payload (IcedID)", "value": "7e076f80a3ba33446c72ee32e71b999d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288279, "uuid": "3de77cfa-aa79-4fb5-a963-f334e393c0f2", "comment": "Malware payload (IcedID)", "value": "57af376db7ba6165d7b3c8b1496e41575676cc2177b69dbe843c6a0175480cee", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288279, "uuid": "e9c61c72-e68b-414e-9f3d-8d350e5d313a", "comment": "Malware payload (IcedID)", "value": "f94b5a9913f2a46c27b9623749e5beae5c28d50b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288279, "uuid": "f79559c8-1d2e-4317-8c42-a2bb6bda848c", "comment": "Malware payload (IcedID)", "value": "8b8df20abfb12f68190a6b911bc7b6d1a3191b0399ad7f68249516d461fd241379b4197d6dc228860c2d377289eec35f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288279, "uuid": "00b6eb79-7755-47bd-8a95-d4c8ed047b77", "value": "9F838CCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EA62E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288279, "uuid": "c876ce7c-8b98-4bce-9f12-65c1cb3154ef", "value": "1536:IB240XZfcaaxf+EQliU2hawsACAIoo8+BNvMhfvNE:+2d1cBWEQXMsA9o8+nEhHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288279, "uuid": "1aa84199-47e5-4454-a883-476c8c4afdd9", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288279, "uuid": "f679eaba-6fdb-4d72-b79f-1af13bc3318a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288279, "uuid": "ae9b4b68-f60a-469a-b339-aaea5d254426", "value": "2119.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3a49f3-92c4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617265901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617265901, "uuid": "0435f5c0-008d-4cc6-9042-6551f146a054", "comment": "Malware payload (Dridex)", "value": "a7bf19bde3c5588d02bb06b53cd08dc1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617265901, "uuid": "bd446357-2adc-4a56-b84b-50b6ab2b998e", "comment": "Malware payload (Dridex)", "value": "57d69e5c0ed696eeebc66fa1e6e4652a42bccc1961d4ce16cbbc11ff4e121ea3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617265901, "uuid": "3e28f8b1-3c5d-497e-b3ef-5eb17c8499a9", "comment": "Malware payload (Dridex)", "value": "4c6157738f7c33ca0db79f03dd2f919877aa9863", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617265901, "uuid": "86366958-897f-45b2-bf09-d743e70a86ca", "comment": "Malware payload (Dridex)", "value": "e285498737b87d9f72d7fa73874c23e50eb6f6f29dc5c655b7e429e93c5b96030b364f2b89d47573b94514909b977d74", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617265901, "uuid": "959df822-f5ac-4f9b-b6de-5c656b1351b1", "value": "D9248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617265901, "uuid": "e723fe75-9192-44e3-9b3a-422fa68bd5e6", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617265901, "uuid": "fe8e0bcd-03c8-45ed-90c6-8bf6948bc934", "value": "3072:t6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:toMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617265901, "uuid": "ecb1fef5-4b85-41b7-95cc-13bbe85617cb", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617265901, "uuid": "dd28dd84-685a-467d-9d56-fc3ecf378afc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617265901, "uuid": "cea5eb40-02d4-46a6-a56e-5807a6933358", "value": "57d69e5c0ed696eeebc66fa1e6e4652a42bccc1961d4ce16cbbc11ff4e121ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364e5352-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617261833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261833, "uuid": "16b5bc64-6c36-4b4c-8015-c09f8f4795d2", "comment": "Malware payload (AgentTesla)", "value": "df09c653555df27dabb2496e98c37386", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261833, "uuid": "e76bb4c3-0689-4af8-a53d-f6672c75a35f", "comment": "Malware payload (AgentTesla)", "value": "57f62ce00cc4f7b78f7bfcc9c06468fab7a17ce5aa69e8f7d51fe60c4e8d4ae3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261833, "uuid": "c5e7fb36-856a-4fe2-9066-00cbbd9dc625", "comment": "Malware payload (AgentTesla)", "value": "5c78c8b7e4dded947f97a3ccdb09907648b7db74", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261833, "uuid": "e0e79e91-a599-4f0d-a5e4-d67f60b04e49", "comment": "Malware payload (AgentTesla)", "value": "f281edd9524f0a68f24e4f150e907793abc0a713ab8889dbd5d7fa9e3c7a5e64bd6ccaf255e853413550394a57c14b07", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261833, "uuid": "21f7c6da-5eb5-4ed1-b219-e1d0e54b8382", "value": "7792D0CA5483E505C74A216A61A136CF61874F31D3F536CB2B0E7FA0C18A260BD3EA2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261833, "uuid": "8036867d-f416-4ea4-ad63-58898c9524bb", "value": "384:ihcAIiZqi5xj52Aq1jZGizVaLVps0FVyQXlLuaE6Z6lnRwHM2:SZIioiX52Aq1lGiz0m6kQ1Lm6ZqnRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261833, "uuid": "011af389-1dcd-4da3-970a-0f8d2c53aaf4", "value": 19992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261833, "uuid": "0794fc0a-d2f7-4d38-9722-233f51f886a8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261833, "uuid": "1d927e85-caa3-4347-9013-8d70662aafa7", "value": "Purchase Order PO101341.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d287fbb-928d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617242168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242168, "uuid": "4331f10f-c6a3-441a-b6c7-32ad6ae24052", "comment": "Malware payload (Dridex)", "value": "6271e7e96cc637cfcd0e1b18976d7e9f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242168, "uuid": "38620566-4c61-4c9c-99f8-8956fb6435a9", "comment": "Malware payload (Dridex)", "value": "57fa33d1f2a5e9809c431ddda0b2224b47baf94d2f2fa8c48fe6c851d8e717df", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242168, "uuid": "d2abed00-8856-4c07-be2d-8dd26bf74eae", "comment": "Malware payload (Dridex)", "value": "500a54fdc7dbbab31ed9736440c5b313679a1c4f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242168, "uuid": "41ba95b5-abad-4200-99cd-c6165111e26c", "comment": "Malware payload (Dridex)", "value": "182e61f4ed76ed06af3e6edcedcf69e9bf7b3ff39ce3780441f9c9765a861f58080628ab11c115e9ac0cb552e1704ace", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242168, "uuid": "70eab7d6-0be2-46bc-bef7-0152538c4727", "value": "B814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242168, "uuid": "d8c8b4c0-d407-4e79-9a34-2744e730848e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242168, "uuid": "bc0c3193-f81c-4edd-b7ce-9e2fc47f11f8", "value": "3072:sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:zpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617242168, "uuid": "9710dfad-88b0-444e-9a69-a43358739682", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617242168, "uuid": "6f81f5f7-b28b-49a9-b11a-9a898f68e6bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242168, "uuid": "7994ba89-87b6-4556-a06c-e25b94637102", "value": "57fa33d1f2a5e9809c431ddda0b2224b47baf94d2f2fa8c48fe6c851d8e717df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15d3e70-928d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1617242282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242282, "uuid": "eddb39a1-3333-48e2-8eb3-11bf7333e3a6", "comment": "Malware payload (Pony)", "value": "7c6679af3586bc552747504b5bb903c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242282, "uuid": "8697d0f7-dabd-44d9-ac8e-5140be448a21", "comment": "Malware payload (Pony)", "value": "5805954aa66a0800e96e576ad633c4a67d08998165f77244b477a1d891d581e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242282, "uuid": "f082cdc1-c1ba-4556-b7af-fcd669026e02", "comment": "Malware payload (Pony)", "value": "6c4d19d2ebd1b8a275a314c34431044862e99cfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242282, "uuid": "4bdf5ee1-4d58-4358-b235-cd1a503738be", "comment": "Malware payload (Pony)", "value": "afc272afcfd8b26e40a1ec9498a80675149f833d79a206af2c3f18e0f20b8c00a01666573600e4ce0cc1342c18ac93fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242282, "uuid": "fccf052a-604d-49df-9ef1-4979434459cf", "value": "82A30903F9C5F0F1C1A216763BC12771E3FDAE7978764D8AEF8C58456DB2696AB02006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242282, "uuid": "96ed78db-205a-4513-88ed-34a81f5d450c", "value": "6112ac1abcf5fa0d96ec0b4b96090842", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242282, "uuid": "f0e58204-a5e8-49b5-b1a2-4c8dcaa492f8", "value": "1536:WfaxDyFHqTMtwmYnJ9MsfQAEZLZttTGRQyKOjm5TvUkzbkiql/18uqh:gCeFAmYJpQ7p1OjKzql/18uqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617242282, "uuid": "802a4186-b96a-4389-9c4c-d6ed65424dac", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617242282, "uuid": "0a2b4bcb-bb09-4cc1-9234-9bf115b5ec03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242282, "uuid": "6571c9db-9573-4b96-9939-0a815932c064", "value": "7C6679AF3586BC552747504B5BB903C5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049367a0-9304-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293103, "uuid": "7125c159-18a3-46c8-8ac5-32ae3751a7cc", "comment": "Malware payload (IcedID)", "value": "ebf72cc46f01373b35b56594e576208c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293103, "uuid": "32b2297d-0b9a-4fdc-80fb-913e4987a2ef", "comment": "Malware payload (IcedID)", "value": "580cd79a9f255482126d1007217c654aec21ea488caed1252bae1021bbe6e78c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293103, "uuid": "5419b513-4d6d-46c6-80ca-d67ca61c3bcd", "comment": "Malware payload (IcedID)", "value": "746724b597128384be9f4935c878fddc45154281", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293103, "uuid": "9785c5f7-dbf3-4bf5-bf0c-fd8b08e17fd2", "comment": "Malware payload (IcedID)", "value": "ec759cdb01de552d3fbfdcddbbab43d794e0462bea5c0f830ec2428a4626f307c42bdee7b75d576c5a548c92c6b5bd8b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293103, "uuid": "aaf5c957-cee4-42a2-8340-835bbb87a598", "value": "C2838DCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EA62E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293103, "uuid": "db94f913-beb9-432e-ac0d-dcf2b2f88de5", "value": "1536:IB240XZfcaaxf+EQliU2hawZECAIoo8+BNvMhfvj8:+2d1cBWEQXMZE9o8+nEhHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293103, "uuid": "79c36cd9-f9cd-43b8-9af6-602f81aafbe3", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293103, "uuid": "883bc00a-1202-4cbb-97a7-d9574f828306", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293103, "uuid": "d20eecf7-60fe-4032-92d6-46d0cdf6ff07", "value": "2012.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3289af-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275645, "uuid": "f8d97a99-3f54-490e-b903-44d453bbad2b", "comment": "Malware payload (IcedID)", "value": "5c9f01b830f95270860b924d63951bf8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275645, "uuid": "28a19fe0-38bd-4e3d-b9e7-1abeb2fb3203", "comment": "Malware payload (IcedID)", "value": "5831b68ff0db91ed6137b72bf3c6951f94f11a57af106dc154988c22852f516c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275645, "uuid": "7e5e7941-f9d3-4db8-a4d5-58f7cb3dd098", "comment": "Malware payload (IcedID)", "value": "d437f4a95dc08736841744e406572d03216b0fad", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275645, "uuid": "3d8dc065-761e-43c8-bcb2-ad3342d7411b", "comment": "Malware payload (IcedID)", "value": "74d9240a844af26af43ba21f62cdbd32ae5c825f88bbc3c74c4c92d7bb9d3d40c7374256bf1b373994cc6af8d7b04b29", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275645, "uuid": "23cd1bb2-429f-403f-9706-e5aea789c5f2", "value": "EF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275645, "uuid": "4d6c6dd3-fe60-4b20-b280-0ea8e5f2c638", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275645, "uuid": "22e2eb7a-31bd-4f67-a5b9-d89f620a6d62", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275645, "uuid": "503be1b5-b6ee-4454-b111-be911ecd1371", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275645, "uuid": "6114929e-2433-4475-8f3a-fff582a20a4e", "value": "document-1877530759.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1460d396-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291411, "uuid": "c6d4baac-83fb-4bf4-8cd4-4b4f90773e38", "comment": "Malware payload (IcedID)", "value": "cb37f24fae2475bb1fb3430e70b130be", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291411, "uuid": "a9330441-c84b-431d-a7e6-5757fb0eeaad", "comment": "Malware payload (IcedID)", "value": "58455790ceed9f3e0ee120d3829d0efcc1b414c6d79b15d5c05282bcc4ec9eb0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291411, "uuid": "ee579a08-f179-4522-b189-50d6b0b7b4c4", "comment": "Malware payload (IcedID)", "value": "cc11127da811250dd01c5ae8b47e417c07635582", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291411, "uuid": "3bb0cf96-7ade-4bc2-8e67-077cc4bb0b68", "comment": "Malware payload (IcedID)", "value": "bfe9afb84bc589da9c8379bc943895be54c071925e807f1c903331b8a4f799ebf3f5750a68a3fdf5f8dad47fcc36fe71", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291411, "uuid": "e18d68c6-e7ef-4aa5-a4d3-28ac9a541d54", "value": "21838CCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E1D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291411, "uuid": "c7eb99db-d3c3-4d43-9e8d-b824381bc5fd", "value": "1536:IB240XZfcaaxf+EQliU2hawGsCAIoo8+BNvMhfvlP:+2d1cBWEQXMGs9o8+nEhHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291411, "uuid": "39d9011b-67d7-43d3-be93-82b19a76e636", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291411, "uuid": "dcd6ee15-adfb-48cd-b904-e43c2232af35", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291411, "uuid": "5fe255e7-5b44-4712-a57b-b4609c81bfc6", "value": "3239.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33194c9c-92a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617251090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617251090, "uuid": "2ae21007-db40-4dcf-8540-09e42c2d8d3b", "comment": "Malware payload", "value": "7f9c0d053f70066e533a9db00e257054", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617251090, "uuid": "99dd05f7-d3a4-4f6e-823a-b02b3790f3c3", "comment": "Malware payload", "value": "584a56682a5eaa73fc6f05bcd448274917c3c22c41f49af72c4f5d5996bc67ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617251090, "uuid": "f7e844ce-ce69-4b65-994f-ed7a8c849a35", "comment": "Malware payload", "value": "c069f88d1fc297d99e9652e1cb0430290db2b239", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617251090, "uuid": "2ece4901-40fb-4ede-a712-01059db315ed", "comment": "Malware payload", "value": "f71ebaef407b05a69ca577368a25efc41463503ad5c1dfa6b27c1cf94f859cbd225912ac46c46f0393862d797400eec7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617251090, "uuid": "93edb257-e345-4ebc-b7c1-ffe672a9eb9c", "value": "2154239C417D6B35DFA29C632EAB960C7FD3551EAB23B602853A34360101BB5EDCE64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617251090, "uuid": "852eb7c0-2376-453a-809c-709f1c262975", "value": "6144:pn03i/ETtDv0gKW4wbPCM00p9QPILJf9p6Wwr590vq/8zzslK7hi9:pai8TtDv08BygLQ3t90u8zzslK7hi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617251090, "uuid": "8a8b81b4-ea83-4c3b-b77c-800d172b5bf1", "value": 297257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617251090, "uuid": "9ca0843b-86fa-4805-a2e1-3fa8e739792c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617251090, "uuid": "fd63cd40-c249-4daa-b733-9405fb85ad55", "value": "PURCHASE ORDER.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d15730-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617290185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290185, "uuid": "fea28e88-5c14-4e40-85ee-760211f05a21", "comment": "Malware payload (Dridex)", "value": "2fb82eb7077d82268c98f315403026e7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290185, "uuid": "565382a5-891b-4bda-bdb1-745b3d6888c8", "comment": "Malware payload (Dridex)", "value": "588c8b5000af1bdb32844a2b65dcc1b0722b03a99eb3e3ba21f5b96a0a8ff63c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290185, "uuid": "7797a527-1c07-4fa2-9abe-c88d4396e37d", "comment": "Malware payload (Dridex)", "value": "e20b5eeed06bf98a82b42a7c7e9225f1c286f2f9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290185, "uuid": "e2a7fb4f-91e5-4b03-9229-fdfa37d7c628", "comment": "Malware payload (Dridex)", "value": "b2838e1cf72fcf2b143a8d5e9f8051af04d16164880c117b3989c0dc62997892d98a4bc3704a9e063861f4ef0119f4ff", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290185, "uuid": "c1a89428-6cba-4ffb-8f38-4382ac756018", "value": "CF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290185, "uuid": "d3a9f22f-b037-4ed8-9eca-d493de13956a", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290185, "uuid": "d75d4d7b-b566-4b09-9b72-1e2cd3874286", "value": "3072:vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ApjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290185, "uuid": "8f78a5eb-032f-46c0-86f8-08296cd18bb9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290185, "uuid": "b3b489d6-35ec-430e-be03-ab8c63a3752e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290185, "uuid": "f94768ac-b501-41e1-90e3-50a14b4c88ab", "value": "588c8b5000af1bdb32844a2b65dcc1b0722b03a99eb3e3ba21f5b96a0a8ff63c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da57162-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617290192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290192, "uuid": "1cf96663-eb3b-4c94-ace6-ec2dea9f32bd", "comment": "Malware payload (Dridex)", "value": "58c97d2f501a3af9591c826d5fcf6af5", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290192, "uuid": "a6481cfc-92b1-4e8b-9628-729725d67dfa", "comment": "Malware payload (Dridex)", "value": "589b40b378619dc3de144770cdc862c78d91e8d118390f62b5595b5270ee7dfc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290192, "uuid": "f56dc489-597a-480e-8faa-e5e177dd7baf", "comment": "Malware payload (Dridex)", "value": "fa41ef8be961c9edf92def195445341d3e824e5e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290192, "uuid": "42553cb3-8495-4496-8a46-a600bf2ba8f7", "comment": "Malware payload (Dridex)", "value": "965d350382bb625865190aeb970cff613b3246f701b57b9ccd01e6f8bb17783dc333a410c3baca71d0a0281e850d2cd1", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290192, "uuid": "e7d3d949-7691-4ac9-8235-dabe87ffd975", "value": "2C14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290192, "uuid": "48c9ff51-d499-4fbb-8c7e-2cf11056be70", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290192, "uuid": "8a8e0e36-fbbc-41df-99c7-769f1654955b", "value": "3072:Oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:xpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290192, "uuid": "5c5d7261-1ec7-4b21-883a-bba619cb97e7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290192, "uuid": "32da7ac5-36db-4766-9f04-093df398e00a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290192, "uuid": "71f572ea-307a-413d-94f6-3391ac6c081b", "value": "589b40b378619dc3de144770cdc862c78d91e8d118390f62b5595b5270ee7dfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5deecf66-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279079, "uuid": "097041d3-3926-4c39-9648-e177a79fc715", "comment": "Malware payload (IcedID)", "value": "2061c7f19f6e54002a681cbe69aff5be", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279079, "uuid": "4ff74ddd-9c21-46b0-9050-69ed9a5e9ab9", "comment": "Malware payload (IcedID)", "value": "58aacc759cc2a111974d28d283f0d12c846f9ff0e8e73447f0244d1efc110fbf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279079, "uuid": "bd52bf75-1544-468e-92dc-b4bcdbbd0014", "comment": "Malware payload (IcedID)", "value": "d6bfaea4bd1ed24f59d16debc46d63847d70a1df", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279079, "uuid": "ca69d35a-c74d-4833-bba0-b3c6ba14fa96", "comment": "Malware payload (IcedID)", "value": "ab2aa8da56437e548810ef1e74fc958837cf4dbb176cb700b3f55c74afb24fff2030c5239b620917d31c9fcbe7a0134e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279079, "uuid": "19d0da6c-ce98-4975-86dd-909b4300d516", "value": "30044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279079, "uuid": "f4288e57-2e9e-4683-b23d-13dadac7fddd", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279079, "uuid": "740d3f4d-32fb-478e-a6ac-ad5357dc1782", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279079, "uuid": "38728d9d-08a3-4236-9f04-5658ad707093", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279079, "uuid": "f8cbe39d-27e3-43d5-b7b8-4ae391e1787e", "value": "document-613974724.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de4eef9-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276932, "uuid": "b5297d58-1604-455b-bb6c-e042c1a4482d", "comment": "Malware payload (IcedID)", "value": "c6d9bd24e0c94f66ab7fa782ad1da0de", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276932, "uuid": "8864027e-a149-43b2-be90-262633603c36", "comment": "Malware payload (IcedID)", "value": "58e21bce5944bcf8558f88646203953bbb0c22676407099f86c5d19ce93f478b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276932, "uuid": "c1cd3e5e-afb2-4160-8dc8-c9828c5ea453", "comment": "Malware payload (IcedID)", "value": "dfc375db92b7b43e2b3fd4c3e919dbdf34dcd955", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276932, "uuid": "3e63ce69-c346-4e9e-96ac-9d0f7bae07be", "comment": "Malware payload (IcedID)", "value": "97fb5d1fe5b241f34e9a9e38e546fcc5ab2f6b17430bfc57b4105936a4f1ec3ee6e951dc74a143982749a947c6063a77", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276932, "uuid": "91e489c0-97a4-4163-88ec-0219e7fbce0f", "value": "A1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276932, "uuid": "e4c8d3dc-5350-4c85-9561-33802921ebe5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276932, "uuid": "c2e7e2b8-c3e3-44ac-8888-3ad84b32ebca", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276932, "uuid": "0c9221ac-84ff-4df7-979c-949b2e12316a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276932, "uuid": "63c85e42-fbf3-4532-ba3d-47d15aa1bde1", "value": "document-549235080.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cdbea8-930e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297641, "uuid": "3da61e55-baf1-4949-87d5-220fe38bf2b3", "comment": "Malware payload (IcedID)", "value": "37924a04c4208d5bfdd3e022c5c53786", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297641, "uuid": "63ce5d0b-1582-43f5-b911-1e99d8f5205e", "comment": "Malware payload (IcedID)", "value": "58f7b0c31ea1d8a291b7efceef129974c62f3fa0bacb8d360575bf71afe73486", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297641, "uuid": "c200d457-fd18-4bcf-b4ef-90d0ae649b99", "comment": "Malware payload (IcedID)", "value": "a5a77a3872a9ed047277035b1430cde1f126ea52", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297641, "uuid": "b31be9de-0d89-4956-8b43-04d9843c3b87", "comment": "Malware payload (IcedID)", "value": "aeaa2c08e3815562580a61857ad90e1a4bec2278f8cf27d690b340383dece07d5acf3173fd28315f00c44f54e0b74c96", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297641, "uuid": "0516ab6e-0d5e-4b33-84e7-6c255c136bf4", "value": "6F04123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297641, "uuid": "eaf16fbb-8a72-4c02-9b44-084609ff8b22", "value": "3072:RXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:dE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297641, "uuid": "07675554-935c-4fa4-9bec-301ffc2c0f1d", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297641, "uuid": "fe2964ae-7377-4900-b12c-458b3c4c7d4a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297641, "uuid": "639ef254-8582-4a9b-8a40-755c64e0c751", "value": "71138432560-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86e4dbc-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277486, "uuid": "562b118e-c480-4524-af6e-6c2958f49025", "comment": "Malware payload (IcedID)", "value": "ca74543c64a78e350f877d4976346ec9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277486, "uuid": "17ec982b-f03a-4533-b760-8062ad9215e7", "comment": "Malware payload (IcedID)", "value": "5913b515b6986cbdefa408223413b6d90046ea149d9024a399c4c36698a38e3a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277486, "uuid": "ebeebd68-b70d-4029-aa5c-f036fe9741a4", "comment": "Malware payload (IcedID)", "value": "356b21583fc7855f53ddc73cdf6a44e205631820", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277486, "uuid": "e998dfa3-c1e9-4e0b-b59c-489957af1d48", "comment": "Malware payload (IcedID)", "value": "cfcef8dcd5fc2193f25267edd3f8db3c5ef3fdbdce5baf03eeca4ebffd0af7069e04e74ed27f72f53739fc30651da6c5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277486, "uuid": "d91a75dd-f258-4117-9224-f4e088cf416e", "value": "03044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277486, "uuid": "8bc8450c-356b-40a0-92fc-9bfa4fcfacc2", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277486, "uuid": "d68e614d-4dd5-42ad-b907-a5f656e54746", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277486, "uuid": "e2313bf7-53b4-4a0d-a31f-0a94bea001af", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277486, "uuid": "4f885b81-0a8e-4b45-8616-3ac4150cdcdb", "value": "document-1138687831.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5929f245-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287232, "uuid": "462dd725-beab-4c99-951e-2a7f28b778d6", "comment": "Malware payload (IcedID)", "value": "74c994cd5e67f5e9ab65b3ce9248f2dd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287232, "uuid": "dd506a4f-eb94-4360-8f5e-474eb6e1b87c", "comment": "Malware payload (IcedID)", "value": "591a8c21c5bcec4d3bfc6a6cac79cd6bada11ed9c5ebe6c73772c4079106bb5e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287232, "uuid": "2e712877-4172-42b7-a2da-5ac802d003d5", "comment": "Malware payload (IcedID)", "value": "6459e1202cfed672585123795c082f622faaef13", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287232, "uuid": "dd24fbf8-3a74-42b8-919c-a859df282b28", "comment": "Malware payload (IcedID)", "value": "a1ce42bba259020a4aa051f8dd4986ca9977c69ede4d8c2c65270571488f543d2f6b3ee805dbc934273b13de6aff8ca2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287232, "uuid": "5dfea4f3-6429-473d-b469-a905b50136cc", "value": "C7838DCDC913E1D9C2559FBD5A0A308511F4E0B7276FF11B148EAA2E4C42FA40A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287232, "uuid": "518cc8ab-3b83-41c3-8149-fb2e24c6ef14", "value": "1536:IB240XZfcaaxf+EQliU2hawmCAIoo8+BNvMhfva7:+2d1cBWEQXMm9o8+nEhHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287232, "uuid": "f21aa59a-3618-44ac-836d-9bf10ab994be", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287232, "uuid": "08482d01-6e49-4c30-ae05-80bb2bfd0593", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287232, "uuid": "bf941f9b-9e84-468b-b731-e328bae3f9a9", "value": "2518.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e4e623-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279087, "uuid": "d1360f24-36fb-443e-945c-10d8600a523d", "comment": "Malware payload (IcedID)", "value": "3b3c3596f93803a468369de562ce305a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279087, "uuid": "1a1af326-17c0-4476-bfbb-a1e681d182aa", "comment": "Malware payload (IcedID)", "value": "595352f7038f2dde98208d18cc9b0acb3bb747c9ffd30471f8ecf67ae5c23ae2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279087, "uuid": "d322b08d-79fc-4cec-8bc3-f7f2d5e0c9aa", "comment": "Malware payload (IcedID)", "value": "207087b7afab8635b8f5eee29c18b1f0ef780a52", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279087, "uuid": "3e0eeaf9-43cb-43fa-8484-1702eb633afe", "comment": "Malware payload (IcedID)", "value": "df45b8630b174667c55d808a39e23865bb40ea4be2e3dd34e35f65e57001899bcfe2c3974d9eb10c411ecdc38290c718", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279087, "uuid": "5fe833bf-0287-4df0-ac4d-eb237f9367a4", "value": "CA044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279087, "uuid": "643f39e1-3232-4e64-b08e-a2933f931cfa", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279087, "uuid": "e30b40af-b9c9-4fb5-b928-273142b058f6", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279087, "uuid": "60d2e616-4d63-4d23-aae7-e04d1879ab32", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279087, "uuid": "93c4ef2d-72d4-4da1-b7c4-17d5052ee179", "value": "document-1894371563.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb0a0c0-92d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617273171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273171, "uuid": "2a8ae7c7-ac30-4024-981e-e4458d5d1744", "comment": "Malware payload (Dridex)", "value": "7ff65864e38c56fddfc62c62f74b9496", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273171, "uuid": "1b7f9a0c-2bd6-442f-b15f-4787fee4737e", "comment": "Malware payload (Dridex)", "value": "599da526dd15352929e8070d216afc889d614b837a379644ce739ad5f8c0ff4c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273171, "uuid": "86f04357-5103-451e-89b1-7a79daed3a87", "comment": "Malware payload (Dridex)", "value": "3f8152d5f9e190c58a3ca005c45f50d55c101139", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273171, "uuid": "5ce1fe1a-512a-458a-9863-aa40cfdca1ea", "comment": "Malware payload (Dridex)", "value": "8af7cda81055f744d5fe9365288b27ce492a4726748bc9863fdb4e95aa012ee9838aa109a34f3432840fd474a7f67d03", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273171, "uuid": "b4f7eb65-6049-4793-b622-1d5a1fc84183", "value": "D1248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273171, "uuid": "98656cfd-6b04-421f-b0bd-a7a438b4367b", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273171, "uuid": "7fb40a76-95e7-49ae-b2e7-af6e0cafcf62", "value": "3072:s6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:soMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617273171, "uuid": "1dfe5631-db54-4591-ba59-da22bff1ebd6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617273171, "uuid": "a64e8122-6802-4962-a9e1-190b5e33e759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273171, "uuid": "1173e4c1-4a5b-4997-af75-056094077f95", "value": "599da526dd15352929e8070d216afc889d614b837a379644ce739ad5f8c0ff4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56166bed-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282931, "uuid": "0d53905d-7107-4a55-ad79-ca1ee0a76378", "comment": "Malware payload (IcedID)", "value": "3d21f264be6300d0502f3f61026b28ae", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282931, "uuid": "a2bbe6b9-eb70-4571-85fe-b64ffee68745", "comment": "Malware payload (IcedID)", "value": "59dc10344730d073b0559ab31439f35fb7c16a1d8c69b20de66036ac4f8e77b2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282931, "uuid": "7d9f23e1-4011-4d0e-8e97-d69e93c0ae9c", "comment": "Malware payload (IcedID)", "value": "395d8e582df5639b568f10d468000efd1dd4f3d4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282931, "uuid": "f3d55ecd-4272-4119-bda7-983c2264a233", "comment": "Malware payload (IcedID)", "value": "2d717116bc5bf0da27b2a7a1244572dc8d9f44946f2d2d8880bb0ad15c856de55f421c5089983c799f65f93043c16080", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282931, "uuid": "f8dd8ebe-e3d0-4948-a598-b781686def73", "value": "19044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282931, "uuid": "b2cf03bb-fed8-43c6-b8aa-ac4cef8ae532", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282931, "uuid": "7dd7763b-8af3-485a-9db4-d6e7e609646d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282931, "uuid": "2bd0a5a3-37a8-4956-a41d-b395eb85a848", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282931, "uuid": "a97bfbd8-db29-4db1-86f7-218890f56db0", "value": "document-2087062461.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01672e4-92f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617288344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288344, "uuid": "53db6545-1cab-405c-8804-02d10202f1c3", "comment": "Malware payload (Dridex)", "value": "e5984a978f642bc27f756e13c4e4af67", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288344, "uuid": "defbe902-31e7-44ec-b8f4-46590cbab677", "comment": "Malware payload (Dridex)", "value": "59e038de028fe69e9e5f6c908d9365ea7ead9408ddfbbf2e3812e9e719a4b2d0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288344, "uuid": "b9027800-657c-4d00-a38f-9513814da7d5", "comment": "Malware payload (Dridex)", "value": "8a23eca5dd519702a5d88bd6953e46a215391f56", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288344, "uuid": "1b079f8b-993d-4579-96e2-8e465b62d65c", "comment": "Malware payload (Dridex)", "value": "6214bc85c9cf1cea3e3f7863112305b8901874024e41693a7c8ea69ff53edfe43ea090b9287d65d942bbb0e6bf57f104", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288344, "uuid": "993e2ca7-2fb3-4414-856c-46f7d7a07a9e", "value": "2914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288344, "uuid": "b1e8cb29-6c42-4ebe-81cd-a21601515f08", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288344, "uuid": "a2d19b97-b037-428a-be9e-ab303b47238a", "value": "3072:Zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:epjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288344, "uuid": "4364b2fe-89e8-4b6d-9469-53a96b2c5069", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288344, "uuid": "f91e2139-8f3d-4f7d-a30c-6f99c885c0c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288344, "uuid": "d1a597e0-0d0f-4497-b2e2-a643d17fa714", "value": "59e038de028fe69e9e5f6c908d9365ea7ead9408ddfbbf2e3812e9e719a4b2d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d623c1-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277510, "uuid": "70c93086-960c-4a22-a242-f58c53d6fe3a", "comment": "Malware payload (IcedID)", "value": "b8260480d44c22171149755840e63e18", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277510, "uuid": "2183d10a-0244-434f-bb4d-4bcfb53507f1", "comment": "Malware payload (IcedID)", "value": "59f1d1fef8a22cd47cce8dce49478b0f4b2e8520708c0999d63147ab577ce244", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277510, "uuid": "a978a9f4-09c5-4faf-a51e-f02c786dc6fe", "comment": "Malware payload (IcedID)", "value": "4c1afffc2de7c91aa075c72f89165e4e09818b4f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277510, "uuid": "a4659ee0-b874-4810-8efa-6635fc2b7c9f", "comment": "Malware payload (IcedID)", "value": "04d475a1f8a104b9601bd7b0b4b5b7588d254a745985c7cf40ed3d7995d099eb4fad51faa2768b420666c44c954115a0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277510, "uuid": "115f324c-7dda-41cf-8211-8b8fca99ef0d", "value": "43044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277510, "uuid": "680c7bbd-12a6-48fd-954b-1823dfccbfed", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277510, "uuid": "b2ae3ee0-5696-41f5-a8fc-e69beb204afd", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277510, "uuid": "e31eeca9-d465-43e0-a4e9-b32bde740a77", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277510, "uuid": "7d777e55-a303-4045-bcef-5b118fc06c0e", "value": "document-1419959474.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5f689d-92c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617267321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267321, "uuid": "75175c3b-5ea2-4885-8d48-bd7f767243fd", "comment": "Malware payload (Dridex)", "value": "08bcd5f120dd0a4c1eb5ff22521bb2c2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267321, "uuid": "856bca17-1198-4a35-8bdf-780373e45028", "comment": "Malware payload (Dridex)", "value": "59fd64990301ef9bc223ad56f958fbd234abcd0ef4a0083022eafe3fa154195f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267321, "uuid": "ae9ad8ab-3016-406f-b9f2-f957c8178996", "comment": "Malware payload (Dridex)", "value": "d765b2491a43d6e95898bfa390e67efe8f206f6b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617267321, "uuid": "78e55abb-7101-4416-8a05-21b10b1fd347", "comment": "Malware payload (Dridex)", "value": "cdefcf62d89d89f2f1e590d1d2143885c279a30d4df09c498b2aea48bdd020f58f1bc76be0ec62178993c9ef1d31ec7f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267321, "uuid": "5991be0c-0c6b-48b0-9f0c-0be27f13ec56", "value": "A314AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267321, "uuid": "bcf51b43-1456-479a-8ca8-8c110224ab75", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267321, "uuid": "53ad62fa-237d-4a3f-9034-974fba2e6800", "value": "3072:41i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ki78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617267321, "uuid": "4f317c51-9827-4fce-85d7-6f14ad0b5a5c", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617267321, "uuid": "0b97c7b5-6629-4f43-a024-d6f11d142b22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617267321, "uuid": "55c9565c-7684-46eb-b5a5-20dad36e8770", "value": "59fd64990301ef9bc223ad56f958fbd234abcd0ef4a0083022eafe3fa154195f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee80502-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284288, "uuid": "80543533-53e5-4c1c-9ad9-e1c196d2bbc9", "comment": "Malware payload (IcedID)", "value": "e941117c925249ce63371aadb3c9d1af", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284288, "uuid": "f970cae8-3174-4730-9311-79128449a380", "comment": "Malware payload (IcedID)", "value": "5a3178160ef723226809563e2c2d9b86e394697d1b12fc570e6ac627d44e65c8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284288, "uuid": "d11cdf34-9127-4f7d-a2cc-96401aa06455", "comment": "Malware payload (IcedID)", "value": "117a0340aec022cb01b6541ab8af12adf452f583", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284288, "uuid": "a99bbea1-45ef-4498-a9a5-6f37ecb7c657", "comment": "Malware payload (IcedID)", "value": "db041ea02967f18aca22557b1d386f524cd2ab8764a7acd49ca6b8888f8be3783852aca39f33cb8c4100c1ae5f9ba27c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284288, "uuid": "a314c5a4-949d-462b-8506-e349e5ae4c3d", "value": "26044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284288, "uuid": "bb3dd3bb-1359-4625-9766-e71bd1a1217e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284288, "uuid": "0df84501-8353-4aa0-ad7f-5609a4b94f84", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284288, "uuid": "a75ac5be-da90-4178-97dd-5560834be1c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284288, "uuid": "4c105580-0d5e-44af-a3a6-b240399baa70", "value": "document-453031610.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27f7b8f-9329-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617309313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309313, "uuid": "b38079b3-2f75-4dae-a73a-7a86ebeb516f", "comment": "Malware payload (Dridex)", "value": "4ba978e0e46fdca800d77892b24a1b41", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309313, "uuid": "5d6debb0-256d-4ec1-87e1-365b3ed051c4", "comment": "Malware payload (Dridex)", "value": "5a9f55f7987f246a4fd1dd1cc2baf628782efdee72e7132627a9610a639939ab", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309313, "uuid": "d3839a04-b522-4163-9520-c1531b788af1", "comment": "Malware payload (Dridex)", "value": "c8ab448689bd1510e67ad7c7f18b2769bf669e55", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309313, "uuid": "3578d2e3-c8c7-4a0c-abb1-430861ef4635", "comment": "Malware payload (Dridex)", "value": "98d1bab87ee6719ff99134166b655cb34d2df3786838b53a7b4deec7d34b3499524d11f132af4824044e49441a12f193", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309313, "uuid": "35223892-d278-41cd-8a50-82e6b7c015aa", "value": "54248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309313, "uuid": "83914dd7-c0e8-49c6-a5ca-34e3224fff83", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309313, "uuid": "91da5d7d-765a-4bf8-a428-cc8ac22b5176", "value": "3072:u6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:uoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617309313, "uuid": "19237b2b-122e-4388-a810-66ad669021ff", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617309313, "uuid": "fb4d1a99-4b34-4d7d-af32-adad50093db6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309313, "uuid": "b955f924-33d5-433b-8c13-51831ab7b201", "value": "5a9f55f7987f246a4fd1dd1cc2baf628782efdee72e7132627a9610a639939ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d905b7c-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280904, "uuid": "7aa5fed3-22a3-4765-8008-90356a47c377", "comment": "Malware payload (IcedID)", "value": "23c87ee37fa851a703d53e9b5e9bd8cb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280904, "uuid": "1d132a90-7b08-42ce-963f-90cfba6acbf8", "comment": "Malware payload (IcedID)", "value": "5ad85096eeed3fa375bacf563fb7f26e68968a99ffcb684b68203d9ce573e7d9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280904, "uuid": "9858ae30-522f-4a42-9c45-1e76178a6387", "comment": "Malware payload (IcedID)", "value": "82e51bdb156e5012e8bf4c2596bbabe562a9793f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280904, "uuid": "6b1e538d-e45b-4c9c-bd8e-c092ed018ee5", "comment": "Malware payload (IcedID)", "value": "b7beeeea6a6951e59b195af6ae65306aa125595e0f79b370d75aea90e786adfdaa39023007f49c0abcfca51354521ac9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280904, "uuid": "81fe02bc-9840-44e1-aa58-6247ed78ec3e", "value": "80044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280904, "uuid": "5c191014-daea-4731-83e6-b6c860622b56", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280904, "uuid": "469a2e70-a710-4975-aa12-24508438b240", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280904, "uuid": "38b7cd09-732c-45aa-8385-25952ec0a307", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280904, "uuid": "a2f7c2c6-0992-49e3-819a-8617dc293b2c", "value": "document-1747349663.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76872386-92c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617265376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617265376, "uuid": "b351d6cf-d732-4f41-bfe9-9ae91d4702f5", "comment": "Malware payload (AZORult)", "value": "d3c20aedabb5bf2bfeefc5b9115f1cef", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617265376, "uuid": "8f85bfb4-70c1-43eb-8206-892e7c5789f0", "comment": "Malware payload (AZORult)", "value": "5af2bcd6e1359e4f5ff0b1f0d91397edb7dfeb3b6e5fef9cb73fd0bbf907b161", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617265376, "uuid": "a6f7f369-fe53-4b06-81a7-09c345df4615", "comment": "Malware payload (AZORult)", "value": "298a6c34000a4f1488483ae7478c173228a0a7a0", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617265376, "uuid": "571ca042-023e-4a97-b38f-2d3078d716bd", "comment": "Malware payload (AZORult)", "value": "c31d1e9fdbc611b0d7a24155254fa889f030dd0505121cfcabaca2078911079342f25005c91cbc8bdb52b8d91b28a4fb", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617265376, "uuid": "f607bb30-344f-426b-a8ad-4129885790d5", "value": "B2F312532AC2C8F7DD260671083EBBA6DBB3C26071D88A43CB542FDD7542967472E662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617265376, "uuid": "a7174285-e6bd-4815-ac3d-1fb3c16b5944", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617265376, "uuid": "3494d736-f393-4e8c-be0b-869fb8cdc7f7", "value": "3072:rf1BDZ0kVB67Duw9AMcTbCc9L3H4w3K2rrnAeR2dSSo8:r9X0GfCc9LXd1rAeR2gl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617265376, "uuid": "c33e5955-8576-4d63-afa2-56af39bdc1b1", "value": 160261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617265376, "uuid": "db5518bb-9e50-4b50-88df-3ac1bf9e4bc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617265376, "uuid": "8cf99716-4c38-4505-bc8f-dd64c31f6751", "value": "TRF-999014-07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4bf1c8-932a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617309495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309495, "uuid": "7cc0522d-83f0-40e8-b50a-7f0a12bb6aa9", "comment": "Malware payload", "value": "966bede9c16dea9546aacfc0688e297b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309495, "uuid": "639a52db-e594-41b3-9ffb-30bba0b99621", "comment": "Malware payload", "value": "5af4e69e662940bb4debccdf5ea331f6cc7dbe05de27218f1726cffb9c74c343", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309495, "uuid": "44badbc5-d113-4dd2-9b6b-a3f54c3103da", "comment": "Malware payload", "value": "c8266ee5aa445db3dfd8b86673088712d67003a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309495, "uuid": "cb665f5f-b567-4c16-9ab7-906f9a83c642", "comment": "Malware payload", "value": "946ca4c45790e452850bfb4768bb73f0f8e380a7da3ba6158590ea5aa69c9337d073f3e8b8e5d697fdee95a907f1f23d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309495, "uuid": "aa83ffd5-6143-44e6-bee2-25c12ef5c3d9", "value": "59C35C577712CFA2D2ADC23009B7C59997F517A626D1A46AB22CCB1C6E3435C1C2FEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309495, "uuid": "9c2c9aef-59af-46a1-b4b2-1d86d04dc30d", "value": "3072:9uNPEfHBjRnR4B5Yl0fzkNXmDDtqRPjvp:kEfHHnqBCl0k2DDtqZvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617309495, "uuid": "5124c84c-915e-4c35-b32d-4011b28d0216", "value": 121048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617309495, "uuid": "d1e4923c-04d7-4c00-a19a-b2e9d5da31a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309495, "uuid": "c7731438-6169-4123-8938-ace2454fa16d", "value": "dmb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b63234-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280921, "uuid": "5e17d975-0971-4fc3-b98c-a3986f540704", "comment": "Malware payload (IcedID)", "value": "5d50e117d661d7b763d811caf51d8994", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280921, "uuid": "7507b118-ce3f-4da2-86e0-d215af9b7dde", "comment": "Malware payload (IcedID)", "value": "5b201245e9e84cfe13db092419c0882aa0e48dc4f3936e53d2202acf08373b60", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280921, "uuid": "d9de6709-4c28-4ad3-9f2a-20de206a7a79", "comment": "Malware payload (IcedID)", "value": "64738c8176505ac62172841360695e919375fcf4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280921, "uuid": "786aee87-ea31-4371-b44b-e83339c00a2e", "comment": "Malware payload (IcedID)", "value": "7d2f75cd35e166b810ae2204e888692def1be9c2df71a51d5b4410f7c5e4f6aee17944666fc8593e34c0d74896646fd9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280921, "uuid": "4e2a3511-db04-49d7-b8de-fd1d37a01702", "value": "C2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280921, "uuid": "106cfff3-5104-41db-8ec0-709605ec905d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280921, "uuid": "991d4eca-906f-4b55-ba0a-6a1c9376efd4", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280921, "uuid": "314754e0-af85-41de-9045-685d76970d91", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280921, "uuid": "1b80296d-f6c4-47c1-926b-b9b030ce0af1", "value": "document-1163935024.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd334bcb-92b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617258730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258730, "uuid": "bb5135ed-cf34-4c22-b884-765124d39003", "comment": "Malware payload (RedLineStealer)", "value": "4bb92747e86b95cbc856d3cb42c427c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258730, "uuid": "93c0de61-8e3b-4c4f-8b84-ae1159042902", "comment": "Malware payload (RedLineStealer)", "value": "5b39d7d6eae45df2f9e263a36b30a1ca32c4c5d80a923c0a2380098fb33d978f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258730, "uuid": "0b995a4b-078e-41d3-9086-4dfc39590889", "comment": "Malware payload (RedLineStealer)", "value": "e19c165a0807752ac949f83444bdac25a1b8030b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258730, "uuid": "c825297f-d918-440e-9131-9809c047886d", "comment": "Malware payload (RedLineStealer)", "value": "2aa681dd650b1ad3c48a8d0d94bebf4647e05e5c02e98b09032ff9db3f75c529b7c12975839d07aae022b9550bcd41fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258730, "uuid": "42879096-84e5-44cc-865f-56a09c864bbb", "value": "DB64E000B6D1D433D29606721460D2B5593AFCB56F30A7C777A42F7A6E7A3E10A3A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258730, "uuid": "8938afbd-a31b-4f49-8b26-c34de10a96f3", "value": "bf00cd32fb07f9ece1c23ad1ece9b809", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258730, "uuid": "be915df2-26c3-4708-a734-7fb6f0a93f2d", "value": "6144:v98i+zkLT0cZSyrgJsrWg7mQQOq89z587HYE3:+igkn00gJs6g7kOq89l87H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258730, "uuid": "091afa2c-d60c-4ab3-ba0a-e3f4425b0e8e", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258730, "uuid": "3024b895-a7cb-4c25-964e-92711e84d84d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258730, "uuid": "c6e49e77-a900-45a0-a3b4-20c7ded6406d", "value": "4bb92747e86b95cbc856d3cb42c427c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4e4db9-9332-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617312924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617312924, "uuid": "47bd6c57-5f51-4277-8e66-c31851836403", "comment": "Malware payload", "value": "b84d5b373cc88a5b3314277531c2aa2e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617312924, "uuid": "35c315ab-aec2-4baa-afa7-e4e7c6349280", "comment": "Malware payload", "value": "5b6733d0d8481e5224c03c9e209bec776612e658467df66e5a91d84b057ff155", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617312924, "uuid": "5f26c311-98cc-448e-8e42-6bd1d1fba0b5", "comment": "Malware payload", "value": "67f7eaf260325f6142218c0329fd50e5d056574a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617312924, "uuid": "59be578a-0f9b-49fc-998e-d46e4cd47282", "comment": "Malware payload", "value": "46b6e1d890a8dff544b54cb63e4fc038b53e3e90431ea4e628fd750bfac6aacb2c26207ea168fe276f415be41fd00a77", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617312924, "uuid": "224e051c-7221-44ce-8807-e17e9735cdda", "value": "33248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617312924, "uuid": "abf11430-9533-40be-b403-b3b7774f3a5a", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617312924, "uuid": "7151932c-14e4-4483-b292-2fa464140b73", "value": "3072:j6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:joMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617312924, "uuid": "15d982d5-ab66-4dfd-8e71-f497a897779f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617312924, "uuid": "787259c0-3690-490e-a284-37a36ab3be8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617312924, "uuid": "cc147edd-fef5-40c0-8fec-f010a212bb1c", "value": "5b6733d0d8481e5224c03c9e209bec776612e658467df66e5a91d84b057ff155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1531413-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261690, "uuid": "f224515f-b2a7-4479-a35d-857d16927420", "comment": "Malware payload (Formbook)", "value": "68e43bfcd9f9589acd63a72599757ff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261690, "uuid": "159348a1-f12c-4cf1-afa3-fb9202d3e70e", "comment": "Malware payload (Formbook)", "value": "5b75380750244e31e48bad94f23649870af530cd9697aa9d6acd15891d30010c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261690, "uuid": "172bd1d5-579a-48a9-9e27-9eebd361455f", "comment": "Malware payload (Formbook)", "value": "569e2c64a5d21e550c290965b63a66373d5a4430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261690, "uuid": "acd40149-c950-4655-afd8-dff94bcdc498", "comment": "Malware payload (Formbook)", "value": "cc31215fbe183c004b42a857406cbf89e2e6804f9796ba86b15c7d8e7384df029f7ae25273bd4aabab8f515d2c1fc81a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261690, "uuid": "4856d4d7-0544-4dc2-9d38-56400ca6f22f", "value": "ABD4582337477BAFDE7857B62452850032B1AD36E76AD10CAC54329D4F776C08BEE262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261690, "uuid": "4fb37712-53f2-482b-bde4-4340af6ed81a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261690, "uuid": "e1323666-cbd2-40b5-bae9-327ee4d43be4", "value": "12288:4blF8d1JjUEaD0Z/tphRnadXXczQApPLDnXcsp:4bKUEtKXX8QePLAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261690, "uuid": "4ca9ef6f-7f37-492f-9aea-8171f0d0375f", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261690, "uuid": "85a66d0b-f471-4895-994d-3489a9966d20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261690, "uuid": "03bfb782-6de0-47da-bb9a-e6142efb8aa4", "value": "CUFUYO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e4e2e0-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617259329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259329, "uuid": "28ab6db2-0634-4e07-b0c4-b42827848218", "comment": "Malware payload (Formbook)", "value": "c56b8a7c42b645067c9674587eb6bfe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259329, "uuid": "5e7e373f-8508-4462-b565-96ba9b9c9547", "comment": "Malware payload (Formbook)", "value": "5b7a19549c692c5dfec51bc6ddc8826132706ab03336321ccec6e02182d9d35e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259329, "uuid": "5238db20-43b3-4a69-b99d-13c0075a6133", "comment": "Malware payload (Formbook)", "value": "238adb0a18b2c7f9849b84e1f1942f543b04d5b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259329, "uuid": "ece2c8f9-42b5-4bb4-93c1-ed54732bcbe3", "comment": "Malware payload (Formbook)", "value": "c95f5e13147b2be47822fbf1d8737c5aa29c6f49e1fa47b26dd954e101ac5a39c46ddb99530c39eaf9dcacca11d95fde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259329, "uuid": "3ce0d240-b2dd-4fde-b0ee-7a0b24750573", "value": "4273A4E85E560AF7D56DFA309083108EA238E1B338DC5A67719752CBC98E7837DD016E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259329, "uuid": "ddf9553d-b21e-40fa-82e9-b06544fb57cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259329, "uuid": "b5c47e54-5fa1-4e21-9bbf-5697c2b587e0", "value": "768:kZ7IUn8Y08A9uAu50iecYx2gW/4xRJEIsAkUp2mpMhfnoGfl4Gflvx/FIwJGun5M:Q1nR08+uAuBRYUcJEIsAjp1M3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259329, "uuid": "fccaf3bf-e7bc-4cbe-9d89-5167d2ffaccd", "value": 78240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259329, "uuid": "f5aea238-42bc-4bc1-81fa-d45b4e8a6b67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259329, "uuid": "3cfb5962-c1db-4fcd-810f-4393adb5462e", "value": "c56b8a7c42b645067c9674587eb6bfe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9189e980-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284320, "uuid": "ba24918b-a236-4767-badb-0fcce41cadae", "comment": "Malware payload (IcedID)", "value": "9da6426c01501a7431b45248ca06ff9b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284320, "uuid": "e551b45c-a28f-4b31-90d4-7a5b48a51536", "comment": "Malware payload (IcedID)", "value": "5b7faed78fd238935af768e72ce38a7ca69dbe9289411291d3b1c7f749bf628c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284320, "uuid": "262d6954-155b-43f5-a58f-75c2ffe49ef8", "comment": "Malware payload (IcedID)", "value": "867ae492954d9b900b757072baee7808fd9253fe", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284320, "uuid": "3d3b6816-78a3-43cf-a3b8-16669bd019cc", "comment": "Malware payload (IcedID)", "value": "a427ced5a3b9b6449fb291f3a1afda71657ae0f2aa72b511195ea7608a5ef55135b1b7eb46ab845ebc52a42d36323318", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284320, "uuid": "7a934e84-ec06-4346-be3b-4e947a2b29e7", "value": "8D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284320, "uuid": "54f1ca00-f524-4a2f-8445-ea9ae51026cc", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284320, "uuid": "66236514-ce92-457f-92f3-0f4eb14749f0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284320, "uuid": "2b1f5134-3363-407b-9bb2-852c36e5d647", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284320, "uuid": "591dabc2-8225-44fd-8fdb-4479422b443b", "value": "document-746033575.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e452f20-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282945, "uuid": "c2e4709a-6294-4135-a970-a824dd6d15da", "comment": "Malware payload (IcedID)", "value": "173a17358244514db0201d55f0b3e8d0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282945, "uuid": "9ab3bcf9-d740-4615-ab00-9e33137d33ff", "comment": "Malware payload (IcedID)", "value": "5c1fb63148fa92120bf852c0449f5a41327ce7d728463810a35db1a9706b8e07", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282945, "uuid": "73ef26ae-3bad-4797-ae13-3aca60aaa78e", "comment": "Malware payload (IcedID)", "value": "d04ea00c71bfce3f233a67bde71f40c2a3ca3139", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282945, "uuid": "012adaba-d7b4-4dfa-af34-e9e62a7c504a", "comment": "Malware payload (IcedID)", "value": "3e0f91c7966e40a456d7ac1553e23cd9070379e104cd79806a486077460cfd1b36cc26125251635088bfe884909c7c7d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282945, "uuid": "aa3483c8-1988-4029-aee9-e75a993c5494", "value": "20044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282945, "uuid": "d3c4979f-78c9-46ab-b097-c9779adc01f8", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282945, "uuid": "cb340cb0-3d22-4b08-92bf-2f8186f3854d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282945, "uuid": "2fdbcc67-c1bf-4739-a73a-e38ae28b7864", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282945, "uuid": "71ebffe7-693e-43d8-aad8-1976d3f0bfd2", "value": "document-1805706467.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e9d513-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275900, "uuid": "d0ef3f30-e8bc-47ab-be14-0f821f91306b", "comment": "Malware payload (IcedID)", "value": "44ce2314686655b35192151d34ace0f4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275900, "uuid": "c68dd626-c05c-49ac-91be-838795bf8ba7", "comment": "Malware payload (IcedID)", "value": "5c33c372eda141c2d624db7004153e424323139a4637a5938ac29e5b52bccde0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275900, "uuid": "695c65ba-9e96-4bc5-813b-57a7fbb84bc7", "comment": "Malware payload (IcedID)", "value": "3d70ece9892f394ef45050027e4f13979ab76628", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275900, "uuid": "95d18cf2-960c-421f-a5c6-83ab8dce203c", "comment": "Malware payload (IcedID)", "value": "1c2523419d1a868c4c01c9dae7ef94d07a70a04b01c3abcf83378bf6c21f3149a2382e2e7876611f779ddd842fbf6f62", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275900, "uuid": "107d927f-0b84-4ad0-90d0-cf09ab6ed479", "value": "8D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275900, "uuid": "739a0386-8e1c-4d6a-a853-d4d5e4b7c32a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275900, "uuid": "ddcf5cba-80dd-45e1-8d93-a5fcf79a89f2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275900, "uuid": "225d8935-525f-4d15-a52a-f6cf41d2cdd9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275900, "uuid": "af08a88b-b6cc-4430-a6ce-18fa47433feb", "value": "document-165668897.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785ec196-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287284, "uuid": "98ffc8b3-a6a6-4e3d-8c9f-2451cabab0d6", "comment": "Malware payload (IcedID)", "value": "a24df021a1a603a6dd7100bdba628a18", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287284, "uuid": "7ac466ba-180d-48e5-9b06-157a0cc6a5f9", "comment": "Malware payload (IcedID)", "value": "5c92e01c7a7512bb4bff3261b38673750d03b90b23eaedcc1f8e65ef5fce8b88", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287284, "uuid": "f6fdfcec-2f06-4aeb-a163-817d8be6ee01", "comment": "Malware payload (IcedID)", "value": "1f889ef05e7ce2913d7bace2565bfdf602ac82a7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287284, "uuid": "48d0cb23-cf00-42bc-a18d-02a2c67f9c1d", "comment": "Malware payload (IcedID)", "value": "9c3d1ca5dca8756ad3e05921a271ee779c001fd964c0a560792183c318287b867dbfafbe795e5b2390ab7ffcb7f7d209", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287284, "uuid": "707e2199-5e3c-4a30-b11e-2280c9d6f229", "value": "5E838CCDC913E1D9C2549FBD5A0A308112F4E0B6276FF11B148EA62E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287284, "uuid": "e0567a96-0894-44a6-a69c-852a0c0d74cc", "value": "1536:IB240XZfcaaxf+EQliU2hawrhCAIoo8+BNvMhfvYo:+2d1cBWEQXMrh9o8+nEhHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287284, "uuid": "60b6115f-8c91-44f9-a28e-9c6aa2c755ff", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287284, "uuid": "f5d2f4f5-bf4a-49dc-a36b-848e4f8b0eb7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287284, "uuid": "ef749981-78be-4737-a2ea-5f2ea7bfa00a", "value": "2911.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8da106e-92f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284788, "uuid": "6aa13080-57e3-4ed8-9c32-60fdda9194d2", "comment": "Malware payload (IcedID)", "value": "ca540a94df4ee5ddccfb4cd07c030682", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284788, "uuid": "8b656bfc-a8e7-477e-8c2a-4bf7d6ded367", "comment": "Malware payload (IcedID)", "value": "5cfababf65aba2939e68d680dcc41e02e7b270623499b4cd0aafed7c39c12caa", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284788, "uuid": "2639dd0f-0d39-4af9-8586-f39aa316a044", "comment": "Malware payload (IcedID)", "value": "ed88e1f552f20ca6fb3e0a8f31103221822e07b2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284788, "uuid": "b1486cbe-82a4-450c-af25-11e40b927d58", "comment": "Malware payload (IcedID)", "value": "39183f4454e41e3a9137f10a838f2e4f3f1805bd32cf80c67aa39514c392b1a3025ca2982853454cd3a94c0814c92f25", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284788, "uuid": "b3d74e49-4eba-4638-b803-7619333422f3", "value": "63044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284788, "uuid": "3a018d43-1bc9-46d6-a56c-6c1ff4de43ba", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284788, "uuid": "f0861d94-39d2-4b0d-9976-a0d0f9e327f1", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284788, "uuid": "fdb84f06-a281-469c-8ee1-7b5a45daaecd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284788, "uuid": "5d8a62c7-0899-4fc0-89c3-6662bfda81d8", "value": "document-519331365.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f88a6d-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291432, "uuid": "35612bd0-720e-4d57-ae8c-bf44b5006a05", "comment": "Malware payload (IcedID)", "value": "203ce00d5f3e01b530b04268e5e01e76", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291432, "uuid": "14c5766a-723e-490a-a100-1d31ff9fbe03", "comment": "Malware payload (IcedID)", "value": "5d33302cd313854985f785e42de652cd9a976c4d9dcf31823850f74a625d5573", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291432, "uuid": "a37bde46-8e56-4a14-b7f9-c7abd2b186bc", "comment": "Malware payload (IcedID)", "value": "661014661d792346c3ca8c5e7fb2d2845d2f6e27", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291432, "uuid": "e6b59924-1da0-4d59-9d35-fe809f982f87", "comment": "Malware payload (IcedID)", "value": "4c075a4fe4ad7da7b99e18b85a257f978baf7e71245d12b3d67b97f9eb3fc7747c8dedf19eddeecd825f10f9c7922cca", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291432, "uuid": "8b822e29-c4fa-4514-bcb3-2937a5180d2f", "value": "83838DCDC913E1D9C2559FBD5A09308112F4E0B7276FF11B148EAA2E1D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291432, "uuid": "2c5b0611-aae1-4a7d-b079-044e762e929e", "value": "1536:IB240XZfcaaxf+EQliU2hawGsCAIoo8+BNvMhfvoz:+2d1cBWEQXMGs9o8+nEhH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291432, "uuid": "5b3018ea-08cd-4290-b6c6-352db42443b0", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291432, "uuid": "a117e573-52e9-41ed-9cca-131668eaa91f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291432, "uuid": "b334ce98-3ce5-49b8-8bda-98fc2fc537fd", "value": "3288.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2ea810-930c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617296632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296632, "uuid": "cf378b8e-c4a6-44b4-a52a-c9e4264e90b7", "comment": "Malware payload (IcedID)", "value": "5e3c9e343ed92c61bb4e9c469b9e4d45", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296632, "uuid": "ff301330-9961-4db7-a4aa-8f45901ee6bb", "comment": "Malware payload (IcedID)", "value": "5d8aa62a6f88f39889af3683ad605bc2d91645c57b1f5e200887541613ca9a6d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296632, "uuid": "a85c1732-45a8-4f65-b5ec-95c82a0357ff", "comment": "Malware payload (IcedID)", "value": "86e3a2b66da28b9a2d6e3172d0d7be41aa91e63c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617296632, "uuid": "89abca19-cef1-48a3-8d2a-06ad4cb5a85e", "comment": "Malware payload (IcedID)", "value": "014fc184b6acbebd2420393d5ee082e511266acc4d5cef1772acf8c403b053e0374711f33b4c7fe08a11d22d862a8742", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296632, "uuid": "8a9b3ff6-de50-41e1-b803-ac1a824d3c12", "value": "3304123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296632, "uuid": "9ba6d76b-ad5a-4aea-a74c-deba61738ca7", "value": "3072:dXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:hE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617296632, "uuid": "de1f6858-4d31-4bd6-b873-3567c86ad3d0", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617296632, "uuid": "5543b7e2-4c3b-4841-b615-40f4aa19b4b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617296632, "uuid": "82f7df91-6483-4e3a-953f-6340234a4e4f", "value": "9792762096-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc747c7-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281763, "uuid": "20549b72-c361-4550-8326-cabe7c698ab1", "comment": "Malware payload (IcedID)", "value": "d39da0198fb6d49ed5bcdd7800eb05d2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281763, "uuid": "8f6fa298-101a-4585-8da1-c092adc1b8e1", "comment": "Malware payload (IcedID)", "value": "5da12b93f0b08a374ab9729996ae5190701b65281a4519da90b056714b085053", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281763, "uuid": "9e4fbca1-f1a6-4572-944c-7a99f844d1d5", "comment": "Malware payload (IcedID)", "value": "6e039c5d0949e5f8e998402c8f6b44250acbe3f3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281763, "uuid": "b53ed874-7e44-4276-96d4-c142af42ceeb", "comment": "Malware payload (IcedID)", "value": "924c17d10b11f51729d1150d54c9f831ee8a94819af99bbe79f13a6692f44533fbadf722dd2731de9f31479c2f47132f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281763, "uuid": "c3c8dce7-4953-49e7-be17-c8f9109c48a8", "value": "96044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281763, "uuid": "132f45d0-65a8-49b1-b3ee-b44ef575c76e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281763, "uuid": "5df30885-fa3b-4466-ae38-0a22d12a641e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281763, "uuid": "d7883f98-c7eb-4110-b2bf-65286b6544c3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281763, "uuid": "b88d99a4-a3b8-4670-b86a-76d168df1d8d", "value": "document-1255320031.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a44935-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280944, "uuid": "402925cc-1537-4ee9-93c2-3ed4b1f98c68", "comment": "Malware payload (IcedID)", "value": "e3ea61b628d5e1a44dae14dc189d2c9f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280944, "uuid": "bfc6040f-cb52-42ad-94a3-d54f07298110", "comment": "Malware payload (IcedID)", "value": "5df04e8b82b574e83051dd71cd07010978cbe82f13de4789082c83488ddf5e8d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280944, "uuid": "40c6d041-af79-45de-8566-28a7495073c6", "comment": "Malware payload (IcedID)", "value": "0467c62118458ba082e2a7882238f398419d1472", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280944, "uuid": "e5968f23-8fee-4144-97ac-26148b93224d", "comment": "Malware payload (IcedID)", "value": "300f38a2eee974fd04cf791a5673c4498446f440aa1e9aafcd88a3f06185405f6d4ec76cde110228da3295ad2ed41933", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280944, "uuid": "66e67956-99da-4ab9-8477-7663e7ac7698", "value": "9E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280944, "uuid": "cc85ac64-df0e-4885-913b-5db06e75d2ea", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280944, "uuid": "7879f27a-48cf-4a02-bced-57575335a91c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280944, "uuid": "681f82ce-7ea1-4de7-b55e-37cfb957d495", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280944, "uuid": "f39ecd18-ee6c-458c-86a4-9a448d60a307", "value": "document-583955381.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6c024e-92b8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617260848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617260848, "uuid": "c145e133-4150-4e70-a6db-ccaf56a6717f", "comment": "Malware payload", "value": "b923093938c6471faec2c9104a36b771", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617260848, "uuid": "5031292f-ba64-48f1-93b2-e5d1f58599b1", "comment": "Malware payload", "value": "5e1e2ad3edee8c263db4c6d5784313db7d7d403cf4e578c85bac2d054df4aabd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617260848, "uuid": "6e7a7be0-422c-4664-9aab-fbabb8b552e8", "comment": "Malware payload", "value": "c3c3a2710a45da087c2d06411ff24f6118c76cc3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617260848, "uuid": "2148b174-4b33-4a10-96e1-0e34473cae7b", "comment": "Malware payload", "value": "28dafe0eca7db75f77240746aad15fcd789053335c0ab28b3318780f641b58d1ebd7abbbf05d08a5a59c4efb7d4395b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617260848, "uuid": "b3038a5f-f70b-4b61-b1a0-661f8f67e425", "value": "B126D157A4F710DA609792755FDCF8BF86B9E01B1A6E7AB31140E352CF35B984A230B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617260848, "uuid": "0b6f5a39-2fb9-4ffc-a5a7-e95df6fc9867", "value": "768:LvTh9ycseRwIYcbkMcbkzPHcbkgPXzPEcbkieRwe9eRwEScbkLeRwa/tzP8cbkKU:LLh9KxmwAPQDPjPbFxCxQIxSPTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617260848, "uuid": "b51b6e58-6b2d-4503-8c07-fc2476561fef", "value": 4636672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617260848, "uuid": "fb3742cf-dded-4b1f-80ab-6cef6102a3a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617260848, "uuid": "501606f3-4fd5-4af9-9a45-f04bd0ea9633", "value": "SecuriteInfo.com.Heur.Corrupt.PE@1z141z3.13715.262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0040e4c6-92ae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617256159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256159, "uuid": "5d8cb709-eb09-43e2-b9ec-14af3b696ced", "comment": "Malware payload (Dridex)", "value": "bddbc804c2c63c7957cdb84f71913faa", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256159, "uuid": "417e04d5-1c8c-4db2-857a-588af7998798", "comment": "Malware payload (Dridex)", "value": "5e4c9c0d650a22466313a63fde8e11f62b468db8df6dc57bec8a10acefffb592", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256159, "uuid": "50bbf5b0-2529-4b6b-a067-ba3fc8bd9925", "comment": "Malware payload (Dridex)", "value": "b3b98abba283b78b1767bd4dbd09000496e816ac", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256159, "uuid": "2ffcc0ee-1010-4ba1-8dc9-05c9e8408f88", "comment": "Malware payload (Dridex)", "value": "dadc8033dea9fa1622ef3de41402f29ed833559fc3b89947b12a675b80e0b70cafd12a889cf393efc18086f3405d7f8b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256159, "uuid": "76696d3b-e159-4831-a861-5423ef7de29a", "value": "AF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256159, "uuid": "26e6be1e-9cdc-477d-92c3-3c65247b4664", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256159, "uuid": "144827f4-3c0e-4343-ae84-cbd0247af526", "value": "3072:sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:zpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256159, "uuid": "7030b422-9a57-416d-98b2-d8c159061541", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256159, "uuid": "2a7facd8-3f87-4b72-82b5-ee038eac7345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256159, "uuid": "f2fc4eb4-501c-4486-ae4a-468664910123", "value": "5e4c9c0d650a22466313a63fde8e11f62b468db8df6dc57bec8a10acefffb592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814a01ac-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617279997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279997, "uuid": "193929a5-255c-4f09-88f8-970d37aa8f34", "comment": "Malware payload", "value": "3b4e773d7a6eba74167b90ff58f66e57", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279997, "uuid": "bbaeec28-56fc-40f3-9f77-3052cce83bb8", "comment": "Malware payload", "value": "5e6fd90ca8d13e48e609f5df82fd1c399e54487e3e124323fad528cec99dcb5c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279997, "uuid": "4898c09d-7d27-40b3-ac36-531b49c88465", "comment": "Malware payload", "value": "51b709d003a13ca9d13de95bb7ce6a3bd790f596", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279997, "uuid": "5b5d914d-eb41-409f-af08-57dc490a590c", "comment": "Malware payload", "value": "90bc1965afb40fe79f04ef0d17decdcf205fce665ef4c3ec8d8be70ffdb2ab70ae07e86c18e0f878e5b19a3148bab574", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279997, "uuid": "5895079d-fc7d-43e1-bf12-932df7154340", "value": "3EA423DCBCD8DB0C18DCC3A1DCB27C3DB9A58F9DEF45D5881CA4639E82C5D0902A52A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279997, "uuid": "d43a91d8-ae05-4beb-bda5-7c56cd91ff44", "value": "12288:6CeQDjhhttZmkBMNeRms0kFUpoi22cf1QDgBVVs:iQDdBwkBMNer2ctQDM3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279997, "uuid": "89d43bb1-4b35-4ff2-b99a-ccfe5f355ad6", "value": 488201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279997, "uuid": "c88737ad-89f3-4e22-81ac-11f629a44aa8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279997, "uuid": "4f4fcbcd-ae3f-485e-a490-84958910686f", "value": "Rfq PN 601310-02.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c337b6b-92be-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617263185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617263185, "uuid": "cfa186ee-0ef7-47de-93e8-bf0f97d2e0ed", "comment": "Malware payload (Dridex)", "value": "a21d3a8e5a2b05ba946ca697fe7ec1af", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617263185, "uuid": "093c47e4-7881-4aaf-b210-501d8c4c7f49", "comment": "Malware payload (Dridex)", "value": "5ec879768a1b9e2926818b91a5a573acef5c13a87ea5e593e3d75db7ff1479ce", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617263185, "uuid": "65d9d736-f5e0-49a4-93d1-500b45bb85ee", "comment": "Malware payload (Dridex)", "value": "6d1ef05306ef2e15c87f2fb2d9bd3450981c1e40", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617263185, "uuid": "2923dfa6-1348-4c37-bf92-7f4378aa7f30", "comment": "Malware payload (Dridex)", "value": "4e2837e6e9a46a5faea4c34053cf5cb34babcd6d4c79554af0cf8b26ff6cb085ac3258d4f109a0b91bc4c598cfccd473", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617263185, "uuid": "3d6066e9-5939-44ad-baf7-677b44c306f9", "value": "2314BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617263185, "uuid": "f7fb9a11-2d79-4d82-8508-e29466269bf7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617263185, "uuid": "1b6e7c61-ce10-47cd-b96e-02ab12161f4c", "value": "3072:3opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:4pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617263185, "uuid": "fefb50cd-276a-496f-bc69-e15e85536de3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617263185, "uuid": "2c6959dc-d147-43ac-9433-fdbb6b148d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617263185, "uuid": "13599064-d27c-45a2-9a0e-f36438dc7b3a", "value": "5ec879768a1b9e2926818b91a5a573acef5c13a87ea5e593e3d75db7ff1479ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96409560-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277456, "uuid": "0c9eaa33-6baf-489e-9100-35f982828680", "comment": "Malware payload (IcedID)", "value": "ec93aa33dd8c61ab1c544b15cf96d157", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277456, "uuid": "b714c6ae-28f9-488d-9f61-7ef6ab182f76", "comment": "Malware payload (IcedID)", "value": "5ec8d5c9b6900d956722c9e94c04b62f9ec6673089868d5e302f8ac57f1cebff", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277456, "uuid": "d22439fe-66c1-4b76-a069-49cbfcbd748c", "comment": "Malware payload (IcedID)", "value": "384c9a8a47cdf958deac02284d911fc31abb85e5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277456, "uuid": "f541e888-3c3f-4617-980f-228bc0731997", "comment": "Malware payload (IcedID)", "value": "7aff9a1ef371ea14f792863b914584bd2365343b3505f9ce12a57a77e4cd5394d2d2ca6e3a4f725c484fa3b566939da1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277456, "uuid": "a0adedfd-1a07-499c-bcbb-ad38b8c21fdf", "value": "58044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277456, "uuid": "fd2f57a3-5ba5-4ba4-9fbe-38c924d4b7bf", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277456, "uuid": "0a14f783-e5a3-4acb-9b15-bc1247330425", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277456, "uuid": "f5472957-d499-4a46-9996-e94fa3879301", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277456, "uuid": "d93c3571-8311-4149-98ee-a870ae364138", "value": "document-2042030219.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e66a77f-928d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617242036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242036, "uuid": "24f06f68-e74f-49b1-9485-723518169d38", "comment": "Malware payload (Loki)", "value": "bc69057557208d7533ae8a1892273b68", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242036, "uuid": "ddb99f02-af55-4f69-ab57-119009a3c58f", "comment": "Malware payload (Loki)", "value": "5eda4d8e1c09d096abc2f2697045cd0f2e683041996b375f511701deba3e73a4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242036, "uuid": "a42c3017-b76d-457b-9a8b-c481d7c5084f", "comment": "Malware payload (Loki)", "value": "08e2682bfba207159f71d3d550a77e083e6d19f7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617242036, "uuid": "e24d32bd-4031-40e6-b387-12eb72ffcc40", "comment": "Malware payload (Loki)", "value": "2bf4716faacd56684c7bd88d3b69c824ce8c088db03bd2fecff7cdf7609da6864d399fd29b375b205672a2562a7d74ab", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242036, "uuid": "71d6e3e2-0226-4ba6-81d5-b4cd77bdcbdc", "value": "97B46BF233449A65D8B753794432966322B3BA0DDE69C50C3CA4BE4F7D723C28163A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242036, "uuid": "c7d54d07-7e03-427d-805b-a362bf192e15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242036, "uuid": "3f9d9dd1-82c4-4625-a4db-df47b58237e1", "value": "6144:HtmD8djlxIjmCWM9V39VNYQZo5rsTBmyjrEQh223jPhubAMxwn+lDAA:HtmD8djl+jV/BBmQrLp3jZulw+dAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617242036, "uuid": "b577fdf9-9b76-484c-aeab-8204c651ef54", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617242036, "uuid": "72d11f2b-e999-47ee-8c44-2bf4f148b00d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617242036, "uuid": "c0acfaa7-768b-4660-9da2-1aecfd452e86", "value": "SecuriteInfo.com.Trojan.PackedNET.576.25410.3039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3c7e3a-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275025, "uuid": "14a38ef9-f003-4bf4-a392-bb10ca56bcc2", "comment": "Malware payload (IcedID)", "value": "2f94d1097a83fdaea05b9f5756fd0234", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275025, "uuid": "2138d3f0-a5db-4944-beb9-5be47bf888ff", "comment": "Malware payload (IcedID)", "value": "5f144a89145b24c65f76508e1b237691980a50ccaa515c2a929d8c8a436356ae", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275025, "uuid": "d3b5d1bb-b3d5-4c1d-9045-99672ec0d219", "comment": "Malware payload (IcedID)", "value": "1efb35688325e7ae0fe695214c465b512f4c0f72", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275025, "uuid": "695516ef-b244-4ca0-b418-cfbfde49cf0f", "comment": "Malware payload (IcedID)", "value": "e970e0b8cf9567655e91db74f982c8b60619a94f2fbaa6988ad40f2e6b191eae9b9a967584a6096ae4f110a5384a4f97", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275025, "uuid": "546ad3e6-a899-47cb-b81f-2d88530e666e", "value": "3B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275025, "uuid": "ccafa968-726d-4986-bdef-f339b4955ea7", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275025, "uuid": "4953412d-a8cc-433e-987f-e9fc593bc769", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275025, "uuid": "6d013231-b21e-4faa-9e71-e4c65f3fa09a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275025, "uuid": "8280f8f1-3817-406e-bf45-facd739f68ec", "value": "document-1158918254.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cf05c2-9304-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617293321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293321, "uuid": "1245bd5e-6fb2-4802-8c36-e4dfbf26f38e", "comment": "Malware payload (RemcosRAT)", "value": "136d009e2306806d83c76ff8fb72650f", "object_relation": "md5", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293321, "uuid": "bae775f4-eccc-4035-93f7-32bd2a902cf2", "comment": "Malware payload (RemcosRAT)", "value": "5f7e614ee696c3c2c437fa513db6c09a5203536793ef2e2b2f47971df90fbc1f", "object_relation": "sha256", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293321, "uuid": "7fe61abe-8dd1-4444-aae6-ca8a38d819b2", "comment": "Malware payload (RemcosRAT)", "value": "e90101a6ce07dd7e13446ade45aeee7a888433f6", "object_relation": "sha1", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293321, "uuid": "f536ace6-96ec-4330-a118-4d8e4c19f457", "comment": "Malware payload (RemcosRAT)", "value": "bc352374a28cf0037a339cb14321b5580b1ccd832c97cadb0ae76ff3c8eba64a2a35b808f674ffb859a93b768a4f2ff4", "object_relation": "sha3-384", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293321, "uuid": "f43a692f-c258-49b6-8b73-744581aea5d3", "value": "3AE4B5F404C918A5E2C7C0817EAEFDA012B6F5DBCDE68D6413BCD2720979B66BD43909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293321, "uuid": "97c82ca0-cd9c-4f88-b539-8e0c31a69f92", "value": "6144:hF8aQDHMeLZIpZ2+W96n+1ugN5I0IWIMmb7/I91N+o+2WM4l1JW:hIHFUjW4+1uvhWoI91NDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293321, "uuid": "15bfb47d-f682-4854-ad16-98de8e9d99a0", "value": 692298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293321, "uuid": "e607fc5f-70af-4e5c-a03b-2fd0c84a04be", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293321, "uuid": "559752a0-2d17-4c9c-b54d-5595d94161fc", "value": "NS 001 DOP IPS ORIENTATIONS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a9c7e3-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279057, "uuid": "b494beb6-4add-4555-8918-25858b4d4cf5", "comment": "Malware payload (IcedID)", "value": "bc973f037b3a110bc11dadfe63a521d1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279057, "uuid": "c6b88c99-2704-4fbb-ba8a-51713c6ba667", "comment": "Malware payload (IcedID)", "value": "5f8864cc878ffd8f329fa60385e49d279209015a78f9f1680f8b88b4b90b7c53", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279057, "uuid": "62b609d6-3a80-4385-afbd-d06eba8a59e2", "comment": "Malware payload (IcedID)", "value": "4bebe1fdcc21899f700a3287b2efee1113fdb51e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279057, "uuid": "6ab9e986-186f-4ac5-956f-225cd2f3fb4e", "comment": "Malware payload (IcedID)", "value": "c6a3250d505010aa1fc22cff3d874b4f40e1e5a7238a83fae16818ea9eeb802f86d7e089532c3d64625e53756687cbcd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279057, "uuid": "bcfd1c50-5426-4ad4-929a-8ec4c96db8ff", "value": "89044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279057, "uuid": "b5a2ebf8-30d1-4219-be18-f7118f250bc0", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279057, "uuid": "be118ecc-61c5-4312-b0ca-71c205059b39", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279057, "uuid": "1423d9af-c73a-4bce-939f-6bed3562b6ce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279057, "uuid": "2df0a957-cee9-4b8a-9783-e723898ff2a0", "value": "document-1373977001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8dccef-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274381, "uuid": "3b29f422-3d51-40a5-b3bf-428622aab432", "comment": "Malware payload (IcedID)", "value": "162453840bd19b701ce0467716f7faae", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274381, "uuid": "304db3bd-a42e-4065-a3d9-a30850e4e170", "comment": "Malware payload (IcedID)", "value": "5fab0c382627735a28dba7c27f6738028e1dcb284de1658420f516a867d00b47", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274381, "uuid": "a1601e22-c356-4ba7-a5fa-f48c63baa199", "comment": "Malware payload (IcedID)", "value": "122795a144e4eafd1ae0fcf294dfe0a5549e874f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274381, "uuid": "1da354c7-7b13-4cc5-bc83-e8ecaa47ee9d", "comment": "Malware payload (IcedID)", "value": "2fb55f269f9009cf95bae696bc431e5413dbd44fefa70bb793849dfe32fddd65ae14584a0272a4354628892ce21c3c18", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274381, "uuid": "0ffa7010-b642-41f4-bed3-db2b06e21a95", "value": "20044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274381, "uuid": "1aad8e2b-4c09-44c2-928d-011252293638", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274381, "uuid": "dcf5412e-c92f-4189-b2fa-01712c5367dd", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274381, "uuid": "dcff50a7-c99a-4024-9c9b-5d42a2758298", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274381, "uuid": "d757c7d0-2023-47da-ad22-e5bf864d012f", "value": "document-398991355.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dce5de-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261913, "uuid": "e2aabc9b-ca6d-42a8-9625-81dadb7407dd", "comment": "Malware payload (Formbook)", "value": "b4b6a4368da52a7f759447bd165c9d0c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261913, "uuid": "5d451ebd-ad1e-4b44-91f5-569b1be560a5", "comment": "Malware payload (Formbook)", "value": "5fd87d80f5611c8d437babb58295fd71b150e714b50d8f6c6853b17555458b2a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261913, "uuid": "e86b859c-5597-44f8-8ba7-1127886d3ae8", "comment": "Malware payload (Formbook)", "value": "34ae39c47b41226d35d5aad08b6ff7a20cb477a7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261913, "uuid": "dc2a3b7d-f5b1-4fa1-ad16-a466baf07661", "comment": "Malware payload (Formbook)", "value": "981f54596ce781cd85afdfa11da2c3435409965aa760f85a2259e16a7caf40e0c2edafdfff6fc8975158283cf87ada81", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261913, "uuid": "d840b4b5-176f-4c45-a1a1-023c2b7a2b69", "value": "0F9423B8B77086F6E7839111D16C0D318FD23C3118AD63FD8BA549A7A241FA75A431ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261913, "uuid": "2995139f-384b-4174-9608-0742b03f0f67", "value": "12288:fEnlhVEusJfuj6Kt5GY0N+7ccWCHPWFAcA+R5:snlhV5Kfu9t5II7c2HVp25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261913, "uuid": "6b5a68bb-baea-41d4-90aa-9a9043700e50", "value": 425709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261913, "uuid": "5d0e5001-0312-4cb5-9b1c-84ba97e483cf", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261913, "uuid": "93fc85db-1a34-417a-92e1-51c78f73f7ef", "value": "ACEPAC INTERNATIONAL - PRODUCTS LIST.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ce526d-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284302, "uuid": "fe9ac600-cf5b-4c48-8017-34b7d777ad3f", "comment": "Malware payload (IcedID)", "value": "1e843410ac9d2cab2d7571973317b436", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284302, "uuid": "b74f9535-1442-404a-84b3-d56880743e63", "comment": "Malware payload (IcedID)", "value": "6005e128b839286dfe25f5c08589dbc3b3a4461fb9b62bb6bfca4ce0b6c12890", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284302, "uuid": "9d347065-1b7b-4598-9bd6-aa17418447a2", "comment": "Malware payload (IcedID)", "value": "b7849d8ba7a1b200e03b65c5cb884c264fe9d079", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284302, "uuid": "96ab2c88-eeee-40e6-9446-f6792ad28c02", "comment": "Malware payload (IcedID)", "value": "229e5a553332abacbf39ec1b1df1459dfab32c25331f49ae768330191317b696525b470ee71c1f1e75093b087e7a9981", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284302, "uuid": "83d398fb-575a-4e3c-8ede-1309a4f26d7c", "value": "35044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284302, "uuid": "31915a36-9a12-499e-b08a-151c589ed8bb", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284302, "uuid": "cd8b04dc-3aae-4def-8774-6592eff2a604", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284302, "uuid": "b622d52f-2f55-4f5b-b50e-2952201741fe", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284302, "uuid": "745412db-212e-4ce2-8e1e-b5939f436d95", "value": "document-1698891085.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3165df0-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280994, "uuid": "f6c36d0e-bfb4-4695-b7b5-28dae193f37a", "comment": "Malware payload (IcedID)", "value": "756128950e009fc8a3b23b40a12e03da", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280994, "uuid": "c34364c1-4021-46b1-beb8-03141ea66fad", "comment": "Malware payload (IcedID)", "value": "602cdcd63ef17b4092110c27d62e1fc072a24f6c5468383fdc83a464c398172b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280994, "uuid": "202f08ac-921e-4c3c-9c42-f22456c1158d", "comment": "Malware payload (IcedID)", "value": "d5de73c7f385d95fdbb8bc1a6b7b03aa57828cac", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280994, "uuid": "5b06ba2c-68ed-45a9-837a-c05a3295d16b", "comment": "Malware payload (IcedID)", "value": "4f813fe32611afb147e875427955eb1ac749644d282ff70b5bf76f790c08d97eb885722fc1c00a043040c7822817801c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280994, "uuid": "1c1ed182-19af-4e9d-a4c7-6d09f5dc7ec0", "value": "DA044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280994, "uuid": "d2b55004-9575-4e1b-9575-d30015940e49", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280994, "uuid": "6b06dd2e-e847-41cc-9f8f-45e357430dec", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280994, "uuid": "28c76354-89b6-4321-a1f3-2d4f4f615749", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280994, "uuid": "47e4800f-1035-4e2b-b737-b98590275ee0", "value": "document-1913930836.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3f9d4d-9319-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617302274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302274, "uuid": "15b25847-b9c2-4251-9971-1e275a878802", "comment": "Malware payload (AgentTesla)", "value": "4dbcd7bdd55f07d64a2350fd88db4cbb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302274, "uuid": "d5312d6f-a2a0-47e1-8fb5-731bdbb6f339", "comment": "Malware payload (AgentTesla)", "value": "60a1b30396ff3462336e5cfa0e538dff7ec313fff46f28e3f4abd093346a7d69", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302274, "uuid": "536defe0-4e4c-4324-a54d-243a8122b3ab", "comment": "Malware payload (AgentTesla)", "value": "57bcba16482be2b48ea843a84d1136659e8bde98", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302274, "uuid": "6bcdea76-b825-4716-8006-da39d077bc28", "comment": "Malware payload (AgentTesla)", "value": "09637d002c36aa70d927e24bbf936d633d5255aa080eb408ea65c52075c4959caac19c2f66e6b72d2872b6ec9022045d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302274, "uuid": "83f675bd-9576-465e-bf28-90e158de5298", "value": "C2D423E7856CFF42300B25D06D6DC6534A20813DBFB8E2D4B2B54119728A397E2B9DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302274, "uuid": "d54a11f3-5f2a-43a0-8431-ecc9d23d78ec", "value": "12288:MrX9WcsD86eLWR1eqG29APwtKu6ATefXRvFtqb4IOn5jdQYoE+tqcYC/lRU:MjHsDDpRgy9APDuKf9ybZO5RTCqaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302274, "uuid": "41789441-5971-4463-8c5d-ce2568716309", "value": 613242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302274, "uuid": "5da32f7f-5cb5-47fa-8a48-444659004e55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302274, "uuid": "db5e4358-7e22-471e-b21f-a8d3722a00db", "value": "Invoice55565.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26183e8b-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291441, "uuid": "4ab37da8-4901-4abc-827a-9c27d3a867f4", "comment": "Malware payload (IcedID)", "value": "f95a4a420a2f56922126982e65f884c9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291441, "uuid": "51461ae8-411b-4eab-ad30-597e96f8025d", "comment": "Malware payload (IcedID)", "value": "60bdbc5bfd8ead23ffbb5d48957d4d59209e4c8f60d5b611de27b375f524678a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291441, "uuid": "ea205df3-fc61-48f8-8f45-ccff5ff30e54", "comment": "Malware payload (IcedID)", "value": "def64b0f2d948df03f7f90724af480d3863d7874", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291441, "uuid": "7d26c8b1-40a7-4746-b67f-d7ddfb57f47a", "comment": "Malware payload (IcedID)", "value": "642597d1623163fbd86aad5b66cb0a190251d6e91800c35540dc17168c25d71015cf08a42d7ed395f6e94449eaebfa04", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291441, "uuid": "927ab1ef-8476-49fe-a594-cef445cc89c5", "value": "C8838DCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EA63E0C42FA84A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291441, "uuid": "82877a38-8cc4-4fd3-bc5a-24c3d2b6f1a1", "value": "1536:IB240XZfcaaxf+EQliU2hawhCAIoo8+BNvMhfv0t:+2d1cBWEQXMh9o8+nEhHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291441, "uuid": "8100004e-605f-4a77-b1db-42d8bd8baa3a", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291441, "uuid": "686d7fb2-c3fd-49a3-bfbd-ab26346e53d8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291441, "uuid": "6f448125-f049-400f-9cd3-584e3a91f25a", "value": "2064.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e0c9c0-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280893, "uuid": "82d5e21d-7a38-4bb6-97c9-aad9db1e3e67", "comment": "Malware payload (IcedID)", "value": "5a0168b438f5f1282e51b044bb91b3d1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280893, "uuid": "f0476e82-5001-4320-ae4f-49a6c60feae1", "comment": "Malware payload (IcedID)", "value": "60d468e66939ba605d904fe8ee8b0a741dfab8863d853ee26fac7db958224807", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280893, "uuid": "6fb9694a-688e-4b00-b1c1-13f226ca07dc", "comment": "Malware payload (IcedID)", "value": "c8718b1714c0f3e5eed85d0589b9338fa3436cb4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280893, "uuid": "1c5da8e4-817e-4970-890e-80082fb533fb", "comment": "Malware payload (IcedID)", "value": "4560319886e1737cee9b4728956eb8875cdc88dfaaa7597c5d4ced1c6912ec8ea9febd22e12c535ec73a298ae964746d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280893, "uuid": "cb51d131-7337-4b7f-92b2-79bc8625bded", "value": "D5044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280893, "uuid": "1d1c9c9c-5cd7-43fb-bc3d-0ff3769858c6", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280893, "uuid": "b724c126-0f65-4e09-8b2b-0c07b87bafe8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280893, "uuid": "cc3f9f08-33a5-4ce4-b7fe-748dc0bc5c6d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280893, "uuid": "789970bb-83b8-4bd3-84eb-660d26cf524c", "value": "document-1438814052.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7077d150-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287271, "uuid": "ab5fa0b6-5a08-4763-8d35-7b62bb5850fa", "comment": "Malware payload (IcedID)", "value": "9ece0941492a13c0e1054643cbd8a601", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287271, "uuid": "2e6ff605-d9e9-4e19-a218-1941b21ac737", "comment": "Malware payload (IcedID)", "value": "60ec60cfe24bd35c861faf4c24250dc18e0d54a5cf8744ca51e28bf5cf8bfa05", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287271, "uuid": "f9fbbadd-0cb8-4878-bced-b5b88203f590", "comment": "Malware payload (IcedID)", "value": "18465cd5e58b147b50a46f72eea580782302da8f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287271, "uuid": "86844aac-2798-40a6-ad76-f205061a3615", "comment": "Malware payload (IcedID)", "value": "e58dedf2995e1bf9c631a34f97fa79f1194760275afddab3d6a2bef3b9a271727876886bb7d0b7e7f2643df0d8a90754", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287271, "uuid": "6af3d6d9-1482-4c76-b832-0f0120b95fe9", "value": "0A838DCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B108EAA2E0D42FA40A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287271, "uuid": "545b093a-83b6-4a62-89c4-a79c4324f3f2", "value": "1536:IB240XZfcaaxf+EQliU2hawYtJCAIoo8+BNvMhfvEn:+2d1cBWEQXMYtJ9o8+nEhHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287271, "uuid": "a8ac3173-432d-4ba5-bfe4-8038486e3ac4", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287271, "uuid": "2a09c6aa-612e-4049-9de1-fa0ddd4cd97a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287271, "uuid": "d7c56175-ace1-48e4-a977-66a0aeef8d68", "value": "1659.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cd15f4-9304-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293111, "uuid": "c6b90995-a1cc-461d-91ff-5e979d6f8cb3", "comment": "Malware payload (IcedID)", "value": "eb0ed8e7ac06936d2dae4855696448b8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293111, "uuid": "6498424b-f5dc-411b-80bd-ffa49a01ad00", "comment": "Malware payload (IcedID)", "value": "615c38d38e6c5a6e4e2ebac3c59858c1b5721b4c5ad5cfcf96aa0cdcfdb6d175", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293111, "uuid": "02998adc-5e47-40a4-b396-0f0b7b944cda", "comment": "Malware payload (IcedID)", "value": "7a2f78cf4623c54cd194aa4c29317132c6d1c9b1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293111, "uuid": "fb7ba692-d816-407e-9420-3078227dfe3c", "comment": "Malware payload (IcedID)", "value": "5c4efe476430583205f52eaa2ccaf284b071ffae6adec2b466252777d59e525ec39d8206a472e9460044c212e68c4b41", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293111, "uuid": "a5b061df-a292-442b-94d2-e7df68824ebd", "value": "B3838DCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EAA2E0D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293111, "uuid": "6f84e0e5-1fdc-4a36-bfb9-964c4f2f3d18", "value": "1536:IB240XZfcaaxf+EQliU2hawdwCAIoo8+BNvMhfvWf:+2d1cBWEQXMdw9o8+nEhHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293111, "uuid": "ecb54168-1378-45c1-9355-1a94df8a8214", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293111, "uuid": "a7c5eae4-7036-47dc-b2db-d5761009884c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293111, "uuid": "97cc1528-d71d-4946-97dc-fe7a0834573d", "value": "1942.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7599a816-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281696, "uuid": "adae97f5-c5d5-4bdc-8905-b616ab7b0ed5", "comment": "Malware payload (IcedID)", "value": "2aa3ee595e796d55c6fba261988d90e7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281696, "uuid": "7d59c3c3-5959-4ba8-bea1-1f71154b9504", "comment": "Malware payload (IcedID)", "value": "61a3a081a9d66175a24c8065e848301c630772a52bad6ca1dfd4e02c3f7d46c2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281696, "uuid": "46b3430c-ed6f-4861-95fb-effd51807385", "comment": "Malware payload (IcedID)", "value": "fd08d3e44532d08e293a8f055a17709234de12a7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281696, "uuid": "f3da1207-ec47-4991-a2af-a4f1f804481e", "comment": "Malware payload (IcedID)", "value": "d1b8485d6769c9b5212b01edede5ffe686dcaa4a90380f04114e61e42414d223c167a4f6ee5be8331916390b5da91086", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281696, "uuid": "a5a670d8-f057-4919-989e-39358580027a", "value": "5F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281696, "uuid": "ccbed690-cd4a-4d75-b5f9-8931a498608d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281696, "uuid": "fa038160-2159-48fc-b07f-db0b0262dff3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281696, "uuid": "7e58d521-0c68-42b6-a800-4070331f5389", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281696, "uuid": "d5f81492-9f1f-463c-9398-a4bf8560985a", "value": "document-1031166636.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099551cc-92b1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617257463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257463, "uuid": "b9dc23d3-0e33-4150-8e9e-3c8d1df9fc98", "comment": "Malware payload (Formbook)", "value": "cf0aa5e08d4e691db469951027c3d0aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257463, "uuid": "1079b3ce-a9da-4752-8964-c848fe18d428", "comment": "Malware payload (Formbook)", "value": "61a44bb62397d033071a78e0e62fca22fbb24ca83ed5998e00ee365c04d99e5a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257463, "uuid": "7ec00461-5e2e-42d2-95e3-3295af579b46", "comment": "Malware payload (Formbook)", "value": "37fad5d6a843578a420a14c7d2678a138aa97a4b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257463, "uuid": "6bc2f91e-2592-4ca0-8746-d3219f9648d3", "comment": "Malware payload (Formbook)", "value": "628f90279e36bdf7d4e9eae6b65ab0d95f46d5e73826ef0191adc3eafe57a44609280b2b92b6d76a48c5841bf9281420", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257463, "uuid": "95172bfa-e5c7-4daf-8358-a28b8e195fde", "value": "85A4AAACC09742A88F85ABB82B1F2F85114C7B6EF744A532723497752BD2C7B901797C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257463, "uuid": "d7c05628-7c47-4f57-8e1f-2e728d62a241", "value": "6144:XdX9sSdYBQyvQfE2Xjf0MPQTISWy6zdPEegc2CqA1AU4JUTKpThg01+MGF2XVghR:XdN1flMISD/vo1cGeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617257463, "uuid": "38cc1334-8cd7-4b5d-b432-3e337e210660", "value": 475751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617257463, "uuid": "e6e0e967-bcf0-4db5-baf8-c4e25e86debd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257463, "uuid": "b4e13083-0f46-485e-8df9-f07fbe6b3448", "value": "Urgent PO.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e51a83b-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285871, "uuid": "3a828b38-d928-4375-b58f-0f1bd11e2dcb", "comment": "Malware payload (IcedID)", "value": "e2facc51c5347cd86e868567382f4de4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285871, "uuid": "e2e4d52a-6932-4515-a9f8-efed2fa07f6f", "comment": "Malware payload (IcedID)", "value": "61c93968c1ce03539c79717dfe7acb6d48d582fbce2c75ff691121f8eb0e0670", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285871, "uuid": "ab9082c0-d84a-478e-a4d4-31b787d29687", "comment": "Malware payload (IcedID)", "value": "da2c8538b50095172f82d81678c998462a2f862b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285871, "uuid": "4c0626c0-b40c-481c-96c7-e924e23fe24f", "comment": "Malware payload (IcedID)", "value": "c993d243e05c1248b79ff2f57a09d6a13f26a2b2166de8e25fdc1ef7e19928b833d24b1768505b95b5d22a4fe30f9d49", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285871, "uuid": "54dfe832-796a-4ee4-b757-39ae416cd5ec", "value": "6F838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA80A5E7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285871, "uuid": "08b8e3d4-edbe-4cde-a4db-456d077cdd49", "value": "1536:IB240XZfcaaxf+EQliU2hawzSCAIoo8+BNvMhfv5fc:+2d1cBWEQXMzS9o8+nEhHhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285871, "uuid": "6e7606e5-dec4-4517-a07c-cbff3172014b", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285871, "uuid": "fa45a554-0bc5-4293-83d6-e68891339278", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285871, "uuid": "6cdb7656-797f-4f47-8046-5996fe7f771d", "value": "2933.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc2f911-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279938, "uuid": "90788288-aad6-40a1-8299-2ebd39e4d31e", "comment": "Malware payload (IcedID)", "value": "cdcb5f3cf5baea889d799ef1f7b4e4f7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279938, "uuid": "48bad005-40ba-400e-995e-f7433fafc2d9", "comment": "Malware payload (IcedID)", "value": "62230414680bce9484678c1dcdb2655ba346570bf0bd490618c3b137c6f9c716", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279938, "uuid": "3c16216e-5a87-4bab-96c8-317474e2ebf9", "comment": "Malware payload (IcedID)", "value": "19f8d5061829b8330e6c6f1ed45f672966633d9b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279938, "uuid": "bdd98103-6f6e-4b95-ab59-6bd037dcfc2e", "comment": "Malware payload (IcedID)", "value": "00fac66de9cfd2437d90dd84a869790b0bf902a311d88446f61677d514e7c3bfaa2867b7d3b9f67508f7f9e1df64de3e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279938, "uuid": "23d9e76c-0c88-4a8b-8481-c826ae14da17", "value": "0E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279938, "uuid": "81fc5fcc-e5f9-4336-aa0b-5bd79b6103df", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279938, "uuid": "ee1724be-2f58-4a98-b1b5-00afb673cb09", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279938, "uuid": "0afc3d9f-f2ef-4189-a6ef-0bde2916897b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279938, "uuid": "0e27b571-ab38-4234-af9b-0c69c4d4c140", "value": "document-2092157215.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db39bc45-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286161, "uuid": "0c884b07-4647-41e0-907c-8d4c757da62c", "comment": "Malware payload (IcedID)", "value": "556091b86dcc5359eb3435a80b34f1f5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286161, "uuid": "c5ede232-87bb-48a9-9dce-6eb361b5e569", "comment": "Malware payload (IcedID)", "value": "626b556477ec998c323f57307ab4db6b33131597c93830c2e4d94495e9743f3b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286161, "uuid": "047b3be3-17f7-41a9-a41e-6f11e1639a0c", "comment": "Malware payload (IcedID)", "value": "97cc9a063b7c26d7ef3a2e9399993feb9c444309", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286161, "uuid": "0d0516b1-3f34-47e5-8a97-227c5a1c8cc0", "comment": "Malware payload (IcedID)", "value": "1dd2d08b46f286aa78c4c1725773ab2157a9fc70ada624b0af2b73af36872f0d1a0edd229e9e85496f766bb91aa96b30", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286161, "uuid": "a479952c-dfb6-423c-b785-1fbd0bafb99d", "value": "D9838DCDC913E1D9C2559FBD5A09308512F4E0B62B6FF11B148EAA2E0D42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286161, "uuid": "ff28fd91-5bb3-4853-9855-025005af31cc", "value": "1536:IB240XZfcaaxf+EQliU2hawhCAIoo8+BNvMhfv5l:+2d1cBWEQXMh9o8+nEhHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286161, "uuid": "76d8ede2-4b43-427c-90fb-3f73aa01f25d", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286161, "uuid": "392e3b50-e1d8-4f06-a5f8-63d256d615ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286161, "uuid": "3b63ed02-fd25-474b-9ea7-a6b4e33baa40", "value": "1637.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b57319-9290-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617243521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243521, "uuid": "d8697d19-7409-4709-9f29-a8d817da83d5", "comment": "Malware payload (Dridex)", "value": "04e1e9d9ec3a65f20df7fa6ad34a13bd", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243521, "uuid": "4df69b08-97d2-4b95-9b15-d762544b0c16", "comment": "Malware payload (Dridex)", "value": "62c3a9c66466f4bceff1f9d785b832af8f15f4ae1b07ec573ba2f43a0d7db308", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243521, "uuid": "68079629-6e39-46a7-b0c4-646743367b57", "comment": "Malware payload (Dridex)", "value": "d65bdf0336fb9d9adb751888ee515929a134aa3d", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243521, "uuid": "b24f98e2-7875-4ead-8081-2308f60dae3b", "comment": "Malware payload (Dridex)", "value": "a1689ab11af29f6c6ca325749df8e3a48dd854eb83e7cbf87f76d8b125a29c8a3d5ae5a2cb5a8e87595252f1c0e5ce6d", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243521, "uuid": "65508b56-e091-4a00-8d2b-a2e421f502cb", "value": "0F84D143ABD54472F6721F3804739B104BEFBDD64E308DAA6289211D2F673C196787AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243521, "uuid": "0d47f0e3-2804-4c88-8cc6-0bd292a53fef", "value": "61ef004a8c2946a166c67bb888b0e53e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243521, "uuid": "caa605ea-cef4-4835-8314-22fb51b616ab", "value": "6144:dOhxWpCcRexubjx/WNQoGuBF4CEejyK0nnTaftjWnFGLOk0zEj/LDOc+gpHU:dOKcubjlA5BFiTaFjaPcvOcjpHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617243521, "uuid": "6844ad65-4560-4b46-81b5-f83220c1c90d", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617243521, "uuid": "f094fb5d-452a-4f11-bab2-5fa0616a2089", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243521, "uuid": "f087df50-84e5-49e8-ab38-6e5dd159faf8", "value": "62c3a9c66466f4bceff1f9d785b832af8f15f4ae1b07ec573ba2f43a0d7db308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b703aa3-9345-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617321166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321166, "uuid": "cc57a267-50ce-4a37-a2d5-9b01d107eaae", "comment": "Malware payload", "value": "fa793a1652ffbdf268972d6f3d14a46e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321166, "uuid": "e6a762bd-56f8-44ac-b537-f629d987b365", "comment": "Malware payload", "value": "62c73b32df10c2f138298d3bfc71ede1ef194e7727455129cda421cf77021dd9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321166, "uuid": "2945ec95-a6ff-424e-9261-d1109d7c6a17", "comment": "Malware payload", "value": "79453dad5b0794083850755df8eb263c427fe44c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617321166, "uuid": "e7dbabde-bed5-41f2-9050-a5294c9757f8", "comment": "Malware payload", "value": "2ae93b426c1a44c8bf86308bc94b21ae23d2b1407b268584a1e16e6337b6bb294db07e72e2cf28b5a66e17acde67bd14", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321166, "uuid": "428ca51e-3f3e-468c-ba09-774ef09de15a", "value": "4A14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321166, "uuid": "44331ac8-7034-4dea-9dac-8207b60b5cd5", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321166, "uuid": "a482056d-29f1-4c70-a32f-e42019fdda16", "value": "3072:L1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ji78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617321166, "uuid": "4871bd70-a738-4738-b114-815273b64e61", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617321166, "uuid": "633bf891-b68f-422c-bad7-7d8f5b5e87f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617321166, "uuid": "dd160a74-a22a-4446-a4bd-089b38094a3b", "value": "62c73b32df10c2f138298d3bfc71ede1ef194e7727455129cda421cf77021dd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b590df-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261914, "uuid": "3942d2cc-bf20-447d-8481-911cb01410ca", "comment": "Malware payload (Formbook)", "value": "cae21380d144dce339ef0589c2b93b17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261914, "uuid": "a5995528-0334-4bc3-ac79-6273b60210eb", "comment": "Malware payload (Formbook)", "value": "6301f339599408263704cb0ff4402bd9109b40871e19440f97332b5c41cfd1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261914, "uuid": "3fc46345-da55-4f43-b02d-9b768dc4707b", "comment": "Malware payload (Formbook)", "value": "3d317ed4a19ce57aa633d0d73a236d0cb919ee16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261914, "uuid": "1c21eec5-4827-45b8-bd75-8454d7452f3b", "comment": "Malware payload (Formbook)", "value": "5de8893d68477b2dbab771a2bfd19392eff052cee419d1f3e9d8d31e1d4e1ca0db67842dc8af854c1f64a29e3beab3b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261914, "uuid": "2a46d850-c656-48f4-8a2b-5208c8dea6ff", "value": "D815AE273E45BE79D7B8577F0850610417F4AC1AE3E5E20A3C2DF29C9D79EC28662782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261914, "uuid": "c58d8a4e-842a-4184-9db1-844602817037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261914, "uuid": "e8d3a09d-ed05-46e4-91aa-cc6787b3108c", "value": "12288:4Eg8vsSj/Lyx1frqrP2KSZAmPfRKV43liNMGeXT:4K/LgxrqqKPmPcVmlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261914, "uuid": "e971ae4a-3b61-4aa4-9fe0-a0a199f3c538", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261914, "uuid": "85ab64d6-0eb8-4176-90be-9069af173624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261914, "uuid": "741de16d-64a6-4325-a483-46020936ea97", "value": "ACEPAC INTERNATIONAL - PRODUCTS LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00e714f-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283539, "uuid": "f12499a9-11a3-4c05-8438-e789434e99e5", "comment": "Malware payload (IcedID)", "value": "4799f2cdb14178f123160ebd16be6d3f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283539, "uuid": "91ae5cc8-6796-43e2-b7dd-b74a0f788455", "comment": "Malware payload (IcedID)", "value": "635b4734fa457cc123455dab373663eae7b5d3437bc0a284a428319d8f8489e0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283539, "uuid": "9d4aec23-8356-4c6a-8e55-2ac5aa725b64", "comment": "Malware payload (IcedID)", "value": "66deaaadca686d5b8c16aa5bb019010a3ece95f5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283539, "uuid": "c3ea8e8a-20ff-47ad-9351-6f12e16265c0", "comment": "Malware payload (IcedID)", "value": "a53db3e762fbe1201f09fd407f90aa70d5872d652028f43d1650c9d0902840d34e6051de7f129d511207541444586108", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283539, "uuid": "b2058aaa-8c0f-446e-8a7c-534a23129876", "value": "E3044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283539, "uuid": "3fa76028-80c7-4ded-8ad2-825e727a9144", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283539, "uuid": "d22d3c1c-8a79-4b73-a1b4-c51d6a0c673c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283539, "uuid": "0bc2d64f-2852-46dd-868c-76fe3db9c550", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283539, "uuid": "f477e7d5-35e8-4b88-a9c3-10ca2897c198", "value": "document-1613675846.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ad0f6a-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617259411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259411, "uuid": "2487184f-9643-42b1-a3ce-1ced26f5b5a2", "comment": "Malware payload", "value": "29c386f6b56657290f3c66d9aa510385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259411, "uuid": "915c99c1-4577-4781-8ea0-d52311331cf1", "comment": "Malware payload", "value": "6362d98cc3f2f39aba123163eb13761d23ff795314da7097835bfacf5f087dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259411, "uuid": "920ae663-3303-4fc9-919c-3d9082acbb1f", "comment": "Malware payload", "value": "b396a43e70b4a63b697aeb212f14ab749cea12fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259411, "uuid": "818e1940-9448-4a62-b48a-a876b5e4c61f", "comment": "Malware payload", "value": "e1d9c415def90ee07f77208b7a1e3671d22e23a7fa66db41907ededcddc1d78135146a2773a7235b0483350049f3540e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259411, "uuid": "edbb5f16-1490-48b4-88d7-cfd206d00540", "value": "AD06CF66A8A614F9C6BEE0348152A32278713CB587353FD32ED426AA0775FE8773D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259411, "uuid": "ff9f95a1-f613-4eab-8222-92276e6608da", "value": "49152:KCb6X0Vg/3EYYD+75cBk5+TrlmVNm0pBmh1IO5Cd3qRe//TMNOYQk:mXog/UYKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259411, "uuid": "9034c96e-18b6-4660-b0aa-eef9d0e3643e", "value": 3680800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259411, "uuid": "801d0ba6-13dd-43f7-a20b-32dc5b000272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259411, "uuid": "e70649ea-0caf-4986-bf96-e7a3d90a8d8e", "value": "29c386f6b56657290f3c66d9aa510385.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae04963-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274376, "uuid": "c4cdc674-a3f3-4498-a5a6-38c5aaec00ae", "comment": "Malware payload (IcedID)", "value": "8477149d25511f7895d456ebb3ca9442", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274376, "uuid": "8a4d1ae7-74eb-4f18-87aa-c99342741a83", "comment": "Malware payload (IcedID)", "value": "63cbd9fe248bf0556e8af26570de33abc71769460fa95dab2364f162604bb4c4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274376, "uuid": "ceaa6556-518f-49b0-b95a-9f88dffd3c17", "comment": "Malware payload (IcedID)", "value": "0f39d639725726fc9e210fedad72aa4b54de82fe", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274376, "uuid": "d5e24fab-38c4-4f5c-a06b-f042b977fd4a", "comment": "Malware payload (IcedID)", "value": "e02a601c2c6cd6a11942445c59648524c4b832f143d9a6f7320200513a2026e6ec8ddcac0ed2b618bea8f70c3cd40062", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274376, "uuid": "219536b3-9ab7-492f-9445-e11f28ab3da9", "value": "6E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274376, "uuid": "8137a5d2-a557-4bf7-9d3e-2ecbc16d3c26", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274376, "uuid": "c11a126e-c186-4644-841b-17930eb7b1a0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274376, "uuid": "21d4e917-a483-4436-ae4c-4896ea45ad2c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274376, "uuid": "b88b66aa-43d7-4d8c-8d05-7eeaf2b15069", "value": "document-90429228.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7b88c2-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275641, "uuid": "cf1b73d7-faa4-4061-a50c-ed2ba76257b3", "comment": "Malware payload (IcedID)", "value": "5b417e23279c338c2959e967df6a64c1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275641, "uuid": "d5675abc-2dad-4b52-b322-e5a6fc112a54", "comment": "Malware payload (IcedID)", "value": "63d106c70251dc9c383ccda4ba934378f580a25d17953aa6352e5287e6a19307", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275641, "uuid": "29b7271a-0745-495a-8ca8-f2b43775d79b", "comment": "Malware payload (IcedID)", "value": "aed5dda8786e53044df3c5219e761657665ace05", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275641, "uuid": "6b694a17-33e6-4f78-bb0b-62710e18a78e", "comment": "Malware payload (IcedID)", "value": "444c438d855e48a22266fcc22b380be19b128dd140d20162d441c6e98ec20923b54a7d519feb4d017a3bea229171991e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275641, "uuid": "ad1b6633-a7f7-4668-95e1-c99861e6d03d", "value": "85044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275641, "uuid": "7e74b5b4-d605-455b-86bf-775b34438bc6", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275641, "uuid": "6b352902-f5a4-437d-af7c-46c435cf72e0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275641, "uuid": "aa88178d-6ea9-43c7-8ead-29a1a68a9a7a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275641, "uuid": "ae15b97e-b5fa-4516-81b6-c02cf5ba9981", "value": "document-1799017197.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4d2981-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284284, "uuid": "6c44e4c6-b113-488e-9feb-c0c93d8bf4c2", "comment": "Malware payload (IcedID)", "value": "0b39d50023504da9f2ef9c0832de9c8e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284284, "uuid": "d9a9e250-b2ac-4bc8-bba5-bb45f0e3b205", "comment": "Malware payload (IcedID)", "value": "63f0a642512ac6d864c7f58efe676beb81e16901987095b978bb0256b0eb67bd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284284, "uuid": "d6a808bb-2165-4036-8376-87abb533f302", "comment": "Malware payload (IcedID)", "value": "ab84e80124c18995a21bdfb16948725bab90bd34", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284284, "uuid": "8ccf3f2e-620c-4346-b44f-16b0660c1762", "comment": "Malware payload (IcedID)", "value": "4e37d06fb08025a20d26c10a9d7b9e3952d4c88cd05e002321b23f2c89bc8416f7502cbdd2cfc437b4a02b4c2b4b3d89", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284284, "uuid": "6463d300-4c1f-4aa1-8f38-ba2f261b0140", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284284, "uuid": "07cbd2a1-c35c-4d15-bfc3-43649411ba7b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284284, "uuid": "c7fd0258-34ec-4ac4-97f7-13ea89c3f6fe", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284284, "uuid": "d0495cae-7ef9-4fa0-ab0d-eec7a7d64798", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284284, "uuid": "c33730a6-09ef-4ed0-b419-da6a49e44b66", "value": "document-1533310598.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0918d076-92b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617257032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257032, "uuid": "09d3aaf3-c881-4e25-930a-edfda9168c18", "comment": "Malware payload (Formbook)", "value": "ffb31cc89f24dabfd7760cc01dc36b9c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257032, "uuid": "bf1d4d97-c6eb-461d-b6d1-91796a5bc659", "comment": "Malware payload (Formbook)", "value": "6435692226e985648fa245cbc6d3eeeefd834a8d77f2d448c5521b836e9e8db8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257032, "uuid": "0c24738e-a0d7-4207-b53f-091dee8045ee", "comment": "Malware payload (Formbook)", "value": "3835ae69986a6249a274b347cc5b6b1e45a4b3d5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257032, "uuid": "fb448195-8e3a-4393-9267-04cfcfb05825", "comment": "Malware payload (Formbook)", "value": "6fa0694f8d085a539276b0148b5288a6fcdd676bcdfd8d13cf675182f6819d9c30b3941f5111ad0263b4a6b65db89dc6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257032, "uuid": "cdb905d6-bd13-405d-8987-cfa991cb2ac0", "value": "58A4A9ACC09742E88F86ABB86B0F2F85114C7A6EF744A5337234977527E2C7B501697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257032, "uuid": "fe0e23b7-f342-41ff-a61a-4798e7f92fe6", "value": "6144:9UEuo/20ku6OBcUJQYbQKBFKHYYfXmoQquug/0rkMSdnPzI8Mmi+tyn3pPpc+r/U:FHZFQ6BE9HtRttSd2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617257032, "uuid": "35e7414d-d643-4894-bf99-5ea38d8b0bff", "value": 473268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617257032, "uuid": "6b510706-da3c-415e-aa27-d62489ec2aae", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257032, "uuid": "684e7919-6b27-4869-8265-412fd991b984", "value": "Proforma invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d8e067-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292387, "uuid": "387c42cc-40b1-4d11-923b-f497fab8c7cd", "comment": "Malware payload (IcedID)", "value": "35a2f4e726591d7cc92286b1f462bbb3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292387, "uuid": "0ce4ab05-ba81-4a85-8b84-d92e10cba5b2", "comment": "Malware payload (IcedID)", "value": "64370948fe579cd3aa1e26c57a5815d77e507666faffededf4ba7dafb5295420", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292387, "uuid": "a2d683f4-9f71-44b8-82bf-c365b0cf9e2f", "comment": "Malware payload (IcedID)", "value": "a38574dee0fb79bf969f83d9d2562e827025536e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292387, "uuid": "3b37ea4d-9a6d-4ac3-ab35-1d326e510b30", "comment": "Malware payload (IcedID)", "value": "fa3eb9527ffa4d62d4df55d4f2ae76260f415eac8ac9de0e6382c50ddc36cfe668cbc3b5655ddb13b691ded5ec924e0a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292387, "uuid": "fa190b2f-3e41-4f40-914a-cadfe0dd37f3", "value": "D114FA8598EF13BBC037113A908316786E3578C097E977CB9658EF15FB637D22922326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292387, "uuid": "cbf5f244-c556-4d41-b9c3-de4a046e93b6", "value": "899ed385f326a8d1a9ab31e32ad45491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292387, "uuid": "015cbdf1-6219-461e-9138-958a7c6f6117", "value": "3072:wEtWEC0YWOD73fGLw5dEkOj4NJj7qR4LZzDP8KD7FgZcrE1ki+gXaB:hQjz7q+LFDP8i2c79gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292387, "uuid": "b6f5a8f7-ab0d-471c-a0a7-ff4529af857d", "value": 203808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292387, "uuid": "970a2f84-efc2-4004-929a-04c09a986fce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292387, "uuid": "275842a2-6c31-46ef-ab32-6242f632f435", "value": "64370948fe579cd3aa1e26c57a5815d77e507666faffe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ffb117-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275286, "uuid": "7d78fc08-d3e6-41ac-bff6-2a338cd6b996", "comment": "Malware payload (IcedID)", "value": "c0e24c805457edf2ca1963f5d0d42d98", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275286, "uuid": "184c8603-b12b-4583-9648-ddd023ceae6f", "comment": "Malware payload (IcedID)", "value": "64abb5d24cbe3309682df2f2cab777bafc9e6761fc17681b07222e1152b2d354", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275286, "uuid": "774655e4-79d3-4976-84f8-1cc778e0d4f8", "comment": "Malware payload (IcedID)", "value": "2e02b04585525ac7312ba1c3df2bec62f4f5e092", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275286, "uuid": "42aa9b87-9815-4fb4-9693-257643b6cffb", "comment": "Malware payload (IcedID)", "value": "017c004f7b88c8b2fd71585c17c34de779b571bb44d32e6ea3b419727d0c2f1ab4ddfb51fbb80835d2b1e1082bf0fd83", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275286, "uuid": "5eb2fb3f-7952-436d-92c9-9e4130b07b89", "value": "DC044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275286, "uuid": "b810bcb6-3523-44bc-ae76-cdd1f91e39fc", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275286, "uuid": "854cc8c3-03fa-4eef-b8df-78c2f2cdc921", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275286, "uuid": "0b60c761-72aa-4df9-ad43-4a02d7fd4c7c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275286, "uuid": "970a533c-9c61-4d2d-ab8a-bbded2511031", "value": "document-853308676.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00625bc8-9310-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617298250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298250, "uuid": "19a9f4fb-71b3-4e2b-aa83-553bce5422d1", "comment": "Malware payload (IcedID)", "value": "dca1f4e4068f4d9d01cf21e119e8d33f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298250, "uuid": "7e072b74-213d-4fc6-898b-b4b40c97f998", "comment": "Malware payload (IcedID)", "value": "65339ee25d29cd266da3ca706ff661a80eec30d65951d7ccdb191f985cdaeab7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298250, "uuid": "3d97bd6d-ce91-47f0-9d36-f38537dc8c00", "comment": "Malware payload (IcedID)", "value": "490581044678ed194291eee594d39bd5a71bf8b1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298250, "uuid": "552d7875-7997-46a0-9162-d3507f2305df", "comment": "Malware payload (IcedID)", "value": "debadb10cbe851a6b971c2fd61ee9ce5125733124b9dc352d5fec86c9dc59eda126e0b1e761ebf690ef87b36edd09510", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298250, "uuid": "07acdc6e-5308-485f-85cb-95c2601fcebd", "value": "4204123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298250, "uuid": "95b1b5f1-c035-4bc5-a6db-30b2226293ef", "value": "3072:bXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:zE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298250, "uuid": "40aaa03f-056e-4140-bb12-048208eac698", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298250, "uuid": "5472a44d-09e2-4574-a8fa-97699dfea2ac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298250, "uuid": "4411327c-805d-4da0-86f2-b9554ef502aa", "value": "7637946683-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6869cad8-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275661, "uuid": "6ae46396-a647-4efe-9e5b-2c43c75b65f3", "comment": "Malware payload (IcedID)", "value": "ad91dff99072be434ba5fa4ab1fe6125", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275661, "uuid": "2da4cc1a-1449-45f2-a9bc-a880094aba4a", "comment": "Malware payload (IcedID)", "value": "654cc37ab3fc0a445e9d51eb96fe05c915cc8ebc29317bb39fffe7037bf22d9c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275661, "uuid": "113a2cc6-46ca-4812-b831-2941bdf42a00", "comment": "Malware payload (IcedID)", "value": "63c56a9abdc83e1a44cd3477f22bea07d745d633", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275661, "uuid": "f2bb6418-416a-48e2-89c8-cfe464f52f4d", "comment": "Malware payload (IcedID)", "value": "73a1b23aada69ea95ca4556b0bde80c99050c6d992d83a5e8024ae3cfb0fcba0dcb801457dc79067f992f40c3a158ffd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275661, "uuid": "63e10c29-67c0-43d1-9dde-8e6c49cef0a2", "value": "CF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275661, "uuid": "ccb0c889-3ac4-4eda-bbf1-9ae352eb832f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275661, "uuid": "a046efb6-0c0b-487d-8d1f-e9e5117beef3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275661, "uuid": "cead6653-5be8-4559-be06-850bf6f56887", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275661, "uuid": "2368297d-68b6-4cba-933d-aba5ecff4702", "value": "document-647371219.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadcf4e0-9299-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazarCall)", "timestamp": 1617247533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617247533, "uuid": "0cbde26f-f190-45a3-93ca-167e6bab27ae", "comment": "Malware payload (BazarCall)", "value": "61968c8debeae1e415a485c0b4d79b46", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617247533, "uuid": "08616847-8250-4197-8b00-14c3335c73a8", "comment": "Malware payload (BazarCall)", "value": "65b652b99cd7ed6bd82bd0f258b03a483e0da9f3314b67fe9728eca76c3d59a2", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617247533, "uuid": "8ebdbcec-eea8-4e62-be4b-967c47271567", "comment": "Malware payload (BazarCall)", "value": "59dd3058a18f6fe59a3951c6f119aaf89d52e30f", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617247533, "uuid": "d71902e6-7dae-4d1e-b75a-9f077086385e", "comment": "Malware payload (BazarCall)", "value": "3d33f5d745c03abc446e3445e9aa488c5344170985036e973b64daa8dbb60a72792c1c10df71ad6fa2fbd02f59e1317a", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "openfield", "colour": "#36FA3C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617247533, "uuid": "712d57e3-fc4f-4303-89a5-056aac2aeb6a", "value": "4C54AFB8B5146CD5E57E527BDE96BCDD13B23A62CE9BD8CD80647AC305A3371EE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617247533, "uuid": "42739e25-c62e-4f7a-a4c3-e68e857a0a32", "value": "6144:VHrUzOn4sBCPBVAPiPCpEpw0Nsnti0ZWcWJXqDYYkMLN/vEo:V4zO1BaBVAPiZ4BqaDYYkyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617247533, "uuid": "e1dbb758-0c6e-4c7e-b469-f943ea740120", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617247533, "uuid": "98a65f8d-cbd8-4150-a51e-4c316fbb581b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617247533, "uuid": "00f13978-df83-499b-a8e6-e55efd89caa0", "value": "61968c8debeae1e415a485c0b4d79b46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb4df67-92b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617259782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259782, "uuid": "00ae5713-5cd6-4958-be9d-cd995ebe7055", "comment": "Malware payload (Dridex)", "value": "c6549f97daafb454ce4d0f14677a2974", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259782, "uuid": "85f5c24f-7cd4-41ed-8373-90fba2949b22", "comment": "Malware payload (Dridex)", "value": "65d73842135b80326eff57c62c571956d8975e318798ec463bc9dafff4a2f15e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259782, "uuid": "a0d87675-6006-40d1-8c1d-a32a40984b8a", "comment": "Malware payload (Dridex)", "value": "3effd78f621809c3842c068caa042ffb2f4c2f0b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259782, "uuid": "a5e46f5c-e77f-43d4-a826-85b6630ef684", "comment": "Malware payload (Dridex)", "value": "b7c26deafcf86b15f86566e3b697a7f291495a20faa8eac17eab56d554a45a9e8274e46ab2a5d357bc7ceab55983d494", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259782, "uuid": "d3fee112-5c5e-4bd2-b8d3-ce491108781a", "value": "7714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259782, "uuid": "bd0eff06-e5b2-451c-a00c-9944fe0c3a75", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259782, "uuid": "b772948a-3354-4907-bf29-877fa7103e8d", "value": "3072:Ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:mpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259782, "uuid": "4d662ad6-3040-4943-9a4d-484e7926e11b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259782, "uuid": "77aea307-5df4-494b-a162-baf8c74e2764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259782, "uuid": "900b81e2-9e64-4494-a992-4f154df101d7", "value": "65d73842135b80326eff57c62c571956d8975e318798ec463bc9dafff4a2f15e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74489783-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617275251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275251, "uuid": "90d38836-2a64-47e6-b171-88a97ebb7428", "comment": "Malware payload (AZORult)", "value": "eb0f252b0cffb75c96739d309f622049", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275251, "uuid": "cf595985-9cbd-41e1-8d28-e90c612ba851", "comment": "Malware payload (AZORult)", "value": "65d873e82fc6d0e63a224589cdee5551f2d98c313e19adbc9799ef17ae493a8f", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275251, "uuid": "d8a2c609-3beb-4353-b2f9-3074ec90710b", "comment": "Malware payload (AZORult)", "value": "03ba937f9dc99c39bdc46630b08c1e40a619e977", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275251, "uuid": "58e1c2b9-2857-4213-b1f3-9446c4cad3b4", "comment": "Malware payload (AZORult)", "value": "7fca6652d9eb9ee28719e3a888d70ed44e81652d05c13bd0bd35a441564fd7030357f32c54bfd3410eb91c52c6c1ed4e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275251, "uuid": "0b441ac8-fcaf-48dc-8c15-15ad0706e168", "value": "D4F302AA16E0E4F7DD2701710DFB4AB7DBA6535433E90A0BAB404F4C7973987A94D223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275251, "uuid": "667cb341-0596-4657-b5c4-ecb69aa8f802", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275251, "uuid": "373c6072-3ad1-432a-95a5-0c365fe72904", "value": "3072:rf1BDZ0kVB67Duw9AMcTbDZpBzYcqbwKoTZj/Pz4sKfvZODUZ4P5zGtad/Q:r9X0GfDbVYtbMTZLz4TrkVGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275251, "uuid": "1ae57724-685e-45e9-b4a8-b66c1e76381d", "value": 159610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275251, "uuid": "c677bb68-6b99-491f-aa4b-6b63041a9fe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275251, "uuid": "f3b15dca-08d3-4e6b-94c0-efca9c56c431", "value": "2400174-0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8cccda-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617273894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273894, "uuid": "5f1d42cb-ce79-4e24-9ef9-7578add6f0b0", "comment": "Malware payload (Dridex)", "value": "fd74cc32ca2c51d3d2e3cf317d17db14", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273894, "uuid": "5941f30b-2b1c-458e-af09-180d57b3ad8c", "comment": "Malware payload (Dridex)", "value": "660a955a971e697de265e237962b99dd52089c27954da9690ef540b89e9a8867", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273894, "uuid": "b674b3a7-2c80-4ae7-bb89-c9ce2aac3f8d", "comment": "Malware payload (Dridex)", "value": "02abfd2c7f254de6ab38be924db3d86af4944afa", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617273894, "uuid": "5eb604c4-8062-4661-a66c-2112fe508649", "comment": "Malware payload (Dridex)", "value": "28def9dad6703a180ce33a2d26fa52b2e1a2dc9cce3613d0ce47d3cd538c5b9f99f0e60dc1d2c6c2da8631949ab0f21f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273894, "uuid": "e6737fa5-8676-4ff7-b133-f6a268b608f2", "value": "3514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273894, "uuid": "18c97f54-1130-44a7-a67d-8bd3ba16c9da", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273894, "uuid": "f2e8fff9-b632-43a4-9742-0cb5e52109c1", "value": "3072:nopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:opjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617273894, "uuid": "7d1f7d62-0f9e-42cb-9758-1eaa77ced456", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617273894, "uuid": "c74c0a5e-35f1-4183-84a7-a101ce08703a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617273894, "uuid": "62c95efc-cb8a-484e-b494-c5550dc320b2", "value": "660a955a971e697de265e237962b99dd52089c27954da9690ef540b89e9a8867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e7da39-9316-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617300858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300858, "uuid": "a1ffe4d8-9f37-4feb-8fca-37b627469980", "comment": "Malware payload (IcedID)", "value": "9c9ee9a97e3dc0da108f66874e320e65", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300858, "uuid": "0bc5cd28-35ae-4e19-b5b5-2d15b1f851df", "comment": "Malware payload (IcedID)", "value": "661ab84821d93104757d62a5a5d1ffda1d9e375c81d94a95a20f503c73bf9df3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300858, "uuid": "d85a159a-536e-4047-a7bf-f5d24e029e85", "comment": "Malware payload (IcedID)", "value": "8d6a3762cfd591e4beda62ab9327c9b22fedfa93", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300858, "uuid": "fdd029dd-002e-493f-adc1-f5b60abf8685", "comment": "Malware payload (IcedID)", "value": "bc9efa95f5a189d88cc8a5203305aa5c0bccda1e4d4f04f7389865c3fb4d8260b8e8ec3f17a5152bf4e7600cf1f68bd4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300858, "uuid": "0049a9cc-c347-4f0f-bd60-da74bd500b2e", "value": "BC04123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300858, "uuid": "a8f7025e-5275-4650-9575-8d8e553bccb9", "value": "3072:DXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:LE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300858, "uuid": "ea6f828a-42e0-47ff-b470-358f3d174d73", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300858, "uuid": "d99f7ed3-e365-4148-8498-31e7ea9edb46", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300858, "uuid": "fee8644e-6bb6-47fd-a4ee-e00d1143c0b5", "value": "71608606512-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eb09a2-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617259438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259438, "uuid": "c57d16ea-23e9-4e62-b9d1-f0ede1b68013", "comment": "Malware payload (Dridex)", "value": "e5333d93ddd790cf369ee3296d7aa454", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259438, "uuid": "2fab093a-87b3-49dd-89d5-64bd83d36348", "comment": "Malware payload (Dridex)", "value": "6632b149c44c5fce7eadb679e01ad3e3c6d3f7b0afe1f41f405a4a139daff759", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259438, "uuid": "ae54f631-5712-40d0-a13b-4362a0011eda", "comment": "Malware payload (Dridex)", "value": "37a8a3acf8ae9ef6666b595263f64d0d012966e0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259438, "uuid": "9429d55a-c426-45d4-8212-dcb0eaca6233", "comment": "Malware payload (Dridex)", "value": "04f3535fb330b69e3f66c3639e4c1e1ec598a5e0406836c8b44bd9c38c5ea1dd50081098bdb1509e38487ff890d377ff", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259438, "uuid": "3f402d0b-d7af-4043-b6bf-675aab9d06c2", "value": "C514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259438, "uuid": "7137e82f-0a0c-4cc0-b40e-843a2fc9366b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259438, "uuid": "53104228-38bf-49b4-acae-59957ca9557f", "value": "3072:Xopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:YpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259438, "uuid": "f962abc7-edd1-401f-abe2-92cc0ab7485e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259438, "uuid": "8ccb1b28-1f63-44e0-8f70-98a10a5d55e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259438, "uuid": "24202b02-4868-40fe-a973-d5c99b823163", "value": "6632b149c44c5fce7eadb679e01ad3e3c6d3f7b0afe1f41f405a4a139daff759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36029449-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278153, "uuid": "4d39dff0-d3e3-40ca-85a3-1021ddf22efb", "comment": "Malware payload (IcedID)", "value": "4f5923985c99cefe5a6b9d7effa76da6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278153, "uuid": "b0d7673c-62a1-4ecc-a86b-bf00255b838e", "comment": "Malware payload (IcedID)", "value": "6648be0447c5eaffa7fc59de5eba3ef242c931bdf093402e97d31b71a4bcd7e5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278153, "uuid": "125f3c07-ce5b-4469-b446-e76cebf6c698", "comment": "Malware payload (IcedID)", "value": "bf7a4bd6c0e231e1665e2ce47587f22633c95fef", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278153, "uuid": "305c2e4b-a825-4660-a61a-a37e68799293", "comment": "Malware payload (IcedID)", "value": "af084468a050ea3e0d19bee86d19144e0918d6c180bc03cb7cc4604da55c89f901b350213f38a49373fb81dea1147692", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278153, "uuid": "f5513016-9c5f-4f3a-9477-50f91cb51ea3", "value": "82044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278153, "uuid": "a2d0d60f-e354-48a6-ba4c-e344e1089bee", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278153, "uuid": "b33b34da-0b78-4655-9c86-8072c7346fbd", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278153, "uuid": "5b78b36c-fb76-4e02-a6ed-a5c796fff7af", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278153, "uuid": "fe6a9127-332c-4b46-ba3e-4cfc4d7e0e23", "value": "document-711183571.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f15c66b-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275672, "uuid": "31d45035-bdcf-4a6e-9696-677e48c53e15", "comment": "Malware payload (IcedID)", "value": "0421a1f876589919c0e4cae2cff65f24", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275672, "uuid": "b2379fe8-f4cb-4b8c-91d0-9764fa798f31", "comment": "Malware payload (IcedID)", "value": "665cf3ae0b690dbca71edddcc7daed647c5e073e7828d4ad42343e5dda13bb20", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275672, "uuid": "ac8bcf81-d50e-4208-9af1-cc8bd0febef2", "comment": "Malware payload (IcedID)", "value": "c9ae1cd07cb05efd11db062d0c9e68dde4aae8b1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275672, "uuid": "4dee1ec6-899a-4faa-810c-0f2b31d2a4f7", "comment": "Malware payload (IcedID)", "value": "7bf1d639af1df968f8a419f012b0917c561d6bfc7456fc2df8c4af9771398b52bc3f9f8d380ee4baa7bb37587014e948", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275672, "uuid": "66d24f85-aadc-4990-83a6-bcad4037ec92", "value": "D1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275672, "uuid": "551db150-7391-470d-a79f-558632d6627e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275672, "uuid": "1dffbebd-8e5a-42a3-970b-b58d39178ed9", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275672, "uuid": "ffdc2b8b-ba40-4191-b77f-60bdab2e814d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275672, "uuid": "187e3371-f442-4e4a-9f43-a6d238893238", "value": "document-1283259960.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f04c1b-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280884, "uuid": "4499aa99-8aa4-4ba3-b8c9-689c466a509c", "comment": "Malware payload (IcedID)", "value": "7b8971a2a06504fd03cd5fde264fa7cd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280884, "uuid": "50ebfa44-8912-4e04-accb-6df9c9e3768e", "comment": "Malware payload (IcedID)", "value": "66a7a22f84ff9b570e22ee15497871a921909b0c5532031450d436441d4b8c19", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280884, "uuid": "83e326f8-587a-4a20-9e67-893a727e74d2", "comment": "Malware payload (IcedID)", "value": "f7e81496fb943564d665f0852eba0a07ca384975", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280884, "uuid": "0f71dbd5-cef6-4fc6-b1aa-e206007b4e7d", "comment": "Malware payload (IcedID)", "value": "52b8ec3fc31ab39912810ff7c37b8d0687ef142a56e335ec774d32c91342c52d1bf43f7f4445fc9c8d644824e9fa0375", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280884, "uuid": "4f860343-6296-440d-bdf0-ee8c385b18bd", "value": "3C044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280884, "uuid": "fa5d5223-526b-40d8-8d6a-959ee7b300f2", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280884, "uuid": "ff473ced-a1c1-4b55-bf4d-1ca2effd81d7", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280884, "uuid": "caf81688-9073-49d0-abf5-075be28465d0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280884, "uuid": "e234c04c-1812-49da-a3ab-5b0a670821b1", "value": "document-1823249151.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef1eb3c-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277497, "uuid": "b9047163-822f-46e6-9b5e-8060aca969e2", "comment": "Malware payload (IcedID)", "value": "83714fd9c384bfbc0df864ffad8b1586", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277497, "uuid": "72d2ee29-de7f-4b56-8914-be758f488183", "comment": "Malware payload (IcedID)", "value": "66dc023d0313df7e14c620766dd2ed021b488bad646e3727f5602f15b0debcde", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277497, "uuid": "dd31804d-1a3e-4bd8-993f-2ad7f8bdc64a", "comment": "Malware payload (IcedID)", "value": "e24bf69e67ca7c8e7c4ab732a88f2fca09165e66", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277497, "uuid": "f9d48b82-1ee7-40cc-b361-34a4ae81d950", "comment": "Malware payload (IcedID)", "value": "c147e68bf85b41d4515a9db91514bd3a6ef49b0810f666ae836a8c815099a5dab9177d0bdb06d6835fb137d8a9f25276", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277497, "uuid": "cc34434b-74a0-457b-b7c7-8af0a858b81e", "value": "C1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277497, "uuid": "59637278-7ca0-4b11-adcd-7b06162c8e34", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277497, "uuid": "c5ddf9ad-8a74-4f25-9304-852b0289a5ff", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277497, "uuid": "7ce95908-fc98-4b8b-adc6-3ed2f569be8d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277497, "uuid": "df28deae-ab46-498d-b5b0-bfd974999ef1", "value": "document-1175343670.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5016c3e6-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279915, "uuid": "61a43fbe-e1df-4a83-b73e-28a8d364978f", "comment": "Malware payload (IcedID)", "value": "b87aa561ee44c4244095e4c420b682e5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279915, "uuid": "1564f6e8-341b-45b8-9d1c-fdbc24d002f1", "comment": "Malware payload (IcedID)", "value": "66e3b801ec62c6fcd9dc4f21c0a8675b7de88b8ff3b8a06a9dbdad3b297a6857", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279915, "uuid": "34a366d8-3d2b-4cd1-9bf9-c3fe03b2e7bb", "comment": "Malware payload (IcedID)", "value": "cd70534dabb775aef2bc504ec996ae3adec01c3b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279915, "uuid": "e4aa46e7-4467-4842-b246-3a52e5788778", "comment": "Malware payload (IcedID)", "value": "82f093010c32683d179fd80f557ff0b37fb586bb5adbf323253072d30f4a1550e0ecae3b33683087d7c0ffa199f267f7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279915, "uuid": "48a2576a-6735-4fa1-84b4-136cb62cc443", "value": "D0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279915, "uuid": "fe041fba-c748-47e5-920d-53b8ad986575", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279915, "uuid": "cea757c0-4ffe-44dc-9111-862d24d537bc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279915, "uuid": "873a2848-85cf-4414-8895-8203fef002fa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279915, "uuid": "b9b0c7de-f1ec-48db-bb0f-960b34006a97", "value": "document-1686823268.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93728ab-92f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285353, "uuid": "99383095-37c3-4eb2-98dd-5ffd02b88716", "comment": "Malware payload (IcedID)", "value": "e5ff5b5d69f3cc637a7aa33b21dc044b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285353, "uuid": "223cdebd-9638-4817-bc51-044428b39aad", "comment": "Malware payload (IcedID)", "value": "66f9e76cae19b0e464006a7dfaf5b27d5c01f6142caa685d6de08e7eb11bcc15", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285353, "uuid": "1efe884d-9bf1-4e97-ac70-425f80d10ae6", "comment": "Malware payload (IcedID)", "value": "98cc3175a9f3218596a43831b5d2e6c92ecd5702", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285353, "uuid": "87406291-9267-4216-9edd-6c421a50fa3a", "comment": "Malware payload (IcedID)", "value": "974b9b4b33bf57e8d9024226a8f060ab2dc14f7929d8ad373ded9a9a980216a312487a46049af53d63e6b35ecfa49d37", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285353, "uuid": "39aabbb9-b7f9-431b-81a4-fd579b30b527", "value": "80044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285353, "uuid": "dada10f0-8479-49f8-ab96-852f01d22c2a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285353, "uuid": "91c27207-7c2e-4062-bbbe-ddf3eeedfa31", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285353, "uuid": "d6669cca-97f1-4a12-adbc-a0f33646555a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285353, "uuid": "bf37f36a-0ddf-4831-a53f-873b002d8b63", "value": "document-2016202499.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21a5844-92ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617282307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282307, "uuid": "ab2bf265-3b00-4918-aa5e-1844c668422b", "comment": "Malware payload (Dridex)", "value": "01bd866b3d05859434753861608a97ef", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282307, "uuid": "0a9df59b-84b2-4dc0-8a27-949eaecb4a85", "comment": "Malware payload (Dridex)", "value": "67220687c7530ba07874d84fd3407ea3634b88ed6b38f8306fefd22aef742068", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282307, "uuid": "f82835b4-45b3-4ebc-9a05-4681e263d963", "comment": "Malware payload (Dridex)", "value": "f9a6ec74a32cc554223795fd88927f1df049f1c1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282307, "uuid": "1d3ef68b-30f9-47fe-afaf-2f8c0faa950b", "comment": "Malware payload (Dridex)", "value": "acec241979ce7c91296f693c4edc9063fb10ce733fa7496acbb0bc92c43214ca9f960cde4325acefc9a6cf71d9270bc1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282307, "uuid": "675b9ab7-9f13-4f3b-9e2b-c7568acb98fb", "value": "A714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282307, "uuid": "55ebcde7-a3dc-4cf0-8a53-e658b68e95b3", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282307, "uuid": "eebec2f0-033f-4dda-a14a-149668131c2f", "value": "3072:l1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282307, "uuid": "9ca3c6d3-680a-408a-a2bb-dd3aa06d8142", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282307, "uuid": "075a83f0-914f-4963-8e24-05ba81ed7b67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282307, "uuid": "4a767e92-c857-4cca-8088-9c9bcb5567fb", "value": "67220687c7530ba07874d84fd3407ea3634b88ed6b38f8306fefd22aef742068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49a469b-92af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617256891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256891, "uuid": "a74b5850-0bb5-4e8f-93d9-a0e01817465b", "comment": "Malware payload", "value": "e4bcd2a6e39dbe93ab06d920c4f49bda", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256891, "uuid": "aad2ee2f-b0ab-46a3-baf7-992cc4092ff0", "comment": "Malware payload", "value": "679758529fb91fa120d1ae7eaac273cf2ac6f3fd5c0e809ad5eec319badc3f15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256891, "uuid": "7b9354c1-d426-4932-a961-8e456fb33ceb", "comment": "Malware payload", "value": "44d8556b9b99a44b016b3046a4f3b55d9b124dca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256891, "uuid": "22ee8583-dcbe-4d2e-bae8-cee92912d1fd", "comment": "Malware payload", "value": "4d351c075f10024c16d0b52672bc285f7ad93e7e96b5938762848fbcbda296cdfa3f1424897b70474d281b9df2325be7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256891, "uuid": "4019909f-9854-4b50-91be-3ece1d35c045", "value": "A09423EE47833B51EB35E13E193E93D27E8191076042C9A67608501ADCDF9EA807F9E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256891, "uuid": "61c9c37e-7282-4c87-be8d-edb0453ea730", "value": "12288:+r2NTSDRxaInKYZ+8165nYV1jS8yTOQZy9:+r2VSDRYInKUd165nyCty9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256891, "uuid": "9e0d3678-bdb3-4f48-a2c6-8e97fbec6c74", "value": 447974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256891, "uuid": "b5d91048-0452-43e1-934c-18dfd6f7c6d2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256891, "uuid": "96131cf4-44db-4839-b163-e918fa4598b6", "value": "Documentos de DHL..PDF.....gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842f113b-932e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617311356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617311356, "uuid": "3434b10e-2d0d-4221-bd5b-c17e55dc6caa", "comment": "Malware payload", "value": "d35eba13efc610162ef5867e79478642", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617311356, "uuid": "080f1667-0b93-4c3c-bed0-7943039de2cf", "comment": "Malware payload", "value": "679f9986dc37567e0bf3f08834702d1176f472c48e288eab6c61a927508be2ad", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617311356, "uuid": "d2983f06-4718-4cc0-a0e8-18c8d25f5c4d", "comment": "Malware payload", "value": "ecd320afe4712a9ce7892d4ccc0eff4cf8aee2eb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617311356, "uuid": "7ddbc60d-4c8b-4f69-abf2-20953545ab16", "comment": "Malware payload", "value": "f91f896f42653119ab8a0f2009a998b76e6a60b89363a735c54a723158d3a086f1d04f607719aa88752eadb3256ea37e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617311356, "uuid": "af7e0016-bf3d-4c3c-a31f-dd7e29eb29db", "value": "AD14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617311356, "uuid": "0cb5f79e-299b-4ca2-8e6a-77c41432ea9b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617311356, "uuid": "6824117c-37e0-4a95-9b9a-4209663560ba", "value": "3072:oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:fpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617311356, "uuid": "1e45bf64-31b8-48e8-9e0d-fa2e792bba15", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617311356, "uuid": "52d02edc-9bbd-4ce9-ae91-103e779c0846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617311356, "uuid": "fb6be109-5c67-4049-ba3b-e021dcf9003d", "value": "679f9986dc37567e0bf3f08834702d1176f472c48e288eab6c61a927508be2ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6922e7fb-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276950, "uuid": "634f8068-179c-4ea6-8666-4ab1a6d0747c", "comment": "Malware payload (IcedID)", "value": "bb3ac61ef78240135612feb1db0f9198", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276950, "uuid": "dc05b151-982d-47b8-8ef8-fc62eecae13f", "comment": "Malware payload (IcedID)", "value": "67cadeb2206992dbe8ef1bd4dda7492406acfae6f7d740604d2ddba3f674e91f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276950, "uuid": "31c95512-5515-4b41-80de-a49bfe5727cb", "comment": "Malware payload (IcedID)", "value": "64c9d85e906489d9335f5e3fb234cdf38b04b11d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276950, "uuid": "ab0dc2d3-9c99-4cae-81b5-49fb9d536adb", "comment": "Malware payload (IcedID)", "value": "4400d21033ae7667189840fc1897ad4b28741bc924bd71d4f34eb949204ff4f40e133633e22e51ee66558882ecb6b175", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276950, "uuid": "d55eb7c2-d1a6-412a-9384-aa0e11e0f876", "value": "D8044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276950, "uuid": "052037c5-94ee-4a58-b829-0a194e6a115e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276950, "uuid": "83844a94-1c50-407b-be8c-bfe47dbeea3c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276950, "uuid": "205a4126-705f-42c3-9c07-a1c8626e2065", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276950, "uuid": "a3b933a1-3ccd-4b13-a69e-5a089c253410", "value": "document-1908172520.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fa85f1-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280972, "uuid": "8af99f66-643a-40c3-8e4d-a9f0bde00fce", "comment": "Malware payload (IcedID)", "value": "5f4b6d46ab63a7eb2db2f6e6cf6f55ab", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280972, "uuid": "9a44bd69-6ad5-46b7-8cf9-b9a13cfc9173", "comment": "Malware payload (IcedID)", "value": "6827aea112fdbc26f6eac7987af3ecba3208288d893284b4fbcb382437a52150", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280972, "uuid": "4ea5c9d6-c482-40f6-a11a-c7a1722b786d", "comment": "Malware payload (IcedID)", "value": "16a54d76251bbf19baaa1e9a620c7d0762454e4c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280972, "uuid": "59578a35-d55d-4b78-8bf5-c1fff8ff94f4", "comment": "Malware payload (IcedID)", "value": "fa5827814ebbad4f19af2a87c5cbee23291667cd383b674720a14a35685a268f07071b590ea5477127261d179ed7ac2c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280972, "uuid": "949da71a-0fcc-4793-9df8-98a5c577925b", "value": "DE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280972, "uuid": "0e6b4385-63b7-43ae-8c7a-5a08e3cd54a5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280972, "uuid": "02c32490-4fcb-4583-bd7f-f519567c8ca9", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280972, "uuid": "b17cf19d-5e6e-4c86-8bb1-ea70d0b1b416", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280972, "uuid": "8d37f040-484c-421e-ad34-b0cc832e5def", "value": "document-1105001169.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d95593c-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288581, "uuid": "ea95b6d4-2b78-4ddd-b988-05e05a3286da", "comment": "Malware payload (IcedID)", "value": "8cbd4123d113470bf6bd4a09d4aee844", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288581, "uuid": "e663cafd-9fd2-4039-ba07-ab62f837a5f3", "comment": "Malware payload (IcedID)", "value": "68370744e2eac55a85b4bfb9256dfbc367d6a93eec9cb46ad07c1f3c77523582", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288581, "uuid": "4273d89f-8235-4dbc-bf2d-ca95262518bb", "comment": "Malware payload (IcedID)", "value": "b445c6f58b16dc4ea1b1e7e18ec7a57240c37650", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288581, "uuid": "4746a37c-2a40-4bb2-b8aa-9c24cc5b942d", "comment": "Malware payload (IcedID)", "value": "9f5a677a0d5244da9505876e0b7a0c68ee7e65a08e3e2fe515f4ee56e0ee788e96bf13ef71db9d59b32b1b9719958b8d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288581, "uuid": "058651df-fdfe-4a4a-86a7-4e1eb38ee463", "value": "23838CCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E4D42FA40A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288581, "uuid": "1b6af6d2-5deb-41ea-b15b-78d32ed687fb", "value": "1536:IB240XZfcaaxf+EQliU2hawlCAIoo8+BNvMhfvYh:+2d1cBWEQXMl9o8+nEhHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288581, "uuid": "3492b63e-83b9-4a9f-b3e6-808cd162cccd", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288581, "uuid": "68f09e6c-a72d-48c1-a63b-4bcc69020963", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288581, "uuid": "311751a9-bfd5-4245-be3d-291b175cec77", "value": "871.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027ae29b-92a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617251438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617251438, "uuid": "294f6415-4c00-4417-9555-480ecbb5a682", "comment": "Malware payload (Dridex)", "value": "51e327d0834dc15831e22106335fb390", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617251438, "uuid": "a4fefde6-e2c0-4ad6-a60a-e4933e6e4c13", "comment": "Malware payload (Dridex)", "value": "684d8965b0c44b038b13145fd8dce0b163129a535389bbd497493f6f52e7d876", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617251438, "uuid": "f3959059-c39d-4edc-997c-e59ffe2792cc", "comment": "Malware payload (Dridex)", "value": "c8c858c60cc470e706d5fe114790ba5a2a404441", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617251438, "uuid": "0588078a-8d97-426f-9552-3f15ad32d5e2", "comment": "Malware payload (Dridex)", "value": "fde3104a4ab9a3fbf55a3a34100a6f77e2434078c7717a2496799d2632e0ff39a29223579871d9ed73936b3be40fa168", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617251438, "uuid": "97b31f1b-ede4-41f2-81d6-c3b02cf455fd", "value": "23248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617251438, "uuid": "627aba9e-fe0b-4cd7-a305-560c5772da1b", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617251438, "uuid": "7e8152e3-cabe-4167-ac13-26d9919b96f8", "value": "3072:T6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ToMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617251438, "uuid": "7fa4287a-d734-4a4d-a716-64c7c42ba169", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617251438, "uuid": "4d94d072-40fa-4c1e-a11a-92dd859b391c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617251438, "uuid": "24121e89-fe1b-4af9-8049-2c09c4c73b91", "value": "684d8965b0c44b038b13145fd8dce0b163129a535389bbd497493f6f52e7d876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c077e4-92f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286546, "uuid": "af9d7bd4-9d9b-408c-861a-5efd5186b2d3", "comment": "Malware payload (IcedID)", "value": "73bf2ad06a9956a99122af73cc57dac5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286546, "uuid": "86763717-7d2e-4018-afdf-7e065b5e8c4c", "comment": "Malware payload (IcedID)", "value": "68b9d35f6f2bd5a548ff0181dfa8734ba9d6345fd456afa784fd79b66c1ff7d9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286546, "uuid": "834bbff5-821b-42ff-b70c-1fb032ca6217", "comment": "Malware payload (IcedID)", "value": "7d88ea77bda6dae40eb4b225f29ca3e81db5093e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286546, "uuid": "1787ad35-b6d6-4da9-9758-7f55bcb00c2d", "comment": "Malware payload (IcedID)", "value": "081a298ea01605896f40e524d20d86054eea3d0641619b1c5f52322747e58a58855846208c726e255e837f764296bbfc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286546, "uuid": "12739738-7dba-4834-bee1-1ee8fbdc0c96", "value": "41838DCDC913E1D9C2559FBD5A0A308511F4E0B7276FF11B148EAA2E0D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286546, "uuid": "4bdd2cde-6255-454c-9624-50c562581a39", "value": "1536:IB240XZfcaaxf+EQliU2hawy/CAIoo8+BNvMhfvRm:+2d1cBWEQXMy/9o8+nEhHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286546, "uuid": "5dc26ad6-9524-4d2e-9bde-d3496be638de", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286546, "uuid": "569ce5fc-fb33-4d0f-a850-39205e5f596c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286546, "uuid": "710a44d0-6171-4ce4-990a-92ee738081b8", "value": "670.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd71711b-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277521, "uuid": "db4887d1-2cbf-4b23-b700-29d8e96ef170", "comment": "Malware payload (IcedID)", "value": "92e46f878cff4307cd1d430caf206fec", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277521, "uuid": "9bce485f-60b5-4992-a96c-d43829c778a0", "comment": "Malware payload (IcedID)", "value": "68da45e5d1e19e722bc9c3ea4acb334d39cdcc4a45a3e43b6779ab7fdd5cb62c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277521, "uuid": "a67cb5fb-0626-454a-b372-d1457755d3a6", "comment": "Malware payload (IcedID)", "value": "1daf3aba06eb1385e9bd62d9781ce1d00b26b391", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277521, "uuid": "ff80cd67-4137-4f23-86e0-0295fe8d19bf", "comment": "Malware payload (IcedID)", "value": "9d3d8c6debfb8dad0e6bb66119611d3950cf6e5d918677752c71fc67265f81193917de18ac9e546f80ba4bd8076e36d8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277521, "uuid": "90b04206-3355-4ad1-9279-aa6e552ab32f", "value": "D4044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277521, "uuid": "071b3d08-726d-4a5a-8546-5286ca50834a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277521, "uuid": "bd0464db-c5d5-4417-b80f-40651b8499ed", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277521, "uuid": "123559f1-8be6-41c0-82db-2c1bc539a2c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277521, "uuid": "a3aa1ff0-3e87-4a8f-8583-20f02226d211", "value": "document-1823566584.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f540ae3-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288584, "uuid": "04c9d8b3-ac2c-447a-8251-9893b0b87b8a", "comment": "Malware payload (IcedID)", "value": "b48109d5fdb26437ef886bdca2a98c87", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288584, "uuid": "7ebbd982-a962-466a-a979-064b5766821d", "comment": "Malware payload (IcedID)", "value": "68e36c32f20dda6a915d5edd650889789ef83d11dc363bf7029262485d07083c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288584, "uuid": "a11f07ef-54f5-4094-aad1-62a07c4d46e9", "comment": "Malware payload (IcedID)", "value": "1fa8287d3c0cb98fee1ef57bf1838a3bd7a51417", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288584, "uuid": "3d67cbae-9d2b-44ab-8726-5032f355fdcd", "comment": "Malware payload (IcedID)", "value": "d49deac246d766800d5e204de3432bb09c0a9a0e2b83b1cf542419822410046743584710e1c2b9facff9b0d7b3a36b70", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288584, "uuid": "bf2c597e-8a19-4630-b959-7afdc07dc79b", "value": "38838CCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288584, "uuid": "073496d0-148a-4224-85b6-97763c8f31a9", "value": "1536:IB240XZfcaaxf+EQliU2hawZCAIoo8+BNvMhfvn:+2d1cBWEQXMZ9o8+nEhHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288584, "uuid": "f4be963c-0734-49ec-b680-89462fc57b90", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288584, "uuid": "b6c2710b-7f99-472c-8ec2-be588b8f59b4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288584, "uuid": "249ead7d-1e50-4f62-88d4-7b532d444fa2", "value": "2928.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456641ce-92fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289775, "uuid": "5c3cb13d-8c0f-4149-8cb7-5074a1f3f242", "comment": "Malware payload (IcedID)", "value": "087bab0de4564d7b219f75b13a02ef19", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289775, "uuid": "f812079a-de29-4e54-9093-656e39848364", "comment": "Malware payload (IcedID)", "value": "69045abafd905bae9cab236e665b7d0e79f3f7c09784a449be456df0b7b71789", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289775, "uuid": "24d5edcd-c3c3-4e41-b458-5c814e6fa969", "comment": "Malware payload (IcedID)", "value": "66be5895a4ae2df44d93764a20cc3fe9d37c31af", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289775, "uuid": "20f014eb-6956-487a-a069-d9cfecd52ffb", "comment": "Malware payload (IcedID)", "value": "2ca65befff56bebfb45b9ab67c8b9ec0b0cc3dcbfec08c2f4dfbbf68fbe75d91645c82fa3225e5d2a1981070938a8f18", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289775, "uuid": "33ae6034-c2e7-4d04-a124-cc149d19ecfd", "value": "9D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289775, "uuid": "5b643bab-87e6-4d54-8bc3-285210b70f81", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289775, "uuid": "c62a550d-8dcc-4a6b-b3ee-29f9eab8108e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289775, "uuid": "ac305072-a8b0-461c-844f-37bbfa588604", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289775, "uuid": "4d41c1e8-246f-4916-b3f9-626c30f114fb", "value": "document-773689710.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a0cb95-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281721, "uuid": "c622f282-faca-4499-b0d0-36ed1a5d3905", "comment": "Malware payload (IcedID)", "value": "0ad4f9a56a7d16835d4839b429cfebf2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281721, "uuid": "61b65c4c-7dc9-483a-b130-06af7366cbb3", "comment": "Malware payload (IcedID)", "value": "6913eea81afdfd8739cd506962bee336c8788f9b0edd2cda6887825cef7e1d7b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281721, "uuid": "82a3c6d7-1f05-4e39-98e6-40f421696509", "comment": "Malware payload (IcedID)", "value": "a9bf0914d9ac5f5d5558c5d7443c38ab057b3a8b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281721, "uuid": "2e37cf82-69b8-4b46-a608-ab3cd3800543", "comment": "Malware payload (IcedID)", "value": "9032c16ed50c178ad7406a600c4fec74e957847ff518c0a9d5a966ef0cd19987a3f1ab1e69dcebca723669c7abfd76ec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281721, "uuid": "eb382b67-43a7-463f-b825-e5e751370205", "value": "83044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281721, "uuid": "9889460e-ba8d-4e34-85ba-ff38c23eaf4e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281721, "uuid": "b054add4-b819-4099-8519-3cc77ab392a0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281721, "uuid": "ab4c8d52-4233-4e42-bcc6-eb54f852c61d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281721, "uuid": "349d8562-ccbe-4ed0-b305-2d6979453f8f", "value": "document-1455377818.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac551bb9-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274057, "uuid": "8df1f0e6-2b19-41e2-8120-2c0fd40a7e27", "comment": "Malware payload (IcedID)", "value": "c932625317a5397288e4817b76ad7e89", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274057, "uuid": "3224fde4-0b54-4c26-973b-7be6b47163e7", "comment": "Malware payload (IcedID)", "value": "691fc317e4c4286908b96438f67eb7c8d58c18347a7e2236db918c55fc0a515c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274057, "uuid": "3bb554a6-505f-4d9f-ad1b-41eeceab2749", "comment": "Malware payload (IcedID)", "value": "9d5d5a7c9a406a584a1524fc87cad81639acf0bd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274057, "uuid": "84dcef99-e26f-47e7-89e0-fd892403efc9", "comment": "Malware payload (IcedID)", "value": "213343353c776359fdf968e97ee7537abfafd6e5050079026503b934fe48da10f4d672a84e4f621d3ece5d889efba36a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274057, "uuid": "a1bd6595-17ab-4e48-8f78-146753ed2693", "value": "A0044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274057, "uuid": "908522d0-8373-4658-8658-15a46a3b950c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274057, "uuid": "7a567166-7a32-4159-8625-84c6338ccd15", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274057, "uuid": "0920832a-531e-4afe-9280-2296f30130ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274057, "uuid": "1a4bec9e-6a40-45a8-b878-107a3eb5ab0c", "value": "document-665060773.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3770b276-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617290181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290181, "uuid": "27a1d9bb-0df6-4b8f-a682-74c9dec580c2", "comment": "Malware payload (Dridex)", "value": "d39b22f7326c6e5e2c16a9100232e4f3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290181, "uuid": "05570037-16cc-4d3d-9cdd-d940778e6bd5", "comment": "Malware payload (Dridex)", "value": "6924c5bf9e86e55eafdef65b244620e4717049603dfc7fea0d644c3bbe73b3b8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290181, "uuid": "ed4d25de-a778-49f7-bdf7-b1fa0e3886ff", "comment": "Malware payload (Dridex)", "value": "99bab530f37fc42416338f2efcff36e9cac50515", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290181, "uuid": "04a04727-f216-45e9-8279-763bc2bb0103", "comment": "Malware payload (Dridex)", "value": "1d9b024c3610cec0f36491b4f2a0f9c660f235903aa35263ba373328390ac83b76d7d65c3bb425fca95e0632370dede4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290181, "uuid": "b0aead68-aa95-4fbc-be4c-bf15105bd19c", "value": "38248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290181, "uuid": "2f2edce8-4f3a-4202-a047-49d3f8917960", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290181, "uuid": "d26569a1-14e5-4528-9a26-ce68adbc9714", "value": "3072:F6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:FoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290181, "uuid": "a380c709-eb82-4acb-841a-d53a2bf4cd3d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290181, "uuid": "ed833dca-bfcc-4957-b6b1-1b82f7fed616", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290181, "uuid": "e1167533-ad8e-46f9-af31-d24911d8b0cb", "value": "6924c5bf9e86e55eafdef65b244620e4717049603dfc7fea0d644c3bbe73b3b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6ef878-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274053, "uuid": "b780e724-afdb-4110-b49c-af49b94e6eac", "comment": "Malware payload (IcedID)", "value": "3f154c69195c25452ba9ef8d7aaa772a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274053, "uuid": "98fcb560-74e2-41f8-ac6d-9febb6a637e9", "comment": "Malware payload (IcedID)", "value": "699a582c6f9622cb0a5350ba32dd61db86811d4b93e4fa1603ac2a1026061b90", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274053, "uuid": "a7110822-6543-486a-8615-bf5c3d64bbb7", "comment": "Malware payload (IcedID)", "value": "8c41fac4761c07c69d35d23c92bdb1134ea37ad5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274053, "uuid": "9e93319d-19a0-4933-810a-779c2055474c", "comment": "Malware payload (IcedID)", "value": "ce45fd855529e887eb3ebfd5e887c7972beb1ce893f67e06e39b05a14e04430547d43d995cb18efb5a55167caad88ee0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274053, "uuid": "1579d88f-efa7-476e-86a0-261d1590a6ea", "value": "51044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274053, "uuid": "185076be-fc52-43af-9e39-4b52e1f47c01", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274053, "uuid": "fe1a476d-fe26-4172-94fb-8e59dde11402", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274053, "uuid": "374eb802-b312-43b8-ae55-0c70c6201145", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274053, "uuid": "e238a5d1-a97c-4f40-b8cd-6f075be09b49", "value": "document-458995832.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d618caf-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282944, "uuid": "3496c958-7e85-4018-83e9-6df5ba76f55a", "comment": "Malware payload (IcedID)", "value": "1470d77d50afbbf1e1288f78d057d575", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282944, "uuid": "f1f3b980-6dfb-46c4-b73e-064598b4a798", "comment": "Malware payload (IcedID)", "value": "699c3abfea650e14c2af5addcddeb8c5cba8eed8eb3339521e0e06763fc29b16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282944, "uuid": "9bdc01c2-13cc-4f7a-9672-dfb4a1d85472", "comment": "Malware payload (IcedID)", "value": "4b67bb6dff377f7f78f73edc4aee8f4f6271b8ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282944, "uuid": "c1c7abf6-c074-4a66-be13-58b7c5cb9c2e", "comment": "Malware payload (IcedID)", "value": "09de2186e28116c8e09819f30001883165f53bdb29c777522ab33663f4448f2f8acccbcea0fdb47928eae26b6b263c2b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282944, "uuid": "d84f3175-e652-4de4-8771-983883a26e46", "value": "4144C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282944, "uuid": "33459382-b6d1-4b0b-a2cf-624c6429e2e5", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282944, "uuid": "9ed62228-e844-4030-958f-6116908a07e1", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282944, "uuid": "7a4dd019-bb92-461c-8cb0-e1b702bc2bb8", "value": 259835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282944, "uuid": "ee9c522c-2348-4370-a2fa-a9ae67a0117d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282944, "uuid": "ec92b424-99cc-4c9a-ad50-520bae0f524c", "value": "1470d77d50afbbf1e1288f78d057d575.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2fde73-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617298969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298969, "uuid": "9f18c1de-c48e-426d-b15f-4bedcce01d82", "comment": "Malware payload (IcedID)", "value": "d4793b0f85e8dd0697cdf9e764e0fcd7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298969, "uuid": "322f3d92-a8e0-4ea8-a651-728649724b73", "comment": "Malware payload (IcedID)", "value": "69b1750ce8e0b0acc15c30918bf710bfb4b453b94c666d9947d4d179fd682130", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298969, "uuid": "a1895dbe-0a9e-4802-8088-3984c844fffb", "comment": "Malware payload (IcedID)", "value": "e16dbc9ccdde0dc6ee2ab17aee0d8dac79ca978c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298969, "uuid": "b9bd74ef-dec9-433d-b768-347d9844bcd3", "comment": "Malware payload (IcedID)", "value": "a2f53cec43db4cd2f90996cdd277dbf075b6de7e40abd09d5bda8795baf674dd3776b98d0a80611c222552861009451c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298969, "uuid": "10a1e172-0d8b-48c1-b6c0-8ef4d67c5066", "value": "4E838CCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298969, "uuid": "198c028f-9aa5-4dcf-a1cc-f695957fd9fe", "value": "1536:IB240XZfcaaxf+EQliU2hawrCAIoo8+BNvMhfvSI:+2d1cBWEQXMr9o8+nEhHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298969, "uuid": "b6b7069b-988b-4177-a3fa-f67cc4e63f8d", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298969, "uuid": "0ae59a8b-75cd-4099-aa46-9228d7391013", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298969, "uuid": "0f387596-d0df-4a1e-9ed4-953a37def68a", "value": "1989.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8a1b9f-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617294755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294755, "uuid": "22c6ef11-3d4f-4d97-9c90-b160528a417b", "comment": "Malware payload (Vjw0rm)", "value": "1b35f717f4fb2916d4f2a8df50e5313b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294755, "uuid": "90cd54d8-151c-4a34-8870-ccb8e28106e6", "comment": "Malware payload (Vjw0rm)", "value": "69c51cafad5ae7fa8b0eb17d6a8cdb521356e1cffec1bd772989bba874f3b352", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294755, "uuid": "a03ad53d-c510-4e1c-bd81-a27d6bd11fa9", "comment": "Malware payload (Vjw0rm)", "value": "078f27b1024c5287408339fc760e5aec6674856e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294755, "uuid": "717eea83-11a3-400a-b1bc-b37cf266e94a", "comment": "Malware payload (Vjw0rm)", "value": "10fd190e9d911f9e20fdd071ad02340f6495c1d1158e6add5f526d63622e09179c6446df53e404f19730ade46f42653d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294755, "uuid": "b7aa0ba5-96d3-409e-8b96-5f228a6d0061", "value": "AB93C6FCF1050F26D392615C89DE0A1873B3E762F5E9DF05666C2609C1DE92B438AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294755, "uuid": "9c5b4f6d-258d-4fe7-8ac6-1ff8e6a605aa", "value": "384:RDBbuI6/6lz5K6Zy24jHuHqWWpBIHKSql:RRu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294755, "uuid": "80b78283-9a40-4586-ae4c-0d2618e2e840", "value": 94258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294755, "uuid": "bc7a8391-4b0d-404e-8b26-d18a4ca3fb04", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294755, "uuid": "1b3995fa-7370-429d-b1cd-e95723f0b8c3", "value": "kfjforderreceipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdd8015-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275049, "uuid": "fdd7976b-f4c8-4225-be4c-dedc8711cf19", "comment": "Malware payload (IcedID)", "value": "beade4fcf64679b20f157c9d468e74e9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275049, "uuid": "1995620b-5d7a-4dad-afb8-349f53d9b355", "comment": "Malware payload (IcedID)", "value": "6a9ac49824c59191a2f8a910faa7ce768c947cf574bbb08ced6551e51ee3bb3b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275049, "uuid": "4c4361fc-c6ce-4daf-862f-58c606330280", "comment": "Malware payload (IcedID)", "value": "a4e1b33697be17b30b1244c79b353e4a89eddfd1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275049, "uuid": "b3f9d8a3-7396-4669-8544-50d93fb354c4", "comment": "Malware payload (IcedID)", "value": "183ec1bf7c55cec29e260fce8d5b4ed95456de8bf37b144a2d422b275073813b9216908b87b079bea7fe1b8f6a5a9d9b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275049, "uuid": "c571f80f-52eb-4f67-8707-645649ff91f7", "value": "14044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275049, "uuid": "b7a9e6f6-b60a-48a4-a7ee-68cf1df3fbc0", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275049, "uuid": "3bf467b9-80ca-413f-9c8a-5372d1906bf5", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275049, "uuid": "b234ab6d-ff94-4d0c-8087-e7deb5c9c968", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275049, "uuid": "9da3cc59-be45-4115-b661-00859221e9ce", "value": "document-378651067.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b021f05-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284282, "uuid": "5d0cd279-5184-4747-a239-346af63f235f", "comment": "Malware payload (IcedID)", "value": "8e335581a016f29837063922c710924f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284282, "uuid": "041ea0e3-4cb9-4c40-8586-2d3a5364362b", "comment": "Malware payload (IcedID)", "value": "6a9c0ad5fdbc3565af43bcd4d928337d47b853e6deb168143f6c684d991cdfe9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284282, "uuid": "21c9bc08-cf36-4a08-9c27-86e56cafc14b", "comment": "Malware payload (IcedID)", "value": "0dac7b7416e295d1d99dee3cc99950e378183e63", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284282, "uuid": "db8ebb4e-94b3-4faf-a240-152f455025f4", "comment": "Malware payload (IcedID)", "value": "df8146472031d648c1c3c1aa67e9e63aa61b308a0116190e654db017a0dfc96a6bb7501cd1ac75998b612757a00fe96f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284282, "uuid": "667addbe-6420-40a2-9ce9-e548f020108a", "value": "9D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284282, "uuid": "74e30f90-d18e-443a-acac-af41b544e384", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284282, "uuid": "a254d21e-ffaf-441b-ac20-38b9a1cee0db", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284282, "uuid": "f3bf5272-69e3-466e-adae-2c5995e33dad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284282, "uuid": "0920409e-2f5a-499a-87ff-31416b1adfd3", "value": "document-839471064.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9418af-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617290455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290455, "uuid": "1ed05439-d444-453a-825d-627dca0fe184", "comment": "Malware payload (IcedID)", "value": "8abdac6213e903c6923c5446fe19d23e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290455, "uuid": "81f2640e-f4e5-4cca-a9e6-1966f630f384", "comment": "Malware payload (IcedID)", "value": "6ac230ef40a42a81a0d545e7f699411e5c1c2985682cf7d8c6ed85cb1d8b08c5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290455, "uuid": "f34bf7c1-a579-4398-b562-f10d9878b7cc", "comment": "Malware payload (IcedID)", "value": "0d2a59789e511e5df9705dc0edb4fe3741dc6982", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290455, "uuid": "5c7d59c8-5d13-4821-99a5-408bb2e56305", "comment": "Malware payload (IcedID)", "value": "5f163f441b9fd1434108d4360cdb1f6f40f215ce6f58ad5f054a08db8ad1f9467b15f28187615d98818950990febf2a5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290455, "uuid": "499fa57a-f70c-4a8a-9faa-382489f2076a", "value": "6304123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290455, "uuid": "e5d4200f-f368-4b65-b1cc-3e873f6098dd", "value": "3072:fXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:/E5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290455, "uuid": "ed34fbd9-f387-45b3-89f1-768b3866d08f", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290455, "uuid": "1a47b61d-8664-4085-abe8-83a703e7e97e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290455, "uuid": "9caa324c-6bb5-490a-8641-10eafd36164f", "value": "9516115992-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a58268-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617287732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287732, "uuid": "975f8d5f-d341-489f-8cac-c4dfe95bc34b", "comment": "Malware payload (AgentTesla)", "value": "50d75585f6270d4386c73bc803be77e5", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287732, "uuid": "8c899608-6552-4792-9f41-5f64add5a652", "comment": "Malware payload (AgentTesla)", "value": "6ace3c430e51bf4571d38adb5443c15f8800497ea53a96fa80fc1763515974b5", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287732, "uuid": "0dec5557-8db5-426a-8092-05dc18b0bc4c", "comment": "Malware payload (AgentTesla)", "value": "1b8de395d2725e654ea2b7f6effd5f7f99fc0d57", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287732, "uuid": "2ba0c58e-12d2-47fa-aa35-a467b87402a7", "comment": "Malware payload (AgentTesla)", "value": "93ef4dc733c0f8b04f01c29fc34a70cb31a3e54de2b4758f6d1032b8e4070c324950f2711eff34aab604209be751b612", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287732, "uuid": "fde4c2af-b641-46f9-b6e6-eef8ba7fb6c1", "value": "8DB423579E6E2C2FE97F69B2D8E22B01349AEF0541D8833E13A434F8CF1196999D005F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287732, "uuid": "ae63740c-557a-4b2e-b355-56c1addceb05", "value": "12288:XlJfqUe13q+OecXd9rsmzhDbJPYuTfYCOXdwjbOCzye2bs:1Jwys4bVYQYCOXdwvOiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287732, "uuid": "3303605a-deb4-4f6c-aea9-5cbb81253aca", "value": 495323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287732, "uuid": "78bf7d82-53b1-4bd4-8a92-2eaaa42cd6c9", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287732, "uuid": "16aea4c4-e135-4de1-a635-f4e190f2f1bb", "value": "Proforma Invoice No.42037 USD.78116.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d40ab8-92b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617258284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258284, "uuid": "58df2333-c41f-4263-8bab-d9e4e5bc9932", "comment": "Malware payload (Loki)", "value": "b57985b3324da36c4350152a5bafc25b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258284, "uuid": "089ee730-92cd-4cd7-b7cc-32c4abd24606", "comment": "Malware payload (Loki)", "value": "6b3ce5f1f7fc6d51fa9b82e32c56521facef5c1ca004fd65bffed44a23663982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258284, "uuid": "4428063e-7472-4353-9e0e-f147e9eaec53", "comment": "Malware payload (Loki)", "value": "6d623c1c4c23646a543747821f6a0f2d49b994b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258284, "uuid": "5c0bad86-d63a-4775-afbb-d15771a042ba", "comment": "Malware payload (Loki)", "value": "0505b4c9ff4a619434181f42d165175a46cc9430e54a4c1fad5c443ebbadc182bfcbb26f47b35c7697d8d2d830c42ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258284, "uuid": "576ac77d-7082-44a9-91d8-b360c0b7f8a3", "value": "03D401F12D90CBD9EA3947FB969561460BB4F3D61003CF849A49F9F2294AF8D4EC1683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258284, "uuid": "0287a64a-c9a5-4c8e-b568-b121bec9d65f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258284, "uuid": "c5cba97c-079e-4173-b145-5ed0fb379185", "value": "12288:lDMktmBGFa827qxb0obI5kcjGcGJdt0yXcD+MIZeJOp1Y/aCHM2iNF:iktmkFa827UIOIicjBq4Y4IZeC111L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258284, "uuid": "9df253a9-a3d6-4730-ba4c-057241d19c7d", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258284, "uuid": "75ff7236-6c3b-4e3f-95cb-e7184c0b06e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258284, "uuid": "0f6bd2f4-b008-4ef7-ac41-e6910b1cc5c8", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14a904e-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283514, "uuid": "840cfe52-0f72-4620-9035-37ebc846a55e", "comment": "Malware payload (IcedID)", "value": "18babb7835e11178692134a3e4981c8a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283514, "uuid": "770ae6cd-bf82-4679-86af-36babfceb7bf", "comment": "Malware payload (IcedID)", "value": "6b4ff58b944b2a8b16703f3157debe9b85fc0ea6b3fa818b6eef608f8d74239e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283514, "uuid": "a1ee7a2a-af6e-4ae1-b353-998591debdfb", "comment": "Malware payload (IcedID)", "value": "32d4803be921e09239370bb9e66233f0725a59c1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283514, "uuid": "0e8993e9-508d-4316-9c1a-53622e6ed679", "comment": "Malware payload (IcedID)", "value": "f96c3f33dd24790c3171def6ad947c119413806b8b53b9e3b77fd0efc3c7ade2d3f6fa3b480f88d16aaef25937accc4c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283514, "uuid": "f872511e-27df-4725-87b5-62d39a37b98c", "value": "37044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283514, "uuid": "c00015f1-e844-4880-ab48-31eef8c9a028", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283514, "uuid": "730341fb-6319-4b32-9af3-06ed86b394a0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283514, "uuid": "13818ce5-6f95-441d-ace3-65e53ed7f075", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283514, "uuid": "0e817ce3-c547-4331-bc66-320ec5d9e48b", "value": "document-1714485532.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933e6881-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275303, "uuid": "cd89b4bc-4146-4e49-9606-233a57815029", "comment": "Malware payload (IcedID)", "value": "29d518e1fd23fdf06c3dab6e73b17d24", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275303, "uuid": "f7bbd085-589a-4de5-83e7-7050bbfa5815", "comment": "Malware payload (IcedID)", "value": "6b7c9bf07e59751769ab8da0316a109c6a45ca54f58106bb7027a6d9dcb20b7b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275303, "uuid": "21a63902-15ed-44fe-873a-6f9afde2c9fa", "comment": "Malware payload (IcedID)", "value": "ad40ca653b5276ed478f6babf3de8de2b26d124a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275303, "uuid": "abe8493e-4915-4d13-9437-e7b563bc72e9", "comment": "Malware payload (IcedID)", "value": "6f71aced275027f8b5a8d93ae8ee8e5a5af27ec51b28c7e23cdd7943215966119bbf98935288814db0d08dbb4dd76582", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275303, "uuid": "279c84e4-1253-4ecd-8341-c74ff8f41fc5", "value": "C2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275303, "uuid": "16884f48-ade0-49d7-8699-5cc484d89737", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275303, "uuid": "39120ff2-f0c0-44e1-9691-45973e0d8a8a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275303, "uuid": "c69ee2bb-85f8-4f1d-acf9-c81d113da005", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275303, "uuid": "b50fec62-d662-4421-97d3-a8b21f437e5c", "value": "document-1252492067.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bc7c31-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285879, "uuid": "4b18c502-a97e-479b-83d8-21cebdf51565", "comment": "Malware payload (IcedID)", "value": "b1c04d9ec0fccfe971513b9de5a0787a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285879, "uuid": "60af39e4-d4a5-41e4-9e0c-fd7f48139c31", "comment": "Malware payload (IcedID)", "value": "6b81fdf633f0b566d3cdd3efe4804fccd89ada63eb8c788f179b226dd4d56423", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285879, "uuid": "c543a87b-4048-4470-9ab5-42438b51fa54", "comment": "Malware payload (IcedID)", "value": "0f85caaa0f6fab3fe71b26de2965526d9d3eaf26", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285879, "uuid": "aa1c09a6-0169-43e0-a1b1-306ebabd1d25", "comment": "Malware payload (IcedID)", "value": "0f2512e96c788586f8cc1b8ceb4b243c9a6161bb1a38524d495ad4bbfd6d6becf12a2fcf389e84eca09a4171e8d22f79", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285879, "uuid": "17f0446a-7853-434e-82d7-33d10e63e7de", "value": "AC838CCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285879, "uuid": "da918d61-4f86-44b8-b64f-b53642e0d6ac", "value": "1536:IB240XZfcaaxf+EQliU2hawQCAIoo8+BNvMhfvko:+2d1cBWEQXMQ9o8+nEhHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285879, "uuid": "d4484ba5-570d-4587-a918-a49ce5142780", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285879, "uuid": "0b41307b-000f-4a1d-aca6-ebd1b17eecff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285879, "uuid": "80a0e8c0-8655-4da4-aa14-b15d2b4401f2", "value": "1498.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f5aedb-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274361, "uuid": "4b6c2f7c-37e3-4f45-bd31-7b189073cecf", "comment": "Malware payload (IcedID)", "value": "450046dfe1b63e813b34a98e43806f2a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274361, "uuid": "d61ca2a0-4e1a-4f09-a2e0-f8aa050c4058", "comment": "Malware payload (IcedID)", "value": "6b9358cea452ebed998fdb6cc7cd4ac69c4a4e9d159cd3b489379fe97008932e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274361, "uuid": "913fed9a-8447-4bec-afec-1406b21a2481", "comment": "Malware payload (IcedID)", "value": "afb4f4f402260a863f7c68c2b5c3cf910d8ba888", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274361, "uuid": "72f1db17-54d5-446d-b526-4042e26f2296", "comment": "Malware payload (IcedID)", "value": "e96831c5c7dd5a718dabe12d8c06c37cece328b9090ddc20485dc7781e668f0665e0b45c64156952e9a580a08ad8ac7e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274361, "uuid": "35e02a46-a876-468c-abb7-6ad6fc6bb0b2", "value": "06044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274361, "uuid": "1eb5517f-968f-4db1-b784-fad428db7ad6", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274361, "uuid": "fb1e530b-37a0-4b82-8863-2ab2c432646c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274361, "uuid": "2e635472-21d8-44cd-9947-f15f7ddac36f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274361, "uuid": "aed800d0-ef7e-46fb-aeba-2e4d235da917", "value": "document-2005797363.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ed8279-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279009, "uuid": "320055fb-b64f-47ca-892d-f6ca34c0fd39", "comment": "Malware payload (IcedID)", "value": "152a4e69c978867dda4b302a646911d9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279009, "uuid": "c3762170-9f13-4975-8df8-b5d4eabeed77", "comment": "Malware payload (IcedID)", "value": "6b9c4e6e65e2e0a6ac5df05d71cb696f8cd21c67aa109c56bdfad634b9bf5f5e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279009, "uuid": "47b9deed-48b7-49ce-876e-7fb7ca08527f", "comment": "Malware payload (IcedID)", "value": "7ee71bc296f811e2ea3699e7112420c8b31c3bed", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279009, "uuid": "3494f12b-def5-48ea-9fa7-663bcd635f59", "comment": "Malware payload (IcedID)", "value": "cfe6052cb73c14c5fe12209eb28d37d77b09ef1346026ac9669b3c9bdc60390df8ed0e69983df8030c60a786c062f739", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279009, "uuid": "45cc1504-f35f-4841-b7b1-7c979c8cf335", "value": "A1044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279009, "uuid": "34a4d18b-0232-4e96-87a0-d66277fd2236", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279009, "uuid": "286d1499-24ae-4eac-8c82-85b1bd052714", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279009, "uuid": "86739144-dcb2-44e3-b041-01d86f284cea", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279009, "uuid": "9f8d4b5c-2df1-4206-936d-693d9f51163a", "value": "document-994484904.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49668f74-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287205, "uuid": "00521285-39f7-4687-82e6-0115674d6462", "comment": "Malware payload (IcedID)", "value": "9e022263b6d3a69ca3a8f977b2e7bfb5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287205, "uuid": "8f79a895-2003-414f-b212-f44ef37d753c", "comment": "Malware payload (IcedID)", "value": "6bd0b54f0867172f93be0f99a73680293c354769643a5994ceb06a3078da93e8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287205, "uuid": "3ba14576-7ebe-475a-bce7-926de5d44ddc", "comment": "Malware payload (IcedID)", "value": "4957c1043a43f77169ba43831e63a1f47754409c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287205, "uuid": "92caef18-3143-4cfc-80d0-ef11ff1758be", "comment": "Malware payload (IcedID)", "value": "4464c01ea31e247504565180b0b94d72d4e95cb80c9e999bde34513603c21f7fcddd0fd6d140ee39ee699773fca8975c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287205, "uuid": "c544ba3c-c05a-47db-8aba-1e84c9078c1b", "value": "86838CCDC913E1D9C2559FBD5A09308112F4E0B62B6FF11B148EA62E4D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287205, "uuid": "bf4a189d-7fe9-4a7d-bc40-3ee47a8baa35", "value": "1536:IB240XZfcaaxf+EQliU2hawMCAIoo8+BNvMhfvLt:+2d1cBWEQXMM9o8+nEhHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287205, "uuid": "ee276119-52f5-4278-bfdc-4488fc925323", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287205, "uuid": "9a43e28e-bfe1-41cb-979d-09b956039620", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287205, "uuid": "3a8b1871-c309-4e0e-b2fd-1f804bf797e2", "value": "1881.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb418dc-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617259453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259453, "uuid": "b0c2b394-08a9-454d-9ebf-d1575ab7373f", "comment": "Malware payload (AgentTesla)", "value": "9ebeff25ddd2931b7d673533a5dda7bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259453, "uuid": "ba6976c7-2d1c-40a8-9d91-ed19ac5359f3", "comment": "Malware payload (AgentTesla)", "value": "6c0c7fac986868d7475d17b7209d27b2f0c510abd056daf28f1a7a10d9efe2c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259453, "uuid": "b74dac4b-55cd-4d77-a7da-5a8965ea9a33", "comment": "Malware payload (AgentTesla)", "value": "d68d4d06bf29bef9066e4cb02fcf45b863f47b8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259453, "uuid": "ae32207b-c28d-4c46-9f4c-1988d938e4b5", "comment": "Malware payload (AgentTesla)", "value": "4217854a620e4f4e338d1f2a034d66576eb909e8b818f35ec8b088ca11d3703fd853e4624397a3e2f4a88b7c779f5325", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259453, "uuid": "05a2fe21-d2dc-45cf-a7d4-402cf2dcff35", "value": "A306FD61B7FAA6CD34B333FA487976F14903BFEA813A2ACD0325265C6B2414519D077E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259453, "uuid": "72e5b491-54a7-4927-944e-1fae2c87ed5b", "value": "1536:bp9WIoj5x4ChS5hpCBxQxi5M2DVpR230gucxUr0ZPlMxs+B25qQPNoDHYDHIFcAj:lDoj5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259453, "uuid": "1a5f49aa-cd29-4a5a-8124-4229bef97d7d", "value": 3873147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259453, "uuid": "42a75f1b-ab21-489b-91e4-1bb83686ec76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259453, "uuid": "63a03673-a031-46ec-8c2f-5ed530caaec2", "value": "9ebeff25ddd2931b7d673533a5dda7bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f9c091-92ae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617256375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256375, "uuid": "4a2fbb1e-e595-46ac-a694-4f9df7eb55ef", "comment": "Malware payload (Formbook)", "value": "38e46988023b026e0553c165e5b21c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256375, "uuid": "69fa9146-6a9a-4478-bfc8-722d258893d6", "comment": "Malware payload (Formbook)", "value": "6c2f5bf673b3bbc31cf425259cd5a0262094e85a8bed03714c7b39712efc4beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256375, "uuid": "3a71843f-59da-4f19-958c-bcb141e93220", "comment": "Malware payload (Formbook)", "value": "e20d2a8861010eec859348a95b091b894ba638e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256375, "uuid": "22f733df-5c78-4d41-8144-ff552423b638", "comment": "Malware payload (Formbook)", "value": "bca67fa61235a3a5266ef73bd880581f59d0ca708727114b7ae75441d0fb6d0e152931c9101d338d6a93a75b32deda65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256375, "uuid": "be8c4a29-5f92-4a92-9993-8715025824f6", "value": "C4A4CEB572D41B19F47AEBF87870110187F4A43D82D6E70A1EAD10DE0872FB19AA5E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256375, "uuid": "8f2ef972-0fd1-420d-a23b-1faa7c5214ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256375, "uuid": "05a1f38a-68a7-4ae9-b77f-47abb64d7ce0", "value": "12288:lTBHVWyJ2zDrA/xmTjizcqb2CdpB6z/wpwcCpfFb:tODzDrMmTezcq6yB6zdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256375, "uuid": "31a51b4f-4e12-4225-8943-09049d91def5", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256375, "uuid": "e8153343-0d53-4f55-b1b0-1c7dee5e77a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256375, "uuid": "67a90dfa-a1f9-4e27-80a8-28505bb419ef", "value": "INV-210318L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1a1ebf-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278133, "uuid": "bf24ac09-cf7e-4a28-a848-784b7c1e8bf4", "comment": "Malware payload (IcedID)", "value": "71b6eaeaf1759b2592957a7dde374c80", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278133, "uuid": "16b10c3d-3373-47b0-aed7-6861c49d1149", "comment": "Malware payload (IcedID)", "value": "6c40d5fc3677e579d28a2172e197e3268780f5163fabec3cf0334ac610f497f0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278133, "uuid": "7c3b1f29-f578-47f3-96e7-f16ceec922ff", "comment": "Malware payload (IcedID)", "value": "4e7473da5f9753ecc995295a35c95cccdc9c648d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278133, "uuid": "5fa2f92a-8bcb-4391-b78a-952f06bdb574", "comment": "Malware payload (IcedID)", "value": "9da225e76439ff695722d2242b2cd4db2fa8c98fc376b31c839a69993439f5a9607094ffbc0f5d5a336ae85dddbcf859", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278133, "uuid": "9110a1cb-219f-48a8-bddc-02518c60c8f3", "value": "7E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278133, "uuid": "dcc8e09a-61ed-4db1-b9a8-5a9b1889df29", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278133, "uuid": "7dddb775-db01-4fe4-9dd3-c7643aa7f005", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278133, "uuid": "09d27b2d-7d7b-4a4d-9a50-2deae9bbab0c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278133, "uuid": "ac508edc-7437-4e0a-8e08-f81718fa96fd", "value": "document-2105863664.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4551619-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274070, "uuid": "1ab6b4bb-31b7-451a-b7a6-7b57718f8d20", "comment": "Malware payload (IcedID)", "value": "bc5018ea490233ef2df168cc14e1c491", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274070, "uuid": "0e6115d7-00b7-47f6-a5af-4e91ada92f4a", "comment": "Malware payload (IcedID)", "value": "6c4885ab4b971b15078448c542d60b88142c8bc8a1628a088e19f16957093a18", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274070, "uuid": "2e3da9ff-8f0c-4329-9236-d9dc158e4381", "comment": "Malware payload (IcedID)", "value": "e58860703ebe2381d30558c140d04611d4a71e9a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274070, "uuid": "616d49a7-9e32-48b8-b794-19f775acba8e", "comment": "Malware payload (IcedID)", "value": "4371bd5675f35466f46d0641dfd7404204b4dfb7dc09183d89c815c3b563398fa48d6bb576898f42ffcb6d2d1b896de8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274070, "uuid": "f497a42d-f218-4bcd-b035-fbb56bbbe487", "value": "B7044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274070, "uuid": "f2a3c97f-ea42-494f-af61-603322b982d3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274070, "uuid": "6dea3b72-bc0e-4647-bfe6-bf64ca080f0c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274070, "uuid": "8d36a86c-9228-438d-bb69-289ff85931a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274070, "uuid": "21c72741-3e5d-4175-a971-c1620b0e8d5b", "value": "document-1216613805.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5546a7f3-9292-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617244275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617244275, "uuid": "5847ba6f-9f28-45d0-ba20-844dfb1e7f49", "comment": "Malware payload (Dridex)", "value": "57fca48499c3c7641862dfda212ff344", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617244275, "uuid": "130aab2d-f821-40be-8e11-10d228ef6883", "comment": "Malware payload (Dridex)", "value": "6c542eee05e19f043999e3a28941c91fa2d7b0186d85a99acce2ef46bbfd9057", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617244275, "uuid": "c5d5ce9f-d253-4084-abc3-22cda615de86", "comment": "Malware payload (Dridex)", "value": "d1d0ca955d36fa2a0a2d02a03b5fc523acb68198", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617244275, "uuid": "8263d0ec-a07b-4fc3-ae84-f9d3e5443170", "comment": "Malware payload (Dridex)", "value": "c58fae92d3602f381faa10fa6a20e5c32907e31384af90790792970345cf1edccf3ee3eec4addfb0d26eb2e5f1ab6fe9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617244275, "uuid": "2744d847-bc43-4a47-ac59-5969fc64675d", "value": "9214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617244275, "uuid": "7bc63d2b-8ffd-4bed-b32c-a0d38eaa4196", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617244275, "uuid": "05b9a6f7-6c88-4ca4-b1c6-af44d25cb480", "value": "3072:O1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:mi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617244275, "uuid": "bf11665a-7d6f-444d-8ec6-5ef4fca3bd85", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617244275, "uuid": "282562b8-f399-49c5-a5e3-8593d75e9be6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617244275, "uuid": "6f74ab4d-ad53-43a9-b737-700517b9b509", "value": "6c542eee05e19f043999e3a28941c91fa2d7b0186d85a99acce2ef46bbfd9057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9721263f-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281752, "uuid": "febd1364-352e-405e-b4fe-a470fd8119a0", "comment": "Malware payload (IcedID)", "value": "afb01a868157c5cd4e041adb13a6cef4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281752, "uuid": "188fec56-e53e-430c-b18e-39965122bf3f", "comment": "Malware payload (IcedID)", "value": "6c57c8336eebafb56e3edcb58edb0996a5308f9d1b04b82040d4701b056e40e3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281752, "uuid": "acc5957a-eea3-4b7c-bf68-b6e0b0823759", "comment": "Malware payload (IcedID)", "value": "552ec6658fd1cec6ba8d96db862b313d609eb13d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281752, "uuid": "f02cfdc6-1a92-41af-8f76-9195f3e19d39", "comment": "Malware payload (IcedID)", "value": "1d15f9c96ead19e2fc68220b9948750d4a730c4d69f3c5eafb2fa38fbd61037b19b99a89b5e47adcb797f95daa00fc64", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281752, "uuid": "afd0228f-fff3-4cd4-8063-4730a2e8855e", "value": "4B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281752, "uuid": "9066d5b6-0de9-4ed1-baa2-2f29ac8e93af", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281752, "uuid": "01d8f9d8-e769-40b3-a44c-aef2e981479a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281752, "uuid": "6546c95f-21cf-421d-a6fe-19b0527a3894", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281752, "uuid": "99bb36eb-fa22-4fbc-9e65-774af8572bae", "value": "document-758557531.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec354a-92e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617281735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281735, "uuid": "f727394c-b703-485a-b40c-9268df18e627", "comment": "Malware payload (IcedID)", "value": "9a5902b09c9a1bf39b0134c167415f21", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281735, "uuid": "dbdbb26f-1169-414e-969b-fcbf47a66360", "comment": "Malware payload (IcedID)", "value": "6c6b46ddacc84de53532132ac4557bf114ff1d0217e4978e88ccf8c2d0cba077", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281735, "uuid": "1e788216-9b8f-4be0-8d2d-94c9bebdb5e9", "comment": "Malware payload (IcedID)", "value": "e7995eaabe0715e318ca4afbb70c6c0d75c223df", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617281735, "uuid": "027ecd85-c4b5-4482-8452-5dc5a22dc953", "comment": "Malware payload (IcedID)", "value": "d5e78a6e00768954a994ff701a4f1e4bca5199da994bfa81ef7cc0c84f20b832361c8c3357468493928ec0f55a8e2b09", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281735, "uuid": "5925c705-e777-4389-b9b0-edbaed06db97", "value": "A2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281735, "uuid": "61caa1c2-f243-4859-9538-0c735438e133", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617281735, "uuid": "f50adbbd-aa7c-4b73-889c-233cc6672306", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617281735, "uuid": "2d618525-8821-4753-9b92-95062c2abd03", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617281735, "uuid": "aa0a4e67-801f-4621-ac09-8a5c6865d2d7", "value": "document-1823104059.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe790bb-928b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617241555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241555, "uuid": "334035df-5c8a-496d-a221-b7a9d34ea9a0", "comment": "Malware payload", "value": "720cba7dffba7f43d444a36326a9d6ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241555, "uuid": "c868a6df-359e-4c4b-91f2-c138e4dba2ec", "comment": "Malware payload", "value": "6cddc92fce9c322cf643b8356a4501b528e1227cfc601fc33dc4b78428aef134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241555, "uuid": "a23da578-c0e4-4281-bb00-8fc64bc114b5", "comment": "Malware payload", "value": "e0e799c92dfc98bc5d8d6e5a9be8b88444d61e5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617241555, "uuid": "858db440-e20a-4ce4-ab6c-5492a21974f1", "comment": "Malware payload", "value": "8cb996ec362e26bf6253a911af08d985c5c65b2bc10938fcb8596b3e37397d16c7367ccf09e5efcebe92c5aa1b984060", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241555, "uuid": "2c5aef92-1682-4bb0-b983-a334f451dde2", "value": "58835C59F8808E32C9D1197EFA8D025873570BBCE7D93241DD14AB353BFBA5A0E7A841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241555, "uuid": "ee2693f8-11f8-460d-b40a-3212c3374076", "value": "1536:hMxorPVHTflkVLsasFWD/PoDO9rmJ/VOqlxHMMharOa+BgS4tHIr:hMxocpR3k/oGepkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617241555, "uuid": "9c377f5b-693b-4cbb-8e63-1c7b5553f438", "value": 83200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617241555, "uuid": "f84b7d4f-ca9e-4dba-b23a-e64b59b85bfa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617241555, "uuid": "85d04825-8742-4990-991c-768178aa386e", "value": "dal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4f6d20-9305-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293949, "uuid": "f2d23635-bb5a-4059-b40e-2ae20420747b", "comment": "Malware payload (IcedID)", "value": "e99b20c701e667ab9fa91fcb961cb3f1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293949, "uuid": "6414a89a-d3fb-4934-809c-dbc31a040869", "comment": "Malware payload (IcedID)", "value": "6d795bc2597f6513070c6844b28201f1ec83f3170770d7768995764b41cd91bf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293949, "uuid": "734ba668-1411-4bf6-9cd2-330980026158", "comment": "Malware payload (IcedID)", "value": "6e8d1f98b09f9f0fa1cde8a906567a32fba2498b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293949, "uuid": "5fc37865-d70f-4986-9eeb-82091dd2e69e", "comment": "Malware payload (IcedID)", "value": "230de9d261032aac55dcfa8bafcaeebcebe111c4a8513efb670215032c55653102316150c13f0e4de479cff5707c61d4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293949, "uuid": "492c296b-f22f-44b6-9556-83ea346a54b7", "value": "8C838CCDC917E1D9C2559FBD5A0A308112F4E0B7276FF11B148EA62E0D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293949, "uuid": "9ffd039d-f79b-41bd-8585-93a9695ab487", "value": "1536:IB240XZfcaaxf+EQliU2haw5aCAIoo8+BNvMhfvFR:+2d1cBWEQXM5a9o8+nEhHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293949, "uuid": "1eb91808-cd86-4004-aae9-8fa38c8d1655", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293949, "uuid": "9f960718-e309-48e9-a074-88349c37557f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293949, "uuid": "1ba8e40e-1c78-482a-a9bb-8198199ec6b9", "value": "1149.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c223b21-9319-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617302269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302269, "uuid": "25be9651-5fd0-48f6-9fb5-8419b195e108", "comment": "Malware payload (SnakeKeylogger)", "value": "c4235c8935161556ecf0dac01756ced5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302269, "uuid": "d28f5309-8ea4-4669-bb83-d4ae76116f9f", "comment": "Malware payload (SnakeKeylogger)", "value": "6da87052b6597901a001b291ad86de659c20255830d86f6a574ed7a1cf6f4b47", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302269, "uuid": "908cabde-351d-4654-b0f2-9211a36162aa", "comment": "Malware payload (SnakeKeylogger)", "value": "48b3cd3efb70d17c1536c3e98e3864566e0aa247", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302269, "uuid": "5eb7fb7d-48df-49dd-9feb-ef0609786b47", "comment": "Malware payload (SnakeKeylogger)", "value": "81950174854da7073cab2fef28e5c2b3bb56384bb294e98ae7e2c54e3600e8dfd50f680c9d53e9e07084498ec573d6f8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302269, "uuid": "3d711f00-2581-491a-9827-f540e04e2f9d", "value": "67F4BF5232C4DD99E02B6BB6446FC02053F4BC4FD221D60D3F8AAA2F96E7742146B75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302269, "uuid": "786f9661-f0d0-4a73-97b8-6ae5307de8f1", "value": "12288:HOGItbjR0yA2aYtb6YaK4IenzE8exVUPzw5TyYHSiyyjKr:HOG2RJA2p59aK4fQ8ouPclyYHd8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302269, "uuid": "bcc81962-4c1a-420d-9351-69cd47f335cf", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302269, "uuid": "cb2c9dc0-5a0e-4dc9-82c9-55bd036d240b", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302269, "uuid": "15bb251c-798e-42d8-8de8-70942a078eb9", "value": "OC CVE9362 _TVOP-MIO 1C 2021,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8663d09-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276305, "uuid": "a9a8cd90-367e-42a8-a6d7-f363ab6a8332", "comment": "Malware payload (IcedID)", "value": "91a2c2669cafdd980def6b00ed8e4aea", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276305, "uuid": "3b5662c7-add1-4549-b94b-fa72e46dcc4f", "comment": "Malware payload (IcedID)", "value": "6ddea0ea64da661b85f05f8f8bea449c2c8e1635d54b3f010625c62c6f37db79", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276305, "uuid": "6e3afb08-59ca-4789-b8d1-9ff73648fde3", "comment": "Malware payload (IcedID)", "value": "722b17666ae06d094b33441e8faf3aecf4490895", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276305, "uuid": "f5dda3de-7dc4-4bce-b900-cdc08600ff92", "comment": "Malware payload (IcedID)", "value": "3b2ed4e9b806ed5c06026d4e2f65d921bc701b135b9196e3223d60109602cb668b0e0c39a79cc34982d081f4283abce5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276305, "uuid": "31b75d07-7b75-496d-8191-73c2ba40e417", "value": "CF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276305, "uuid": "a4741976-ef6d-45f7-91f9-a0910ad88a5d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276305, "uuid": "eb132961-4cb0-482c-9dfd-d01c8efcaa03", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276305, "uuid": "145ce6a5-8572-4fb5-901f-59934760f5c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276305, "uuid": "e28e238c-0e4e-4e50-b6cf-f4bd8a3c2d86", "value": "document-209898793.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9316c098-932a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617309663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309663, "uuid": "347e9b1b-dd0d-4353-aa81-13afae305587", "comment": "Malware payload", "value": "957af70cce8481f490a0eb68539c4fd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309663, "uuid": "c07ba293-c103-4e63-99cb-f7c748203715", "comment": "Malware payload", "value": "6df34bc6c9b53610c86d489e83f3b69d3a220dae0793524f31e4095e47174d98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309663, "uuid": "80f01a4a-8a04-4c97-82bb-1a07dd6cc2e8", "comment": "Malware payload", "value": "e68d33ecbe3857faa9b8e3186da1b20008ebac8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617309663, "uuid": "b3cb6b4b-2f04-4c06-b9fe-3f563f2353f6", "comment": "Malware payload", "value": "4b842aa1ebc28e58aaf6e9e532b397b7458a04784d7aebe4e3d978c45d5449d6c3ddefde4572cb5e1433afabb6eed8d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309663, "uuid": "e8f21aa1-2185-4ed7-baa3-b89de351fdb4", "value": "86538D05A682D1BEF5974F70063FC62AFC31BC651010BABAB35DBBB06933D232D19469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309663, "uuid": "390fa61a-2241-4f1f-a679-24b6a33d9c56", "value": "1536:kPZ0YgweD0DLdREB/Ia4ol/VKp7qqBTEKsPCMT0rvE6cEZ/BcS4t0Boor:kGD0XI/7cp7rBQKnMgAREZ/nh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617309663, "uuid": "350a8a89-4256-47dc-a83e-0a29e71d6cd8", "value": 66540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617309663, "uuid": "249690e8-400b-4880-b8f7-622d1077132a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617309663, "uuid": "edb37653-1463-47c4-9e79-1b5bb4fdcd3d", "value": "dx3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad310376-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274058, "uuid": "0d544b69-dbf0-40a4-819c-d6b4fe3045e5", "comment": "Malware payload (IcedID)", "value": "8070a86f5f8243b21382b45a98e43034", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274058, "uuid": "74c160af-76e9-475f-bff5-f9d39557b5ff", "comment": "Malware payload (IcedID)", "value": "6e4521fe49a1132ba7880d5afa4fde1d6626eeca8c7ed9b61605d38ef6a772ea", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274058, "uuid": "0384a15c-ae6b-4e89-90fd-b47f6a48b2cb", "comment": "Malware payload (IcedID)", "value": "7829a7821902abdf6a72b0b75aa8313fe30d1cf0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274058, "uuid": "db305d51-1785-41d8-81cb-5d3fa2c51863", "comment": "Malware payload (IcedID)", "value": "c54ee64409fa291d1ae199af9430e42f8fe5f9adccd5a8883f9a8362c2cad59f3fb7079699114bd8fe1891b6104265c5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274058, "uuid": "7e84576f-00f0-4978-8406-c27feaa0be47", "value": "75044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274058, "uuid": "410365a1-03d9-4485-ad25-926e2499ac56", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274058, "uuid": "8e4fd8f8-ebfe-44b2-abc5-365efe348a83", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274058, "uuid": "38c58237-45f1-4a9b-867b-b442c5d4b3e6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274058, "uuid": "62b39e95-855f-4dd9-96ad-1a905a1fa955", "value": "document-2086225444.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da7ec74-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274757, "uuid": "0ab36dcd-2d32-4a72-9bba-f5f366b841ea", "comment": "Malware payload (IcedID)", "value": "d275966b56e956a61012eb0652f5644f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274757, "uuid": "1f756111-ddaa-472a-b9ca-1e7b545d94a5", "comment": "Malware payload (IcedID)", "value": "6e6cfa8a657fa2f85e3ed1572d76614cd588c2b84afebd4ef66e40faf9443f34", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274757, "uuid": "877cb033-3ec8-4c3b-adb3-ce5d5ef20f2a", "comment": "Malware payload (IcedID)", "value": "a8d709582708b25a9f1583181c285a47fa658438", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274757, "uuid": "46ae3ffd-7479-43a7-8d84-7354c7623c8f", "comment": "Malware payload (IcedID)", "value": "d1b7393d8839b9ae79cdc7df6cc501c6afc9447296fe906993178543436b732db51534979f7467285b61a1d0a883836b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274757, "uuid": "0aae094f-0d70-446b-9458-edd941561606", "value": "CD044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274757, "uuid": "5d0e15b1-b796-4ee1-8268-4ec31d475e2c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274757, "uuid": "9988328c-5213-4c4f-b31a-aeb950bc723c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274757, "uuid": "a891c4d0-f998-4209-b43c-62f04fad665c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274757, "uuid": "13c93d6b-c0a8-4c0e-b30f-d2287183481e", "value": "document-513384862.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33e28e8-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617286148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286148, "uuid": "afcf8b63-0887-4969-b12c-7ad55ef37d56", "comment": "Malware payload (IcedID)", "value": "e68d1fabfcd618385ca5393817a35e40", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286148, "uuid": "76efdc3e-f89c-4c47-86ec-65efcea1cdef", "comment": "Malware payload (IcedID)", "value": "6eb265dedce7ee07a3e99fe25ce030f7a6045b339100373d1d58ddccac2079cb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286148, "uuid": "907e7513-c2bb-4a93-ba5c-b40c31354945", "comment": "Malware payload (IcedID)", "value": "f985d74a159642a1da964c202b10ccc7a33f68ef", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617286148, "uuid": "cc7ff85d-6e99-406b-84af-d02468cced2d", "comment": "Malware payload (IcedID)", "value": "906ce83484c7ea76ce500b83b62c49c1fcdd8df87e62d8ddb83c305326a30fdd93ff9c54591d6f85aec1f490f147f0ec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286148, "uuid": "05782603-57db-481c-b52e-bb35fad15e87", "value": "0E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286148, "uuid": "c84ceee2-28b6-4801-ad27-8e1cdfd3b48e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617286148, "uuid": "c9184dfc-a7e5-4e83-a2ce-a3bc3368d236", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617286148, "uuid": "26966c86-6114-4911-a420-a6b967bfea6a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617286148, "uuid": "eeff0640-75f2-4de6-9921-94acace67e29", "value": "document-1778527785.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7649dc-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279936, "uuid": "69bb7145-d2fa-4a42-8e31-3139a21ffd4c", "comment": "Malware payload (IcedID)", "value": "d14897d018a925a72f1dd0047c7567ee", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279936, "uuid": "65ec1d06-8584-4201-8d80-7f789687420d", "comment": "Malware payload (IcedID)", "value": "6ed441ab53f334182b395ccc0aef8e49e333e36b5122b9e7bdf6e7ab8e76b0d2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279936, "uuid": "f2466a5f-e12c-432d-becc-bde35f05af86", "comment": "Malware payload (IcedID)", "value": "adcfa0525996a8590c5dc59947fbca5ef4d42b87", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279936, "uuid": "1e72f68a-5218-43bf-8685-1948701d67f7", "comment": "Malware payload (IcedID)", "value": "c0ff751594fc732c1c4b4312f714a1c3266d385ebcaacad81ae2147c6336c3d856f6e978cc79130a4c9ac2e2dce68bf8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279936, "uuid": "f0f4b845-7712-484f-afa5-3f94f51e7dac", "value": "E7044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279936, "uuid": "7a2ad543-216e-4b4c-b6e6-1bac2a60123c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279936, "uuid": "1a1c29c5-8d62-456a-abf1-0014dfbd34b7", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279936, "uuid": "471ed87e-f634-4def-a559-33a366729cc5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279936, "uuid": "3ebec173-3517-4b4e-b3b0-143e7ca39a6e", "value": "document-839474071.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7620ec85-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287280, "uuid": "62a6e3ce-b823-4170-b1e3-f8ddd49f0bad", "comment": "Malware payload (IcedID)", "value": "d18ecaf071d7cf538ac1f2a8dc777e5b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287280, "uuid": "5dfcc679-f928-4601-9dea-944a16276162", "comment": "Malware payload (IcedID)", "value": "6eea83ed1449600e5f6ac37be2ee8b70657604735f0de492ac2a13983bea2143", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287280, "uuid": "2f06a79d-de36-4614-9e56-7db596495930", "comment": "Malware payload (IcedID)", "value": "afc4d41a135e5c66e706a8b46f0fd88dba6e8ddc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287280, "uuid": "e3f96f0c-a726-4777-9958-8655b67076e8", "comment": "Malware payload (IcedID)", "value": "7e50c0b445ad9d036b4e067bcc0c8ae83ad49b01d68659606f8d02d550a1be20eba3160f6763f820b881de87cebf7db4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287280, "uuid": "a46a9e28-2db2-4ad6-a244-65b1b0129adb", "value": "8C838CCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E4D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287280, "uuid": "832faec2-32ef-4165-b598-b9173a232051", "value": "1536:IB240XZfcaaxf+EQliU2haweCAIoo8+BNvMhfvCN:+2d1cBWEQXMe9o8+nEhHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287280, "uuid": "5f50de21-1b56-4f65-a0c6-f700bce13c32", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287280, "uuid": "165057a0-f55b-485f-b218-279583902646", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287280, "uuid": "d36280e8-6316-492d-917b-90c2ed4aa3d7", "value": "1267.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a74f64-930d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617297260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297260, "uuid": "0dbec572-e267-4aa2-859d-3fc88303fd1a", "comment": "Malware payload (Dridex)", "value": "71b08820f05e17c97f452024d8954894", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297260, "uuid": "5e0bf879-8da4-411f-b3e1-8efdfed86757", "comment": "Malware payload (Dridex)", "value": "6f2f677df1410a7f9446b5ef24f65c497bc51ad399ce89a0a01e39472372917d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297260, "uuid": "f4e97ada-6cf4-4b8c-a964-fe14082ee9ee", "comment": "Malware payload (Dridex)", "value": "940b6c4e2c35e53bb9e8f47024924d88362b8441", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297260, "uuid": "92e8623a-681b-4a69-98ee-baedd02da07c", "comment": "Malware payload (Dridex)", "value": "2c3d28c8887670d4b7065b28e520094637371417c0a7258c9ccfb75447beba4f34794e9b19c38e62d3389524f32d34c2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297260, "uuid": "1d0fd13f-c6f6-4705-aa04-b70de4e0bd05", "value": "1C14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297260, "uuid": "d2c8e8fd-299f-4d64-a0ea-f8f8ecda752d", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297260, "uuid": "be11bd35-5c80-45d2-ba03-c558cb36613d", "value": "3072:g1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ci78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297260, "uuid": "2737bdd7-aa81-4762-837e-6b14bfcfa5dc", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297260, "uuid": "00e20a77-8986-4ab0-acef-ed9c8b9885b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297260, "uuid": "eca1d2ef-b85e-4800-b24b-33b486ff5d41", "value": "6f2f677df1410a7f9446b5ef24f65c497bc51ad399ce89a0a01e39472372917d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44429bd-92dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276298, "uuid": "07fc91f9-4e95-4f87-b039-881a9a8a1487", "comment": "Malware payload (IcedID)", "value": "c3704d9b96a5f5b1faec606b6367aaa4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276298, "uuid": "73d9aac5-2064-48cd-a820-60332f489119", "comment": "Malware payload (IcedID)", "value": "6f61e217550272d6a487dc8b9e738c482e50651461514648d4d461bfe5e38381", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276298, "uuid": "ef434a03-a739-4952-be20-eaaa355e229e", "comment": "Malware payload (IcedID)", "value": "712b13d59ea647a524f2e920cf53bd5e8d449056", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276298, "uuid": "8cd276d6-5113-4532-b226-08f9045a2de3", "comment": "Malware payload (IcedID)", "value": "e3cb999363454b85c5d9070166fb4e4bb662726e68e8b08e762ff61dbbdd19363744aeba9975f41bc148938974e74ce5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276298, "uuid": "0ba1611f-ef2c-42ce-9564-d505a334b0ef", "value": "2B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276298, "uuid": "4bd07d68-3272-4a2c-984d-0a238e889a58", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276298, "uuid": "b5e00c0c-790e-4788-9e0e-527e395c0a50", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276298, "uuid": "037a4404-0f1e-4d3b-ba97-eb8782cd818a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276298, "uuid": "5ee5e4bb-1316-438f-bbab-0597aa96ea7f", "value": "document-645019697.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f22220-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279948, "uuid": "8df2ddb4-8f38-4a53-a81f-2b83e44ba836", "comment": "Malware payload (IcedID)", "value": "dbbccd4eca2e29c84cf3ab420b5467f0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279948, "uuid": "39704143-7d75-4d7d-bc41-16b7fc9227bc", "comment": "Malware payload (IcedID)", "value": "6f95a77fb3a48a4a6bbd7dd10f179e8c52931a0f2d1f488b9b5018c92daecc8b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279948, "uuid": "ab0257cc-845c-412d-b388-840e4c241c7f", "comment": "Malware payload (IcedID)", "value": "77768cba7891f29fea541aa085f384db02536d2c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279948, "uuid": "cd04a969-9841-417b-bf4b-eef9d68b6482", "comment": "Malware payload (IcedID)", "value": "0c8d58541bb6404aadf5b89f6689abd4565e26e95cd06ac8e5c643c5cf5f919be74c2ec49ad73c17b8c9ab5063427224", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279948, "uuid": "8775e29a-e96f-44b3-a353-4bb2a6e0f263", "value": "3D044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279948, "uuid": "b40b8781-1b3f-474f-ac8d-12b4fe6b4b6d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279948, "uuid": "f04eacba-0c22-4d6c-8839-3f570ee8e4ec", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279948, "uuid": "06074c51-473e-4267-9b92-b445b6add8b7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279948, "uuid": "f8e1e9aa-d47f-4d71-ab94-6cd76e04e576", "value": "document-852492365.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553634b4-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282930, "uuid": "3940fb5d-d8da-49e8-a20f-f70ac08be085", "comment": "Malware payload (IcedID)", "value": "c5ec3124229336ba92a7b3c5bb0380f1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282930, "uuid": "53b5fc9c-4c5f-4c41-84c7-73cec5b23f9c", "comment": "Malware payload (IcedID)", "value": "700ad69d87a82560c7ba3ec439e187e23e3507a3e10446661042208b1624e818", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282930, "uuid": "ce4573e3-2dc6-4ba5-985f-df82c3a6a8ee", "comment": "Malware payload (IcedID)", "value": "0fb11cb509f79ab0c66feb6b64653e48fadd92e3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282930, "uuid": "b60bf0a1-5a5b-4e1a-9dab-0f2d97cc5956", "comment": "Malware payload (IcedID)", "value": "59bd73b3eecaae5467511828b708e5af89f89aac188be245e7f87accbef21e6c37b4b62d1b46805792a0d3574086d84d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282930, "uuid": "37bda656-c1ad-4976-8381-787339f24e9d", "value": "16044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282930, "uuid": "61ffb818-e75d-443c-96eb-fc55fe176480", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282930, "uuid": "7c2708ed-3e17-44ff-9d2f-04e7761a64df", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282930, "uuid": "9e989734-977d-4d85-b06b-d5403afc522b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282930, "uuid": "c7299c10-a522-45e3-b883-14485da56f27", "value": "document-1287840868.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2386675f-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291437, "uuid": "3fb41495-f2cf-438f-8ec6-a713258fcd55", "comment": "Malware payload (IcedID)", "value": "b069b9939b421dfe88636a85261b36fc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291437, "uuid": "fd8fdcbf-ae1f-4a35-9ede-1c7f73394851", "comment": "Malware payload (IcedID)", "value": "705016c2765ddd628c27a7897175c39effc2975d28b29c251075f00bf8dc12ed", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291437, "uuid": "e93f26e9-61d4-4c8f-bb89-7e0579678e39", "comment": "Malware payload (IcedID)", "value": "d6ca22b005a022a51b2e523400ccad97efd200d5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291437, "uuid": "bfa6b156-fbeb-4fd1-b2be-cc4290f50771", "comment": "Malware payload (IcedID)", "value": "a79bf76e2db84facca78a7b1e700c004440348f9281b22597be979fd17908e9ccd8fa53cd17c584f0a62322259e0099a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291437, "uuid": "677de5a3-9d24-4594-a11c-953ed226f8ff", "value": "F3838DCDC913E1D9C2519FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291437, "uuid": "27efa3e9-7a89-42be-b740-6128042ad341", "value": "1536:IB240XZfcaaxf+EQliU2haw/NCAIoo8+BNvMhfv9Z:+2d1cBWEQXM/N9o8+nEhHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291437, "uuid": "588ec620-ef89-4c08-b69a-289b1ba59f71", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291437, "uuid": "9546c09e-8cf1-49cb-a0e9-70c511f8f583", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291437, "uuid": "5956bd10-980a-4c5f-8f89-ca6a4392dd7c", "value": "796.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfcc65b-92fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289761, "uuid": "dec687e9-8193-4c88-b163-4dd666c08b5f", "comment": "Malware payload (IcedID)", "value": "d7d069871e84fb92813d8fc7e0444f9c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289761, "uuid": "a2e475b0-e450-4790-8560-ae56e7a9ca04", "comment": "Malware payload (IcedID)", "value": "708950f8e4f32151e15cfbfc48b7c435d224d2cdae4c929073bd9c44818f0cf7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289761, "uuid": "69aa352a-6b6d-4236-a5f2-a1cfb6d98848", "comment": "Malware payload (IcedID)", "value": "0b1a43e9fa7d1e7663eef94ab5d1a5b7835bf973", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289761, "uuid": "f80af452-0103-4c8c-b274-7ecc7814ec02", "comment": "Malware payload (IcedID)", "value": "5910dd6b82ac08c859e3373f67200042e528315f2a5a99049074b6a6146086eab716bd1de10227bb15e85933d88a2916", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289761, "uuid": "2ff7203a-c7ed-44bc-bd1f-dd105945500d", "value": "46838DCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EA62E0C42FA84A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289761, "uuid": "485e5bf7-d2c4-4be4-8bb6-4a08787a4a63", "value": "1536:IB240XZfcaaxf+EQliU2hawOCAIoo8+BNvMhfvs:+2d1cBWEQXMO9o8+nEhHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289761, "uuid": "b875c18c-ae1d-44af-92d7-865f4c81e0ea", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289761, "uuid": "b6cd21ba-5575-488e-9c66-ae53c2793559", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289761, "uuid": "d155220b-b73c-4d48-a801-0ca2bd3e797f", "value": "650.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed28265-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277524, "uuid": "f8abee47-30ba-4032-88b7-bc5facc4d572", "comment": "Malware payload (IcedID)", "value": "e7055ce63dc908cf3b19fb63896d31f4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277524, "uuid": "2c4f05ea-554e-4f64-93b0-1cebb560ae38", "comment": "Malware payload (IcedID)", "value": "70b128683ec799e0a313f62430cb74aee18f891c7480c680a23fa1b208f2156d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277524, "uuid": "a4bc1502-a0b7-4ffe-9f5b-20bebe6bcd17", "comment": "Malware payload (IcedID)", "value": "0e4dab61a4d5c2e3b6fa2bdbdc8382de07aeba3a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277524, "uuid": "d5012c5d-5be4-4f20-a9fd-0f3972921a4a", "comment": "Malware payload (IcedID)", "value": "463e62e3f17379193ec97f201e04c4d7145f318161081056fb8462b2bd87add21618947ea88d4de26490e4540e6e6607", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277524, "uuid": "1908ada9-5471-4cec-bea1-13c8e55c2098", "value": "B3044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277524, "uuid": "9911534f-4180-4298-bf36-2e180f10b319", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277524, "uuid": "bb5c5d87-e4b1-4c55-b6d3-ddf54863e148", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277524, "uuid": "41a6fabc-a0d2-495a-81d7-145cfc2e7bb3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277524, "uuid": "a2e5c0d4-eb52-41bf-972f-c8c4574817ca", "value": "document-2088288517.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62db0de7-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274363, "uuid": "54049e85-bbb6-4474-8124-fdaff4d9ff63", "comment": "Malware payload (IcedID)", "value": "8c2d8c0a2781e190ac184842e9cf1ce3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274363, "uuid": "001b5280-ce31-4bc6-aaa6-5c89554105d9", "comment": "Malware payload (IcedID)", "value": "70b5231670122d2c82ebe18166227fcf66404983d685e84c5c0b0946a842b985", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274363, "uuid": "bfa20bea-cdef-48af-b8fe-8119d3bfaa1f", "comment": "Malware payload (IcedID)", "value": "56b480462dc7cdd96c1efe936d4c8fd4a1c52e00", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274363, "uuid": "b69a1200-45ba-4700-8d2d-9dfb80f77eb7", "comment": "Malware payload (IcedID)", "value": "bb3f84e286d28b3a2e087d2870fde1180832119cb0496e385c8d39a8c49204536334ebd5f3d3b6aa229bafa6453feb1e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274363, "uuid": "bf0a7029-de82-4014-8ca2-12a96d928066", "value": "DE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274363, "uuid": "adf82a13-1c3a-4f2a-921e-3848c7d87bd9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274363, "uuid": "037dc5d2-78f1-43e9-8607-b4645c9b15d8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274363, "uuid": "749e6fbb-26b5-407a-9c6c-f6c32ed48d3f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274363, "uuid": "c2be52b9-964d-46c5-ac24-e7aa7d434e19", "value": "document-891948743.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cadf00-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617262159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262159, "uuid": "99313eb0-62ab-489e-942b-f5c1d98a3917", "comment": "Malware payload (SnakeKeylogger)", "value": "e8c71e5234844c5c5bb1bbfcc2e1017d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262159, "uuid": "ce8e605a-abc1-48ce-be5b-8b5c9b0ef233", "comment": "Malware payload (SnakeKeylogger)", "value": "711f4cb1949bfec693a614472ac348331b024c40cb51179b9c7ee1a06287750f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262159, "uuid": "000f21c5-0aeb-4a6e-a61c-157b25d42c4a", "comment": "Malware payload (SnakeKeylogger)", "value": "f16581dc5c033b26f0e1caac16f96d39107b5e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262159, "uuid": "a46e45aa-d9ee-410e-904d-7efaa25b61a8", "comment": "Malware payload (SnakeKeylogger)", "value": "1912f8e072950fde1d81a7e64529a7e168b3e19a60c148dcfd2309964b3c16c319346a72726ff606a765fd29eb94c75e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262159, "uuid": "b9e9a6b3-10f3-4316-b544-f236219e931d", "value": "6CB4D0F432C45B14F07AFBF8B8A0111083F5A43EA6D2E7491D9911CE1972FB199A6E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262159, "uuid": "b18abc75-5a13-40d1-8bd0-0a9d0ea0b44a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262159, "uuid": "949e9ced-a231-4278-9824-2e2871293b5a", "value": "12288:fymHH/3UsA+OfT+VrJJVx1LYpI8J3pIx:FfUfyRJJ7dY68JZIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262159, "uuid": "a3b056e8-3023-4b07-bd75-c08e80b72123", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262159, "uuid": "1ba40574-ed15-47e8-b218-50e3924579b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262159, "uuid": "41f0f478-2ae5-4ce9-a1b9-1d8e41cbec20", "value": "QUOTATION_REQUEST_ORDER_00988_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd92a9d-92b0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617257066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257066, "uuid": "1af4f738-9b66-428b-b6d6-84861b01929c", "comment": "Malware payload (AgentTesla)", "value": "182617ded6c6228d4c531327635f465c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257066, "uuid": "8ad98b3f-799f-4698-b7d3-7660d849b9bb", "comment": "Malware payload (AgentTesla)", "value": "7135a74fa92a4c7e3cdc8839da6ba521f11778d4ca2b31b713256f419ee2a4a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257066, "uuid": "7ccf3e47-5909-43cb-8550-0c7ed8017d7a", "comment": "Malware payload (AgentTesla)", "value": "3c4e40e3321a3672d335ae6e594a37b294124d5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617257066, "uuid": "0367341e-7fb5-490a-8621-08286a7e0443", "comment": "Malware payload (AgentTesla)", "value": "c3293d075d5e3ca92f384c782278468fa64a5a54d789ea741d763b750d1fafc70be45381fbb35d3dd1e61e82ff343218", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257066, "uuid": "379ae160-0d7a-4ca4-84f0-977afdb88bbd", "value": "8284AFB876047DE6666F576BCE96ACDD13B61B239ACBA4CC806477C305A3361FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257066, "uuid": "00bc3f95-da3b-4572-acc7-417ab12c9198", "value": "12288:I2qmG4VLZM9kEH3jntcuT0RgZAIIN9Zwe/Tm5:nv9Ny9kEXjyuT36IIN/TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617257066, "uuid": "59402971-8bc2-4845-9aba-f14e6c79f6b6", "value": 405163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617257066, "uuid": "86f232fc-4e36-47f7-8825-c0ac742db7c0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617257066, "uuid": "15231e2a-d9e5-49a9-8f9f-8f32f882eb2d", "value": "Purchase Order_3006164.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531b3621-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274766, "uuid": "237174dd-ef66-4c37-beeb-6fede11071ef", "comment": "Malware payload (IcedID)", "value": "04611de6e093eb25cf0e7257fb06d25b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274766, "uuid": "da1d0dcf-9c46-4838-b5c4-69f22745ae98", "comment": "Malware payload (IcedID)", "value": "71545c2a90bca2324792c7b721f2d811d03ef20aaa175b417b966b0091aebb1a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274766, "uuid": "21ffc36c-de52-450b-91a4-8f210d546221", "comment": "Malware payload (IcedID)", "value": "d9e600644772b1b7b290e2d034d9b9eb2f8bca45", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274766, "uuid": "476cccf4-37f6-4a05-814d-058df4749ed1", "comment": "Malware payload (IcedID)", "value": "deb4457f1082bbf2b295041606dc5f44ac52455cfd4abb27a6ad2b024cc20f04fb5e69134c5277b8d177bda5c8d97ade", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274766, "uuid": "e6a36155-e538-4bf3-ac40-38c5a293364a", "value": "5E044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274766, "uuid": "702b50d8-c26d-493e-be66-7c9da6fa6850", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274766, "uuid": "1ada6c68-3630-413d-bd18-6409a0a8e4ae", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274766, "uuid": "95fa44a5-9172-40c0-bda6-b06758fcedc9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274766, "uuid": "75e2fe14-d8ad-43fa-aa78-0c2b84fe4589", "value": "document-320163579.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b72d47e-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278135, "uuid": "47f9a2ee-aef8-48d9-a164-ff3fe1da7ab4", "comment": "Malware payload (IcedID)", "value": "6cbda4a8347c56cfa623b627bb10ab42", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278135, "uuid": "38395ee5-ce0f-4f14-9249-e133cf86287e", "comment": "Malware payload (IcedID)", "value": "7167b9d9d3096f8a6fe246a274f6e262011e00828611005005bc0130227d8d77", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278135, "uuid": "c67fb392-8ef2-45af-9860-4f98d7473d84", "comment": "Malware payload (IcedID)", "value": "e1e12d6780606858152389ecbbf2f85b69b6ffcb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278135, "uuid": "88c39a38-a747-443f-8605-5ee489deae88", "comment": "Malware payload (IcedID)", "value": "81371475fa6ecaa55d5ed540700fc23a179d8ac5af65064939d462691ea68afbfc3731cbf69d12811ebcae8ec00f68fe", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278135, "uuid": "5d2f53fe-b978-4432-b614-ca4f5f7e32cd", "value": "95044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278135, "uuid": "d8267433-a3fc-422f-a5c8-7d8a88e2a410", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278135, "uuid": "676c08ba-68c8-4ae7-9697-dd6a391c543a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278135, "uuid": "4d498f88-47d6-48c0-8547-9931831adb62", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278135, "uuid": "8abc96f4-90d4-4031-91af-7c1f9a1adb23", "value": "document-2101954527.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2d790e-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617287745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287745, "uuid": "5e65a16a-d04f-4f18-bc1f-4464979a56a8", "comment": "Malware payload (AgentTesla)", "value": "6cb32913a7ae47d09aa93c0ec8fa35d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287745, "uuid": "7d4ac68c-a677-4363-a018-5909d6a966ea", "comment": "Malware payload (AgentTesla)", "value": "7174ab0eecfd18454318228d477aac91b03b3c873919e3bc44e9cc067a09dcbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287745, "uuid": "fd4c2c80-b301-4e85-9d26-0a9b7b5eab1e", "comment": "Malware payload (AgentTesla)", "value": "840ac4fb19e816ea939ee68684ea0ad6da4fa9b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287745, "uuid": "b9369587-636e-4f0e-9a39-6a2c7d556a81", "comment": "Malware payload (AgentTesla)", "value": "c096ce77d802dbb4c810daa493bccd5b381ed528d6961345df85ddd61c13412606e52d8f2035e8a6d6c03d9b8cc3876a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287745, "uuid": "d34ca1ab-49fb-470e-9f5e-746a2ebc1935", "value": "01259D193F14618CC4AB0B395854D04CAFEA7DA9AAD7D2837EEE33DB6073F1306A4552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287745, "uuid": "d714b01a-3205-4b59-8674-60c11ba23c9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287745, "uuid": "e608f40b-2832-4c74-8596-aa6a5f6bedaf", "value": "12288:XYsTIpYu6KLLuGIzuKn/aVD0+QLLxf5gACHm0zHxe3Z:XYppYSS3zfn/8DgXxfWAePzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287745, "uuid": "1cdcfcff-f5ed-45b8-a778-73ab84802617", "value": 1051648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287745, "uuid": "63cf6bf4-48de-4533-9228-b18b31a6315c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287745, "uuid": "cc673901-4abd-4c55-a7cd-b49d867e662b", "value": "Proforma Invoice No.42037 USD.78116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3451ef83-92ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617282016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282016, "uuid": "daa427ad-71b8-4ab4-a97f-b1392f6477c9", "comment": "Malware payload", "value": "8331855b6ccd90717868f3cc37f926dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282016, "uuid": "b869c5cf-d937-4ad0-9b8d-3ba02e541f02", "comment": "Malware payload", "value": "71abd14acb029e32561f0cab50ac4fc315e2d9371e1f4ff55180b175af39a8bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282016, "uuid": "48472661-11ff-466f-98ef-6b36fb20835b", "comment": "Malware payload", "value": "a8304c7ea766d30e1f258f4ba29c919055fa7814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282016, "uuid": "3aaced45-9c5b-408c-aae2-dfe99570fc50", "comment": "Malware payload", "value": "fca9fa62804596d50d20f124e612026705d0b2f8ac1a3f2e3e6cf9170e3d0cbb6ec3321b4003379b848a0bc8d33dfa07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282016, "uuid": "7cfe2064-6d82-4f0b-94fb-8a23b81ae9dd", "value": "E1A57C66A8A610F9C6BEE0348552A322B8713CB587353FD32ED426A90775FE8773D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282016, "uuid": "b42f161d-a227-4700-80da-acb348b0c53b", "value": "24576:Kg5ZNb6XQrOOg/3EYYi1M+75gdUNRG/kJ/x6BEMgqjkvargwyGmzDJMcNmZgXJyC:KCb6X0Vg/3EYYD+75cBk5+TrlmVNm0pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282016, "uuid": "1a98abc1-9d47-4aac-915b-015657d61a96", "value": 2245152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282016, "uuid": "5b868e74-edd0-4cff-a2af-1457c08665f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282016, "uuid": "bc4fbb82-54ff-48ae-9b2f-c0151ab3a935", "value": "8331855b6ccd90717868f3cc37f926dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80c75da-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617262024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262024, "uuid": "c1c48275-2142-40f4-baa0-6fc911c8bd88", "comment": "Malware payload (NanoCore)", "value": "98152ef5e7363ec1d7083e4dbb0c84a0", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262024, "uuid": "1bb67f02-2b37-4908-b05d-ba9d3a664d5e", "comment": "Malware payload (NanoCore)", "value": "7209fde1899cd174cf3997716e3dd69a91316f096c9d04b2196661cd19471044", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262024, "uuid": "00bc9490-bceb-45f1-bdac-22e1c5a4b1fc", "comment": "Malware payload (NanoCore)", "value": "4bc18ed8dfa050e53814888d09c816396aaa9f72", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262024, "uuid": "b016323a-882f-46ec-9f66-4a7b380201c6", "comment": "Malware payload (NanoCore)", "value": "46d7069f0b6ccbf99156ca4d09093548e2625dc1050edee614368456440349b23716a602cc578f149b5c955c6705f869", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262024, "uuid": "9603fcc0-e802-480d-9e55-c57f34a2756d", "value": "660523F496167A4F312FB4D7225F5026643747CB89C10B6411BBBB43B39E766B2BE020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262024, "uuid": "7fb29b94-37ee-40d4-89ea-edc190419935", "value": "24576:WYezt5tDadJDItLmC+3/oPh5YSDrg+eUtytfeFPE:WfzXthqC+vOh7fLctIPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262024, "uuid": "9bb744f7-6c1b-4bf1-ae3b-bea9a7869527", "value": 809124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262024, "uuid": "5040ac50-7ff8-4e29-aba3-8bb22913e3ec", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262024, "uuid": "70ac2593-7c03-4b23-9e88-664808ca6153", "value": "QUOTATIONs280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f280171a-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275033, "uuid": "95aa6a31-ed85-432f-b89a-5dde2288777f", "comment": "Malware payload (IcedID)", "value": "02e792c5f0e92c49ed72fd6c3c43a9be", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275033, "uuid": "40b7b3af-f62f-4df9-841b-4b1f82129b73", "comment": "Malware payload (IcedID)", "value": "7257e21e4db17c1d5fdda8236c2985303f40568a3b01d4d539cee6f77cafcb48", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275033, "uuid": "08d3a032-70e6-4658-9de2-09730c079535", "comment": "Malware payload (IcedID)", "value": "0ca3d4060fa7b62554f1af4dab76b09da4dda445", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275033, "uuid": "0f553f6e-62d0-4ae7-97bf-9569fe3417b6", "comment": "Malware payload (IcedID)", "value": "cb06bbb6bf8674f371a3b084964255585459293bac319d3d18414a2c593d11220c3a4ee7c178f8aaec54a7344d111827", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275033, "uuid": "fe76ff1d-9205-4f02-ae5c-7c72dbc72275", "value": "2B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275033, "uuid": "6edf165f-aae3-42d3-b66c-2e0d02994629", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUf:4PmxIEudkLeXPD/PjYwe2DMo3S/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275033, "uuid": "5fdb1c69-2830-479c-a072-0434b2edd0a3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275033, "uuid": "1f81c9be-ef01-4825-8dd6-32eafea35eb6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275033, "uuid": "bd3f5983-97d8-48f4-9c38-18f1d98edb8e", "value": "document-579823191.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac25be46-930d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617297249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297249, "uuid": "59d66f63-28ea-4e53-b444-bc3d4b4eca69", "comment": "Malware payload (IcedID)", "value": "c9ae0fe8e8ed38957324e881636fcb4d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297249, "uuid": "66402ba3-57d5-4637-8009-c3d9172bb4d5", "comment": "Malware payload (IcedID)", "value": "728de80a88d63c076e45c280189d69153776176be6ac6318cab9fb138dce3e57", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297249, "uuid": "5890170d-18e4-40c9-a997-40c4557194b0", "comment": "Malware payload (IcedID)", "value": "68c554fcc8937902e095e13de9b6570d04e649bf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617297249, "uuid": "fed66f4b-6439-4699-8708-0390d4f05a4e", "comment": "Malware payload (IcedID)", "value": "72fd685562c8b382b18459312a2089630ec87f214f720a5fba536ba90905d6d02cf3dda0ce2182f233470fb15acff241", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297249, "uuid": "9cfc9800-c7b2-47eb-b55a-a401ce3338b9", "value": "B904123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297249, "uuid": "4e8bce2c-404a-4ea9-963a-154119e75fe0", "value": "3072:XXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:HE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617297249, "uuid": "40b441ce-7acc-4706-b2bb-6ded48011e19", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617297249, "uuid": "7bb76443-0127-4cd7-886b-fd67d046c0f3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617297249, "uuid": "fad1b4cf-cfab-4a0a-abb6-905891ae0334", "value": "71887884598-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6127fe0-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280918, "uuid": "c3bf3207-e52e-43b3-bab8-59b651b40671", "comment": "Malware payload (IcedID)", "value": "c1d4b88d7b8389eeac465d186b247921", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280918, "uuid": "b7f09f6b-3dbf-42d0-a168-3d54104f3e58", "comment": "Malware payload (IcedID)", "value": "7292a64c1141e3e229c757aa472f91c2481288c0391a35996106276b1a6dbfd3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280918, "uuid": "1d976e06-34c6-427f-88d5-5987a1df59b5", "comment": "Malware payload (IcedID)", "value": "2917a941f6ca7f9016ded95b7772db78159ac599", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280918, "uuid": "5c217c61-c3ba-45a7-bc51-72e0f0b318f8", "comment": "Malware payload (IcedID)", "value": "dd57f5abc3138f68814647bbb2c5a26081087957e4028d8666d99eca8abe2e05d4de6a87ce05078012484fc1d64fff8a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280918, "uuid": "02f17a5c-2fe1-4c8c-9f8d-3c1be9c3e537", "value": "2B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280918, "uuid": "c64ee93b-01d6-48fc-bb35-1262e87dc966", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280918, "uuid": "11b7b3a8-71d5-4a28-a630-918fd52f93d8", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280918, "uuid": "3b5b6cb1-bf17-4a75-9ca4-d44cec65ac7f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280918, "uuid": "c68fa9e9-a6ed-4220-9660-1893866d85f1", "value": "document-1783542022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70afac16-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617261931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261931, "uuid": "3803be81-656f-443d-95f6-a636d2983950", "comment": "Malware payload", "value": "a0d54c3a394a0bd7d96a690006a49389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261931, "uuid": "c371e50e-f5ff-42e8-8d5c-247e857ad42a", "comment": "Malware payload", "value": "72b904030ccd607291ad1f2f0e3e083377c0a3dbec8e0b63c33f127377598b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261931, "uuid": "bedd6a55-700a-483d-8b11-b1997cb2c825", "comment": "Malware payload", "value": "3033d3522b583ccb6f5330428cfe67a5f89660da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261931, "uuid": "de83d16c-3e36-40ef-96c8-53ee82687d52", "comment": "Malware payload", "value": "65c13c520b6e714f59b3e5300f4b4a874a8b0571ce0a6e652a68a370b2ad055b7b0fbced482973c5da206478c93eb85f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261931, "uuid": "976b273a-bbc5-43b9-90bc-dcff595d232c", "value": "7884E01AB7D20E87E9BA6EB12F9791F042B3B85B1FA7464B7640723D2821F114C9471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261931, "uuid": "8d62c39b-6135-48d0-9b67-7262048e09e6", "value": "ce1c6fdc67e50426e322780731487a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261931, "uuid": "a58635b3-ab98-496b-8587-7e28e92cbe73", "value": "6144:Aun1cb71S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYRn:AQ46A9jmP/uhu/yMS08CkntxYRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261931, "uuid": "d3ea0862-5339-4826-baa7-9feb66f37241", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261931, "uuid": "8c3e038f-0c74-42a7-a430-f06edc081907", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261931, "uuid": "9933c50f-a72c-406c-a598-9a2c18c42dbd", "value": "Payment reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f6ba03-92ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617255952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255952, "uuid": "46aac052-52c4-4f01-832b-26b3706cf778", "comment": "Malware payload (Formbook)", "value": "a5826b579fd6627d89bed75077d84921", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255952, "uuid": "16d15ef4-7563-47a2-84d3-c1f652eadb0d", "comment": "Malware payload (Formbook)", "value": "72c1771b872c9fdd4f61b0a78caaa0728f235ec0237271caef24d7bf07a58706", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255952, "uuid": "016aafd7-5aed-438b-8f9d-c83bd0513ad9", "comment": "Malware payload (Formbook)", "value": "fcb90ab48a43a87205de3c6b213e0aaa5aa90a76", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255952, "uuid": "c2209058-b84a-4a44-b8bc-6d5fef20ba47", "comment": "Malware payload (Formbook)", "value": "54b713f53c306cb4818f88c8eb2e149d910d2b8ff83026629aae1b386450f2e8750a71bc3de997b44a3811da086455a0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255952, "uuid": "c67c6062-9e6b-4fa8-8857-49e239e2f7ce", "value": "45D423DDA502805A0B4A80EB9AFF5D231DBA2F60B36F13543445D8F54F884E6ADB8737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255952, "uuid": "77819fdf-5252-4177-9739-9234885d8aa4", "value": "12288:DBzwWc6yGOpkSbnAlNMMBTDfJiaUDhmok0CrHsTzxtsZM:DBzyVbnAlGMT6Dhm6mHsTNqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617255952, "uuid": "64e93e3d-062d-410c-9602-348983cee332", "value": 644451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617255952, "uuid": "0d4e83a3-7631-4c08-8206-03a4df9a273a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255952, "uuid": "4fa66bd5-6010-494d-b089-36b78d21ec39", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9c427a-9302-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617292368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292368, "uuid": "849468d0-ad86-4345-80cd-8dc4da4d30e7", "comment": "Malware payload (IcedID)", "value": "8bf24ae315d38c15916e8a5cc2c01d71", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292368, "uuid": "a4f16358-ad4b-472c-8bc8-e5573c261b2e", "comment": "Malware payload (IcedID)", "value": "7351f01ee5f737d6445ef528c9c3351e622d3678b0739ce28a6c28471d796504", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292368, "uuid": "78881c53-d687-47dd-9e88-4f38dce11a34", "comment": "Malware payload (IcedID)", "value": "584b377e6074d773358793a51967d0d58b386f74", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617292368, "uuid": "8cd46982-497c-427f-aaff-003049234560", "comment": "Malware payload (IcedID)", "value": "3fc8f22cd96cba32f7edf6005e3b97b1a577d0d6b36d52a58f01719c836e18b04593253b6bcd5e0362bab84dff40108b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292368, "uuid": "c5632c55-2faa-4d80-9c12-2d1f516ed222", "value": "F8838CCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EAA2E4D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292368, "uuid": "f0a7130f-0e9e-4d2e-8579-05b63f36c805", "value": "1536:IB240XZfcaaxf+EQliU2hawWCAIoo8+BNvMhfveT2:+2d1cBWEQXMW9o8+nEhHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617292368, "uuid": "164f7e70-230a-44ec-8fc6-944dafbb1227", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617292368, "uuid": "0ffb693f-d02e-4cff-9f88-6bf91ef545bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617292368, "uuid": "cf33f4dc-19bc-4138-94e1-f8baa1aaed1c", "value": "3020.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127c5d37-9298-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617246740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617246740, "uuid": "adba87ae-efba-4635-a978-1e8860b4f211", "comment": "Malware payload (RedLineStealer)", "value": "5f83d79a4a7452a664f1a2e6fca59b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617246740, "uuid": "85044646-0c7c-4024-84ec-27ff6c5e9234", "comment": "Malware payload (RedLineStealer)", "value": "7375880cb7ad8093bab87493b67bd963227bac916deba2f2fbdf0a0084543bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617246740, "uuid": "8612364e-5fa9-40b3-9f4a-6780c06c609c", "comment": "Malware payload (RedLineStealer)", "value": "70a4cd1d86b487399acddb1e31898c674d677307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617246740, "uuid": "a7243efa-78b1-4eef-8106-a704fba67888", "comment": "Malware payload (RedLineStealer)", "value": "d1bad2f11a3785129d56e3c9976a59f732133dbb749108db0771b1d12a8085647d07a8e878fd2694cc315ae62e9de357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617246740, "uuid": "743e6add-afe3-4a4d-8684-6975d668942f", "value": "2AB4AE627190F272E8B6513545D2CA61092A3CF2476D68D7B3D877FE0E322919F362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617246740, "uuid": "bce01e46-a4df-4762-b734-0ec44a9ef9fb", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617246740, "uuid": "a396fbbb-414a-4a7d-9efd-50a98923be9c", "value": "6144:eDKW1Lgbdl0TBBvjc/s6LjtTc9Zyul7/H16SLJdfm:4h1Lk70Tnvjc06LjtTcTHl7PUGdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617246740, "uuid": "d885317c-e298-46e4-979f-c7434e39aecf", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617246740, "uuid": "6ea22a82-900c-4ea2-bc09-0516ae9301a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617246740, "uuid": "811b2f62-0180-4882-9781-503c6dbd50e7", "value": "5F83D79A4A7452A664F1A2E6FCA59B94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b32534-9306-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617294225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294225, "uuid": "ce62d959-af3c-4908-a3e2-a04cfa5aac23", "comment": "Malware payload (Dridex)", "value": "ddf7b0209a35f411fa6d8423732681f2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294225, "uuid": "a4e3e1c7-4e7d-4c51-8010-743d16c5039a", "comment": "Malware payload (Dridex)", "value": "738d755c3006a6168036291fc2568c7c69f16689ee75b052aca4f8875b17dba6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294225, "uuid": "a6926eba-2c00-4631-bf2f-df867d9e1f6e", "comment": "Malware payload (Dridex)", "value": "2562bb2580bbcdbc670efa003e6d9310b7c09b9c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294225, "uuid": "19801032-fbb8-4f5f-9302-8fea700be434", "comment": "Malware payload (Dridex)", "value": "a6669e810c08793afa64a6ccfb127d824ec3b1aa277a36f0397a162b48a247abd3cfda0ddc38c7c50b407dacdb86cd6f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294225, "uuid": "a52bbc4f-828a-4cf1-ae1d-3ff8720cb964", "value": "B714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294225, "uuid": "33e07011-c9f8-45ec-8d25-a8dda0229382", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294225, "uuid": "f0f2efbe-b18d-4bbe-b6d1-424555c31f32", "value": "3072:Copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:VpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294225, "uuid": "13cdcd91-becb-47e2-828a-27c5fa86fcee", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294225, "uuid": "212102a6-2c69-4904-9045-7dba59f3e815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294225, "uuid": "b26377e7-5977-4708-8b3d-7dddc5371ab7", "value": "738d755c3006a6168036291fc2568c7c69f16689ee75b052aca4f8875b17dba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea95c53-931a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617302568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302568, "uuid": "697902bb-db9d-4f25-a157-372246c6ea75", "comment": "Malware payload", "value": "4538c6d51753e0dc3639bf952e534470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302568, "uuid": "f32e0031-9ea7-4a3d-b580-98528b2fda23", "comment": "Malware payload", "value": "739b4e4e93d474642ec7b95b9e1a42d3bceecfb0fb3497abd7747ccfff228152", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302568, "uuid": "a811a71f-4618-42c1-a480-c79923287fac", "comment": "Malware payload", "value": "f1fc9e590e7f0265b1bde5c8cb5d9d37bf523720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302568, "uuid": "c4281200-c7ee-46f7-8ce5-d5b0543a08d9", "comment": "Malware payload", "value": "31f02bd42835c6c19f9245bda19543c53fb4afefc530b8aec7dc711203f7b89bb6d047516d5d23acd5df12c344b1adba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302568, "uuid": "dd8caf8f-7cac-4280-90d5-e9d42fe50f54", "value": "1135022BBB74051AF0C241B1195499B75B3AAC3262969C0FF7839E1C14F2683F9F176B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302568, "uuid": "4d10f37e-55f5-40dc-8e1a-fb64e7898b6c", "value": "12288:VfXKDZ+P0rMoV1JsOs8tEDO7y8xL9WFoHLBVfeg/fXvf0JoAXtUrAWacPfXf1myJ:xK4PWB/sf8iD78xgIvf0JICiNcSkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302568, "uuid": "8dd1d1c3-dab8-401c-8e62-2a9b3d19f3c9", "value": 1090119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302568, "uuid": "9283df18-2f80-477a-9ad6-ed636bdc3b7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302568, "uuid": "b08357d9-0cfc-4dd9-9b79-075773c9b190", "value": "4538c6d51753e0dc3639bf952e534470.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1faa5f2d-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291430, "uuid": "d68b1ede-b52f-4bf1-b4aa-234d2a6be81c", "comment": "Malware payload (IcedID)", "value": "5ba3275b533b0d4315a3a072baaf1915", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291430, "uuid": "c31d2215-7f21-4e6c-8259-0b958df5053c", "comment": "Malware payload (IcedID)", "value": "74651f49c57a7e53596912ed64408f59fd7d5f9673e238f7394bcaaf5c94680c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291430, "uuid": "c86a8dcb-b2b2-42da-b424-15c812d0b5ff", "comment": "Malware payload (IcedID)", "value": "2a675df1946d49b14aac2f331ed7408a15204fbc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291430, "uuid": "0483305c-b003-4962-b3b2-68545d91de57", "comment": "Malware payload (IcedID)", "value": "3aa40078fcb7bdc4428079b21ec541cfa3b69596b1ff4475c8eddf0983c634a683f41b73018211685fdf52a7f81063d6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291430, "uuid": "2796a85a-b99c-44cc-b4ee-1d1198092671", "value": "47838DCDC913E1D9C2559FBD5A0A308112F4E0B7276FF11B148EA62E4D42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291430, "uuid": "2d5a7d0b-88e0-4744-82b3-2dc713f56e5a", "value": "1536:IB240XZfcaaxf+EQliU2haw4yCAIoo8+BNvMhfvfq:+2d1cBWEQXM4y9o8+nEhHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291430, "uuid": "60e88e1c-d4a5-4da3-b963-a113efc4170f", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291430, "uuid": "96fc3d70-3ad2-4dbe-9972-b2b3c11b3e59", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291430, "uuid": "de11d578-d2bc-401d-8106-0a36769ba33f", "value": "1244.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d263c9e-9309-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617295426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295426, "uuid": "4c2c1c4f-155d-453f-81ea-72c20b406dde", "comment": "Malware payload", "value": "2fd0355eaea3ee14c9ad49daf266cbcb", "object_relation": "md5", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295426, "uuid": "48b61728-a47b-4fdd-907d-0970f9292361", "comment": "Malware payload", "value": "754ab7c2050696e0d2010dc98f8138f6634abd10b8089a0b5bde2453a61d98bb", "object_relation": "sha256", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295426, "uuid": "319aced1-ad76-43cd-83cd-9181c0e8684b", "comment": "Malware payload", "value": "fa6d6c4cf75403f975d9cc89bcfe3210d838e4a9", "object_relation": "sha1", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295426, "uuid": "28115846-c0bc-48ef-9246-4575fdfd2dbd", "comment": "Malware payload", "value": "da6d456bcbba17e1911360d15b9cc4162563e38cd226717528834ccfb0e9d3f1b7e07c040809ffa1ab35b733b7a305b9", "object_relation": "sha3-384", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295426, "uuid": "742df031-59f7-4036-b439-3cc94bb58b36", "value": "23F533FA4EABDD85E52FB364354E98F16C48178DD6B039D201E32342C994B4D9E3F2A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295426, "uuid": "67c49fa7-fa66-4df4-b804-06f82e5f5317", "value": "98304:nqLzVpE2IBi0qG6B6gyHf1KkhFu+AiTbXH4vSp:q7ELFKly/1rFu+AinHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295426, "uuid": "32f4faca-12c8-41ff-b3be-46f54f197a02", "value": 3487857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295426, "uuid": "ea4af12f-d0b4-416c-8f58-a0af21fa7941", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295426, "uuid": "8a95bab3-19dc-4097-9f02-fea810feff7a", "value": "Private doc.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e25d22-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282503, "uuid": "1530671a-f446-424b-97c4-5371cdf63edc", "comment": "Malware payload (IcedID)", "value": "b7f2ed4a65b04b151ff9cc7bb4c994f4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282503, "uuid": "6b16ca87-93dc-411c-bcab-f994b76b1e70", "comment": "Malware payload (IcedID)", "value": "758678307cf1a5c3a9226b90420bef9b4f8d26a6ae5ed0360c564decdc2f017d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282503, "uuid": "885a0692-6263-4644-843c-27657db41a47", "comment": "Malware payload (IcedID)", "value": "330850f244bf2adb75d87c9959aa76fa657748fe", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282503, "uuid": "1fef94ad-2a59-4b0f-bc56-b871ccf9d73a", "comment": "Malware payload (IcedID)", "value": "ff59049fe64affae020f22af4742dacfa0c546806ff8009d6b7c35d1241bdf05374a127cdf4f2bcad7d1f1412782b65f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282503, "uuid": "d158cb19-faf0-4238-88d7-6c2460f44706", "value": "83044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282503, "uuid": "9e69aa5a-2b48-4b6c-bdf3-d8c369f8d7cd", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282503, "uuid": "fd20b960-0b54-4204-8c1f-7622dc0869fc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282503, "uuid": "2a2e06ca-91bb-4e80-881d-12888dfbf7ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282503, "uuid": "fd3b6595-3744-4977-bc16-7010f3b1d351", "value": "document-378361828.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a81e1f0-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276953, "uuid": "31aae60c-5b41-4f77-98ad-f45e33332e1e", "comment": "Malware payload (IcedID)", "value": "0da10490cc71921f6ea5af571b59536a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276953, "uuid": "0e442ddc-d785-483b-bb47-8417ab481dfa", "comment": "Malware payload (IcedID)", "value": "75981e7b8d98c8f636a4d9f8f2217a84a58733c7adf33c4fb1d4fa243c579214", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276953, "uuid": "fa28bcb4-e38c-4f4b-8a43-8a9e2545a77c", "comment": "Malware payload (IcedID)", "value": "666ff7108ea5c84a4605dd8d23dc3255172d7039", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276953, "uuid": "cf20ece4-0804-4806-a6df-f4fb5fdfbce5", "comment": "Malware payload (IcedID)", "value": "d51eb6e189e0ba890044995daa7a9196eade561c0d732051e8c038e4342a73edae4c388697ff7fa944aeb29c59d69d81", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276953, "uuid": "c1cdd605-d3c5-49f6-879d-ea8f178dda03", "value": "CA044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276953, "uuid": "5e58eb20-0928-4fca-96ac-01b79473c48d", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276953, "uuid": "bf3370ce-d92c-4269-86f8-a353b9751a02", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276953, "uuid": "d2f89bb0-379c-424c-9663-d416c8529a87", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276953, "uuid": "b9e64ff4-00c4-442f-9430-96c4f0205ab5", "value": "document-1363720225.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c2871c-9333-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617313501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313501, "uuid": "77a31a35-3ec2-478f-9bd9-1ec7db41472b", "comment": "Malware payload", "value": "10ec4e7d26fbc820a188559ebdfa33ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313501, "uuid": "0b23decd-2651-4fa0-9d86-7bd57ecfb6f8", "comment": "Malware payload", "value": "75b40e9fdcf3547bc3951f453c77f876272e1cd1e5e148ca2d2e9455c29ffd0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313501, "uuid": "f2f49652-da8a-42ec-b7dd-195b0e1b4fd3", "comment": "Malware payload", "value": "8ba1c4418a23bb4f97ff585a020e1128b8febc23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313501, "uuid": "2f599036-0965-4dcb-8707-53c317221731", "comment": "Malware payload", "value": "3dc91def109e48b77b5ff4d8e5d07bd450027ca6ebbcb6a421a692576053354fab2f4f52a422091a50d530486a29507b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313501, "uuid": "7b0dbb4f-adf2-465a-8975-0db63a5441b3", "value": "F5B33A59F890CB31CAD16A7EFA4D129873530B7CE7D931018D256F342BEB95A4E7A802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313501, "uuid": "ff2e7fa6-65ca-4bcd-81ba-1ea9a699e3f2", "value": "1536:zl5oxPVHTflrlLVTpDT8dRoO4W0hfKqyqgoC7j5OK19vT94x20PlwCzkOEO+xT+W:zl5ot5PTY69pyqgBZOK1Zmlg9XxTkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617313501, "uuid": "29b92f5d-38f2-44bc-96c3-35282f9bbca7", "value": 115892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617313501, "uuid": "be256d8f-7c4d-496e-8179-78c68540f262", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313501, "uuid": "9e8084d2-97e9-4822-b2c5-2d74335b9621", "value": "dal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23f1746-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617262094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262094, "uuid": "b559db2b-5ce4-41b7-a5a7-0e2b8340c006", "comment": "Malware payload (AgentTesla)", "value": "4c85cddc8e76eb2e4d27feda08d34541", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262094, "uuid": "a545ac17-68ed-4a56-baaf-feba0f6c70da", "comment": "Malware payload (AgentTesla)", "value": "75eb22476e4f2943824599ef1d72d31dcbd490a21d7f22969418d88ea2b5456c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262094, "uuid": "339236a1-91d9-4150-9b2e-6ab9adb05f2a", "comment": "Malware payload (AgentTesla)", "value": "cab7266ade3d81342acc963f1009aaaabb2facab", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262094, "uuid": "d92ca5c9-51c8-45f0-b7a6-b0bd634d8101", "comment": "Malware payload (AgentTesla)", "value": "e59655c11e711ada9f92793ebaaf8dacc14a9ac3acad85c5a72f4dde171c5f4fe27d00f444a8ffec2c4fb7caf4f74195", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262094, "uuid": "a6477de2-fc0a-4a39-b961-d2d0a16e5df1", "value": "DA52C0F61E55EEBD8046D5AEB13054C8C3886D4A9CA26B3167D8F930AE3103FB126CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262094, "uuid": "16d4fa9d-3e12-40fc-8598-d6ed20a1a7f3", "value": "192:hzuYJmdRH9SBXN2CuSJg9SdS1LHB6xCaoMYKL7Ly8wwiMIJncpiNkykL:BXJad9WN2NSe8sLwpj7r2Jiiqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262094, "uuid": "2be213f8-0fe3-4a06-ba21-c0aad9bfda52", "value": 14168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262094, "uuid": "db637291-12cf-4c36-913c-5f3887da016d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262094, "uuid": "2c367242-2f40-4829-a7a8-05b47fbb35e4", "value": "Payment Details_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f383a10-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285873, "uuid": "70b70a65-fe4f-4522-8b56-29fce562fde8", "comment": "Malware payload (IcedID)", "value": "adf657d530e385ed0ad4f1e866497bfa", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285873, "uuid": "374645df-e79c-4404-8f6d-2a0443c27bf4", "comment": "Malware payload (IcedID)", "value": "7669baeab6ca9af8eb4cbb15be88efa5effea8eebe1834fcf20422c2ad9f03c5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285873, "uuid": "4ea51616-98f3-4a5e-933d-10a331df1d84", "comment": "Malware payload (IcedID)", "value": "26cfd6ccb9207324c84975aeb0ba69a740e50e06", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285873, "uuid": "ed129a48-ad94-4c5e-b357-a5b6dea0b3e1", "comment": "Malware payload (IcedID)", "value": "15ddfc698a878f31cd383ffd7903e83f985de39985fb4b96ab2305f319a43e1dc9ef70b6b9ed8e37d2548511eb23961d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285873, "uuid": "79200b4d-40d5-4a37-b1ec-1336b73d614d", "value": "06044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285873, "uuid": "6303d810-f1e4-40be-b8cf-126637638bc4", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285873, "uuid": "98648932-fb08-4237-b068-a797e89e0aca", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285873, "uuid": "8d25d3a8-b2a4-4cc0-ae59-03c31b3e7b14", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285873, "uuid": "828bb6d8-c825-464a-8964-acbb64c4ecc5", "value": "document-831653335.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617eb98a-92e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279944, "uuid": "51fe26fa-5182-4c0b-bec3-41c75bf67a20", "comment": "Malware payload (IcedID)", "value": "8ffa4ffc82f2b4a2dcc769daf445706c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279944, "uuid": "ce14c8b4-5378-44e6-9f91-a5ce11a1d5a5", "comment": "Malware payload (IcedID)", "value": "7674d271bc0eaefee23de0732e0403825bbddf5a884551d5b516137fa582023e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279944, "uuid": "fcec60a2-c045-4109-9ee1-80232c25c52d", "comment": "Malware payload (IcedID)", "value": "d0818d727fd8d30f3bd168b801465f81be8beae0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279944, "uuid": "7df6f52a-6dce-4d4d-83ae-dc9c72de29ab", "comment": "Malware payload (IcedID)", "value": "6452afc9bf0aece56f0d98a2e0000313b7f5f12b47216f51d2ad3e5760f8518a4d56e3ce72cded83561d7a48cb78bf01", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279944, "uuid": "d8b44a42-dc5e-42eb-bf47-8406eae1075c", "value": "62044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279944, "uuid": "84b6672d-3786-4a15-9a76-f67b1d805e0b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279944, "uuid": "f0594fd8-7b09-4efc-aa91-cd33069f94e1", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279944, "uuid": "51eba8bd-81e2-4e18-a768-e92f2903bd29", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279944, "uuid": "db46569d-cea8-4b4d-8978-3175401732c4", "value": "document-1813543019.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ab6b06-92de-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276966, "uuid": "91d89690-d5d9-436f-92ca-923aef97dc11", "comment": "Malware payload (IcedID)", "value": "a80fa4aa179333304c0c85aafcd07387", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276966, "uuid": "db44a2ca-34dc-4f94-bb52-9e542f86974e", "comment": "Malware payload (IcedID)", "value": "767fd29bb0a56842c6a159116bfabd6320a0ed90f718cba68427ae45e1875a4c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276966, "uuid": "c90c0142-9c80-4b5d-8f76-7729540d9877", "comment": "Malware payload (IcedID)", "value": "c2d993acf4ab907fae0aebecb5df43bf667167f3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276966, "uuid": "cb9c04f7-6fbc-4428-9bf3-58bc10643196", "comment": "Malware payload (IcedID)", "value": "b55aafe2c05f85a31ad88b55865bfbbb29a4b0d2301d7ee78fc054f3c91d6f5e09ab2b6856b18c51ae60f0061902694d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276966, "uuid": "66059f06-206a-4207-a045-7f59d9f40164", "value": "1F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276966, "uuid": "66efdf66-4859-40fd-9287-a287a5a57429", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276966, "uuid": "231bb254-4471-4a14-a04c-b2cadf8ca24c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276966, "uuid": "8da02a96-37b6-4b32-a465-08f6dc02c63f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276966, "uuid": "39a67c49-72e8-45b2-8e20-3bf12b1df5a2", "value": "document-1110307277.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d96ae45-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284286, "uuid": "a1741d8a-9658-450e-981f-a1147a1c624a", "comment": "Malware payload (IcedID)", "value": "bc94f7ef43aa34403a4342fe2c3cd0bc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284286, "uuid": "539a560c-25af-4933-991d-e02c9e50d9b5", "comment": "Malware payload (IcedID)", "value": "76fefe3f5f6374298a923066b6d421d2b9a3a5d6f414f6b1b0f7af8ee6c52d74", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284286, "uuid": "b03b6a47-0543-45ef-8f34-8202f01087dc", "comment": "Malware payload (IcedID)", "value": "8475107e405c4f3ff74c29428f0de3a810b540da", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284286, "uuid": "18ed2eb0-3a5a-42da-8c1e-943a0edb39b1", "comment": "Malware payload (IcedID)", "value": "8eff0a8d378a56a8b3683a81a42333798c6fb520fc858218855812e919f89437d506a39f32ada9e8f95e91e3cf267a99", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284286, "uuid": "6cc7c2d2-97f9-4a89-bd48-852d240a6053", "value": "8B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284286, "uuid": "1ba103bd-54b8-4af4-97a4-3046612e2244", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284286, "uuid": "e1db4f88-5e9d-4ba7-b1d2-28cd293650a5", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284286, "uuid": "0ca57f77-31dd-4217-82ad-626d6c3216a3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284286, "uuid": "63fbc953-7924-438e-9ee3-5074485c2be0", "value": "document-1102900915.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9efb87-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285868, "uuid": "5eb201ba-7231-4b4a-985e-1b9ba7418c32", "comment": "Malware payload (IcedID)", "value": "1bcd4c448f9d9ff11b5ad2e7bea04211", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285868, "uuid": "9d8a29a5-bafd-473a-931a-735a40f1ad84", "comment": "Malware payload (IcedID)", "value": "774f8e00edbdd3edd7127774ea33b9e9de1fdc9057383b7833a23d320b7edf1f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285868, "uuid": "c980f12e-ec58-4a51-bd4f-3b84b8041b8a", "comment": "Malware payload (IcedID)", "value": "288fbb4ffb1af1294348214c53407b2dab5469bf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285868, "uuid": "37a4da13-cf46-48c4-aee9-232e97dcbe2f", "comment": "Malware payload (IcedID)", "value": "f971ab76e88bd5ef2acad6e9ffbfe4fb903dda405cee8674378648c44fb2bd8c3e2ce34de26d350eb1d059d70b4fd544", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285868, "uuid": "09f6cc2d-7894-4ee1-880e-e6f930a63d48", "value": "AC044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285868, "uuid": "668fc51d-b8ab-4980-9cfd-a663d77444c2", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285868, "uuid": "10007840-07eb-4fed-a3db-9d1ada92a39a", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285868, "uuid": "1a456f58-8229-455a-92d0-ce75da923801", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285868, "uuid": "ac51e36a-b806-4b68-be1e-13bd74ba0c53", "value": "document-249299438.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c798ad-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275901, "uuid": "68b8b5df-a08e-4f1f-aa2d-e310d19659ce", "comment": "Malware payload (IcedID)", "value": "f4e674fd86ba0ee7fc77cddece346141", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275901, "uuid": "3034c7ce-7eca-49c1-8460-f05d4ff50a02", "comment": "Malware payload (IcedID)", "value": "777d6d0ad2ebc906f36d2c7026902c39f7a12dba8e18b96f551c6bdde4c8880a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275901, "uuid": "cc757b4e-e181-46a9-b538-e14f8313ad0e", "comment": "Malware payload (IcedID)", "value": "01336d2eb60852310b306038a1d701226cc0d657", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275901, "uuid": "4488df1d-762b-4a06-98af-8124bfc16078", "comment": "Malware payload (IcedID)", "value": "5c6898a69d9e9fff59718aeb0d139a3e6184fa48de0408fd5756326c6c8d64120b8e2405e1c6d1dc57092c2a807bd949", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275901, "uuid": "67feb7a1-464e-4b85-a30a-1cd78e08998f", "value": "FF044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275901, "uuid": "347fb432-a0e8-4e76-8bcd-ad582fa400b8", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275901, "uuid": "07a2ad68-6d12-4d65-ac4d-fc259a3db3cb", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275901, "uuid": "58f7bb1c-f9e6-40a2-9886-93df4807585d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275901, "uuid": "72e3beea-d0f5-4ac7-8a36-563e77040e7b", "value": "document-1989881675.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cff620-92db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275650, "uuid": "9cf5898d-8ac8-407a-a7ec-28de5dd0ef27", "comment": "Malware payload (IcedID)", "value": "b1967965700b5bb4325ca26980df686a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275650, "uuid": "094cf253-b7c6-4e30-bbac-38a143935b99", "comment": "Malware payload (IcedID)", "value": "77a21dfe5159811824ab8f9446507afeabe9aa4176a0d6fa104a2bd1958d1009", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275650, "uuid": "15fac619-1f3c-41c2-9bae-a4abd98e30f5", "comment": "Malware payload (IcedID)", "value": "9c1fc2a56bcd8e68689fdd7dc6eeaefa4f8c9e98", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275650, "uuid": "46bde5d0-bbf8-44e0-9997-4532533e12d5", "comment": "Malware payload (IcedID)", "value": "86f53d820b78476f186e45123d4a1ba6b2a21989364ef71045feec4c50c9ccbd78f5c47f28e8fe8512bf6a31586fcc0f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275650, "uuid": "ef5846a8-644c-41c2-bfc6-1e99b82a27a1", "value": "F2044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275650, "uuid": "031f017c-aa24-495c-8522-497f319cc671", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275650, "uuid": "ae1e4817-8c54-49f6-8cb2-a1c3723a71c3", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275650, "uuid": "96999311-0a9b-453e-b095-23a4e945348b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275650, "uuid": "6d921a1b-102c-4839-bb9f-09880efe31f4", "value": "document-1453528722.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe7056c-92f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285357, "uuid": "415e2e0f-8134-498e-a521-9161b331ac5a", "comment": "Malware payload (IcedID)", "value": "304e512495e7ecf54132b4ff630a0331", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285357, "uuid": "b8f9c827-55e0-4776-adf1-0ecc84b63a27", "comment": "Malware payload (IcedID)", "value": "77a60c8dd0f6eab8f4871350ef31bc50a3e15f1d30267fa44b40d8fbcd4331bf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285357, "uuid": "94830c08-cf69-46c1-a2b1-28acd9c674ff", "comment": "Malware payload (IcedID)", "value": "ad72ce000cf659f1e037a42d75b68a68994a91cb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285357, "uuid": "20e66183-af34-4409-9675-10470871b25b", "comment": "Malware payload (IcedID)", "value": "46bdaee993ba02280d569d3e433dc72eb1ef22ae809481c47b23c8e0b40c1485d5835dadc8db8f0797413b5df1761e1b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285357, "uuid": "bbe73962-c840-49a2-a21d-f31d3007e884", "value": "CE044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285357, "uuid": "34a127b5-d122-4d00-a8bc-b73a1d5dc197", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285357, "uuid": "a074fa48-e8e8-4522-aeb5-ffa0350cd7df", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285357, "uuid": "3f053a74-ebc5-4e3c-b49a-7397f8c225d7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285357, "uuid": "5859e4a9-31c8-4d79-9bb2-1bf998d69818", "value": "document-2061014470.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c770060-92f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287237, "uuid": "3ecd36e0-381e-46d7-bc88-339c5d93ddbd", "comment": "Malware payload (IcedID)", "value": "f2a0784c645493bee63943c58b269e6c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287237, "uuid": "df643d2f-1c04-41b9-917f-687c656e36a7", "comment": "Malware payload (IcedID)", "value": "77ba42380275c465e241dce43cf2e4818606fb02fe272cd1633d6af480b556de", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287237, "uuid": "789c49ef-d656-4ff7-9de3-74246ade7320", "comment": "Malware payload (IcedID)", "value": "88beaeb7641f1300571975f4104dac5b63158c7e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287237, "uuid": "eaa74041-0e03-407c-b02c-f6726e14f469", "comment": "Malware payload (IcedID)", "value": "11496f3439d94457d2e1f9c2a975b1e153ff4ce1eccf4e608a1757d63f25ce6ee4bb26c95bd96d9ba75a6fedce781a40", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287237, "uuid": "40ce4e3c-8b62-4b9c-b25e-1621294876f3", "value": "59838DCDC913E1D9C2559FBD5A0A308512F4E0B7276FF11B148EA62E0D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287237, "uuid": "5acb4ae3-d16c-46f6-8a4d-bf6920b7b3c9", "value": "1536:IB240XZfcaaxf+EQliU2hawFCAIoo8+BNvMhfv6F:+2d1cBWEQXMF9o8+nEhHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287237, "uuid": "4c3361c0-edb8-4ff2-92e0-fecffb76c74b", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287237, "uuid": "5c8d9c62-dcba-4683-83d2-0c839fb501a4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287237, "uuid": "bcd5a9c1-8da6-4837-910d-240022905b8f", "value": "376.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cddb63af-92ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617283991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283991, "uuid": "8e65d08a-0f17-4e61-bf67-8fbfc0f72b5b", "comment": "Malware payload (Dridex)", "value": "d9f377cc4b742c02ec4ea784061732f0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283991, "uuid": "839ad1c1-b149-4cad-9f50-995d443df94b", "comment": "Malware payload (Dridex)", "value": "77e67823abae3f2f4f56538aa18545e6c7428bf61c35094a1203389f6fe9a8d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283991, "uuid": "3452d4cc-8789-49c4-b0be-789d19c8b69f", "comment": "Malware payload (Dridex)", "value": "86dca6b941ac111333069fba436711bbdf040cf4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283991, "uuid": "200799cc-b11a-4dc1-b71f-90a353ff3654", "comment": "Malware payload (Dridex)", "value": "4dd20a1a248221b63d1753096593c1e40af15362f72e3eac2a094377e83570d46732c79c6488aac8f83402f5347f98a2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283991, "uuid": "4dd777e1-5bac-4e9f-b237-f413ec6d98c7", "value": "43248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283991, "uuid": "98bdcdb1-077a-4966-bc72-9239727ee92b", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283991, "uuid": "0c32fa63-c795-4f52-8747-6c0d7bf70e77", "value": "3072:Z6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ZoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283991, "uuid": "da4f99e3-d0e7-4f54-b6dc-37154095f018", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283991, "uuid": "adcd76ff-aae2-4110-ac3a-a1231e4d7cd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283991, "uuid": "80c4599c-39bd-4ac7-b09b-bb588931da63", "value": "77e67823abae3f2f4f56538aa18545e6c7428bf61c35094a1203389f6fe9a8d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143282f3-9316-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617300860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300860, "uuid": "fc100f45-0144-4ed9-a4d7-0e501830f904", "comment": "Malware payload (IcedID)", "value": "6ddc86493c3423cc81a9fb2f8f181875", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300860, "uuid": "3462bee4-ac9f-486c-ab72-921b7d13839f", "comment": "Malware payload (IcedID)", "value": "7861a5b08e215602770d2e2eef110e29ccd435095a52a16a92aee883c957dc14", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300860, "uuid": "cecdae22-da0c-403b-bc11-09f49eaa8f74", "comment": "Malware payload (IcedID)", "value": "00acbb5143006d7e21643958ba7e1c79e5cec9c0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300860, "uuid": "5efcf459-33b2-492a-952b-2d97a126ae99", "comment": "Malware payload (IcedID)", "value": "44028eac157094ad2007b2b9e31551a6e1ca8f40400fffdea2b4731a4cee837e765b04f1c771e11ae23aa67e9e42ff73", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300860, "uuid": "46e35517-8d17-4c46-90d9-19a389206a5a", "value": "8704123CD0274C58C2E5447BD858C246AC6A2427ADF8A5ED668CB994EA137F30F7FB44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300860, "uuid": "78a8e50f-6b42-473d-82c4-6bd68f671f9b", "value": "3072:jXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGDKJj:rE5SDvbXAyHbVt15wTQD0KJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300860, "uuid": "56ed1a6a-cf9e-4440-9acd-abeb2b6a499d", "value": 176993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300860, "uuid": "54b47949-a740-418f-939d-b818a9170bfd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300860, "uuid": "0c5ea82f-f8ff-41da-8b1d-d6e5b38f6797", "value": "91399367380-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d680a1-92aa-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617254658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254658, "uuid": "dd9476c2-1ca7-4459-a4b0-0fc07d076533", "comment": "Malware payload (GuLoader)", "value": "573e8967c62f710f95a2aaf13bf91226", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254658, "uuid": "97ae38b9-b83b-4c0c-ae5f-278e09b3ce33", "comment": "Malware payload (GuLoader)", "value": "7870b03e6b88a8199a4bb69c2783d7250cd67a55bc941530a7c257a0f929e5b8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254658, "uuid": "918302a2-120e-4136-b8d0-2a07a9e5a3ab", "comment": "Malware payload (GuLoader)", "value": "4dfa8071959cac7adcd89559dc3b8f3d3a9d79b4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617254658, "uuid": "1e0fb0b6-14f4-49d8-8ad5-919cf016a703", "comment": "Malware payload (GuLoader)", "value": "486eeed15e33bea328e57b7b50e8260dc742cd5b0271e242fb915ca470a694038ab96003a450c58350ad274f2fa0e97a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254658, "uuid": "dae10d1b-36d2-4991-b368-8fe97a3180c9", "value": "03D2F0C16337FAB4076E255E1CBD199AD30DD44080E65CEBDD171340AD1ACE6C96BEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254658, "uuid": "a2c3c175-d296-4e5c-9a20-ede7618f2d74", "value": "768:DEQMTwAJe8TWrPi5oXwMaEiK9okufAVgCJ7ucvojcw:DEQMDJKPOozawoJq0cvojL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617254658, "uuid": "a2bab946-cfb8-4dfb-95a7-684d53c2a7f3", "value": 31037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617254658, "uuid": "d05f632a-72d7-4516-9be0-1c8116603166", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617254658, "uuid": "495bc454-3c9f-4362-ac14-5232a795a5b1", "value": "Facturas pendiente.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052dd505-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278071, "uuid": "16abce16-4a28-46d4-b890-687e4b0e0916", "comment": "Malware payload (IcedID)", "value": "f813a727c6c2fed078fa3c3834370a27", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278071, "uuid": "d9b5ce6d-7c5a-4018-87fc-4299774b3cde", "comment": "Malware payload (IcedID)", "value": "788fbd60a19d80b064538807f817913bad7e37a9ac0d711cd90388c08eb4fe39", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278071, "uuid": "32975b74-e29e-4e47-9151-ae2f01e81d4b", "comment": "Malware payload (IcedID)", "value": "516e38235b6b9f65334df9e3a81ac3eaecf7e323", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278071, "uuid": "26654aae-91fa-4c6b-8315-18c9fa77c2ef", "comment": "Malware payload (IcedID)", "value": "f2c37b83ab1dfb6a3eb589fe3b7093995e05ce31bc0d137e8b8079bc13bb79cc8cfa09e3c78d343943bb556c0719b861", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278071, "uuid": "0ad65ea3-9cc4-4356-9588-4ce918113699", "value": "E0B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278071, "uuid": "b40306b1-82bf-48f1-af64-3b8ba59b5eb7", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278071, "uuid": "1b16c07f-e857-4fa7-8c8c-a7c1edac7f99", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278071, "uuid": "ca92f1c7-6706-427f-b63a-58a9d8171e0a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278071, "uuid": "b31f861d-cf5d-43bd-a44e-a34d73161a54", "value": "document-651919080.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8a8739-92ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282939, "uuid": "8c830136-6b9a-435f-a42e-591ef3c975fa", "comment": "Malware payload (IcedID)", "value": "a62fef39d6894faa9ef5f22e2f08b5eb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282939, "uuid": "0f714c62-02d8-47bd-8d2d-2bd264cd3803", "comment": "Malware payload (IcedID)", "value": "7909ff08a7f50c264eed1c2e90fe9590a784858758317e15d4cf586c17d8e5bd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282939, "uuid": "fe289146-3c7a-45cc-a674-c8c4cf4c001a", "comment": "Malware payload (IcedID)", "value": "8c191eb0ea48f952758bd520631e79e02cfe956c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282939, "uuid": "d2df2486-74db-4193-9685-c43ff28d8812", "comment": "Malware payload (IcedID)", "value": "30f165b126cc8161c62bacc4e0a146203bc1f1f464d28eb4acfe26025c6d63e7f27ead6e5d56694b7eef348445e4a491", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282939, "uuid": "ce8d8f01-fa9f-4e95-87c2-dbda1a4760d3", "value": "51044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282939, "uuid": "4a0d326d-7fdb-4002-aaab-978c9b2b060a", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282939, "uuid": "7cbc7b9c-e195-468b-8ee9-beb7ab24bec0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282939, "uuid": "440f760d-8c72-455d-8431-3ab91da10233", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282939, "uuid": "64d97fc6-a26f-462a-999b-91a14ac680a5", "value": "document-533770495.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7207d3ea-92d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274388, "uuid": "e6f5190a-5f94-422c-bb2a-26f4856564ad", "comment": "Malware payload (IcedID)", "value": "e99b6bfc5e78db3372a532f69518df9a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274388, "uuid": "bd83c4db-2a84-49f5-ac35-ba6181560d3e", "comment": "Malware payload (IcedID)", "value": "790ef7bb81a1131187945b0e9cff3265b4589be2a190e65c5e07cdebdc74ad3b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274388, "uuid": "5ddae95a-f04e-4f96-9f4c-ed41f13987f7", "comment": "Malware payload (IcedID)", "value": "ac50fe3db87559b4edecbb652889f60c30cb6dde", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274388, "uuid": "c9de46f5-bf1a-4f9d-b17a-aea8ec36838d", "comment": "Malware payload (IcedID)", "value": "989ec379e4e4e87c09f16289577cf047cf4b8312a69daf57e9f226bf526d34f5cf39773b0a5e4ab3bb924ad87e686e3f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274388, "uuid": "97af893c-13b5-409e-93c0-28e9628f965b", "value": "26044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274388, "uuid": "af87f513-c8f0-4897-9faa-df80f89ff32c", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274388, "uuid": "98ed8896-0b5c-46df-b154-12583d2edfe0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274388, "uuid": "6bb1e339-d072-45fd-a18e-c9d7bd1130db", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274388, "uuid": "dbabe5f8-b70d-4da7-9c62-b8157aa19267", "value": "document-854558039.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a891be-9290-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617243548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243548, "uuid": "ef3e5953-0dc7-470a-95c5-fd29920de3c8", "comment": "Malware payload (Dridex)", "value": "68672d1ed6c979158b159fd9945934c6", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243548, "uuid": "0723c8de-51d5-4b91-88d3-c8e9b59f4d96", "comment": "Malware payload (Dridex)", "value": "791fc1aa65ec3ae85a5441497344eed922c7e03720d086a58f17a63e038a6427", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243548, "uuid": "de7053ec-2cc0-4abc-9249-cc42f25d06a9", "comment": "Malware payload (Dridex)", "value": "2d155146ffcdd25bdad9cb04688cda7dd7942063", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617243548, "uuid": "4ef3bfd0-5392-4851-9caf-61a5b0e07256", "comment": "Malware payload (Dridex)", "value": "d27c4a66c98e124a326439c8b19fe76f69a2a91707bba63697cb4c9d8931ea227b2e7b4ec3d5cf1f3c3961073b841ed6", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243548, "uuid": "dcb69cbd-94d1-4cbd-bdea-1d0210fa64cb", "value": "A584D143ABD54472F6721F3804739B104BEFBDD64E308DAA6289211D2F673C196787AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243548, "uuid": "2a6851e4-3534-4cff-bf33-582941e01cbb", "value": "61ef004a8c2946a166c67bb888b0e53e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243548, "uuid": "31bbb913-238d-46d1-8efe-c2b9b4e0d029", "value": "6144:2OhxWpCcRexubjd/WNQoGuBF4CEejyK0nnTaftjWnFGLOk0zEj/LjOc+gpHU:2OKcubjRA5BFiTaFjaPcPOcjpHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617243548, "uuid": "07e5836c-9960-4f31-a086-927f85ee3069", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617243548, "uuid": "1f9809e1-2a18-4d2f-968b-d4656fa1801a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617243548, "uuid": "8b342f61-3111-49fe-a851-e076a8539eac", "value": "791fc1aa65ec3ae85a5441497344eed922c7e03720d086a58f17a63e038a6427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b2edb4-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284280, "uuid": "5e485a04-1cf6-4c99-9a25-2509c2eaa976", "comment": "Malware payload (IcedID)", "value": "2fc6cb48a8d67aad18fa54d0f003fc67", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284280, "uuid": "6eafdcf2-c123-4976-8cfa-9fdbf26c1312", "comment": "Malware payload (IcedID)", "value": "799114cf3a390d5b04a072542e5979b25b528ecefc593c0ea99101724c6a8c1d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284280, "uuid": "d1ca586f-985f-45f2-aafd-23857782fc6f", "comment": "Malware payload (IcedID)", "value": "76dcfa63ef5eae7f0e05fa85042a9f5323049b13", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284280, "uuid": "888a0d71-8e20-4b8d-9952-eb370193500c", "comment": "Malware payload (IcedID)", "value": "5b52dbd5a82db507d22369bd92cd92baec894801a78539ca49d503023672660c94bbaed4d662c9d02c106f8d8630b01c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284280, "uuid": "8e4c7ee0-3ba5-45cf-9593-1e53a154a496", "value": "B3044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284280, "uuid": "5b7f639b-edfa-463f-ae68-e84ccbe1b2e5", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284280, "uuid": "4ae9e9bd-7206-4383-b340-a4f697a84898", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284280, "uuid": "1e1ab9d2-dc78-4279-9411-d2f84f9838c4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284280, "uuid": "48c5d0d3-3e72-40be-ae15-3efd7056fef1", "value": "document-149785084.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fcf930-92d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274767, "uuid": "4ccba7bc-1767-4bee-afa1-f2c8f5444e27", "comment": "Malware payload (IcedID)", "value": "e21f3beb6a89047c18926eb486f9db44", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274767, "uuid": "a6382fdd-7a9d-478f-9621-9d41ce212a54", "comment": "Malware payload (IcedID)", "value": "79d35709418f7ff4af63e95eb1ac5fab4694d06c17dfa4fe73d05350d220ce09", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274767, "uuid": "9c097e9c-f9ef-4f03-b94b-b51c32db6f86", "comment": "Malware payload (IcedID)", "value": "c471895f7687b53ff23f8bcfd3203e38942ba9f8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274767, "uuid": "e75c4a4f-02d0-4bee-ae75-7b7b48c2ac78", "comment": "Malware payload (IcedID)", "value": "c5548ed9cee84741bdb02356bd3ca4c4f5a9aabbf45f5723358b0d7c7753dc40811d8e453cec8703b28c891e70f387bf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274767, "uuid": "c2b2693b-ae6f-4868-840a-5733e4b89063", "value": "C5044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274767, "uuid": "128b2038-f8d9-4aa6-a122-dc0b405b1950", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274767, "uuid": "07ccc965-b398-4e0b-83f9-14f949ad74dc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274767, "uuid": "5939741b-2b12-49a4-b3d7-945ad20df8f0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274767, "uuid": "bb2b8d22-643d-497c-9fe0-ec0c3382ca91", "value": "document-274920400.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a610d5f-9312-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617299179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299179, "uuid": "cd87505e-bd2b-4b0e-b49f-ddc4648c37f7", "comment": "Malware payload (Dridex)", "value": "eeaacaedca9c4e0dcdf2cfaf7771ecde", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299179, "uuid": "0ae4809e-9712-4b11-ac26-e40d24b1e9d5", "comment": "Malware payload (Dridex)", "value": "7a278c1687f06067fbec73a84f76317aaf324a09f54cf725e033339e43c39f0a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299179, "uuid": "d0a1cbd4-1006-4ac1-993e-8b4465574857", "comment": "Malware payload (Dridex)", "value": "112df71795c597a02a92aa1f7e47003dcc0ac346", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617299179, "uuid": "fbe98805-55f0-49d3-939e-7a1dcf47cfcb", "comment": "Malware payload (Dridex)", "value": "baac07cf9c3fbd9edfe9b7a9ee2de75eb62c6c152409998793a51e38de5ed348089d1303b75eb3e147fdee85ecd9fbd9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299179, "uuid": "e8a33087-0d8d-4c0a-949d-3822fac05f73", "value": "B414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299179, "uuid": "bc8537cf-7a22-4ae9-b1e6-33b77620eb6c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299179, "uuid": "babec7cd-9701-4a22-9e83-209172715e3c", "value": "3072:zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:0pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617299179, "uuid": "266b11e8-ee87-4af0-a080-b848a9da1912", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617299179, "uuid": "02bd0434-aee6-41e9-b9eb-2db798cdb14c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617299179, "uuid": "9c0b9a98-b202-4cb9-868f-7e324206daba", "value": "7a278c1687f06067fbec73a84f76317aaf324a09f54cf725e033339e43c39f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7e8fbf-92b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617258008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258008, "uuid": "bb630766-3b36-46ee-9276-a907a1fb1058", "comment": "Malware payload (Loki)", "value": "6051a7e8c14297941b8a1eb31901f7af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258008, "uuid": "7edeaa48-2957-4b04-9e60-fbeeeaced587", "comment": "Malware payload (Loki)", "value": "7a545a28cacdf3ab2dfa605a626adebad10290b1c6980fbf157eb464dadf2011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258008, "uuid": "2b9c0ba9-6a08-443b-b4c3-b68c8b0206ca", "comment": "Malware payload (Loki)", "value": "f6c2467739ccaaa3b79b9a809d9b026aa37fe60c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617258008, "uuid": "11ff82b9-d43e-4e4a-9851-06a3951b634d", "comment": "Malware payload (Loki)", "value": "2e2b0012d211b6f4401c8556425e834b691b18b877eda036d5e8d92b454249082755b6007ea0925127165f4c12a462a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258008, "uuid": "277e5d80-e3d1-4c37-9ed3-29ad08c5845d", "value": "30E312A667E0E4B3D3AB15714ABDEACC8FFAD41214A247076B34CF5E77231D2462B141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258008, "uuid": "3204337e-7dbf-4651-a047-959b99b5c543", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258008, "uuid": "ea08ac3b-8662-48cc-bd50-f847c0d96afe", "value": "3072:KBkfJpRXATwMdFCcXbACjyxGVAtcyFGDsgC1RtVfsZs5CfMkaf84oB0T8:KqjIFACjy1CqRtV0ZnMkaf84oWT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617258008, "uuid": "30b5559a-572d-4991-9ae7-324803bda5de", "value": 151029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617258008, "uuid": "2d57c3ca-8419-4b2b-a245-9750d0693062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617258008, "uuid": "912ae395-9264-4f42-9498-ba1ae7e37361", "value": "RfqHongJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefc24e9-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274061, "uuid": "ac5fe273-1cac-4549-a3ab-81fdfbcb7be6", "comment": "Malware payload (IcedID)", "value": "1b27179fef088c95bef188db78154ad3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274061, "uuid": "ca6d18d3-252a-48c7-bf40-cbc01a3faf7a", "comment": "Malware payload (IcedID)", "value": "7a7a6ee9a031078704222a214b6dab12083eec752181415f563ae9a7340beb23", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274061, "uuid": "29477ad7-198c-49cb-bb7a-580703d0ba57", "comment": "Malware payload (IcedID)", "value": "b7a421f8f9b82ea79bdb06d24bb13e25643bac24", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274061, "uuid": "846cb58d-1741-4a35-9265-a57f76600071", "comment": "Malware payload (IcedID)", "value": "b7f0cc7ab9679897ffb9f477e0c14940f032fb01ad16938d38a8f9324a2884c2167284930d5706cbdfb99e7742dab1f7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274061, "uuid": "4716e027-a4bb-4aa4-a3db-e4355646c7fc", "value": "18044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274061, "uuid": "47013aeb-8a27-4815-9429-3b5cc3689864", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUz:4PmxIEudkLeXPD/PjYwe2DMo3S//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274061, "uuid": "2d62c193-e82e-4471-86a6-b2660f1b7b1f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274061, "uuid": "e77af240-1c63-4f72-ab49-f33be0a4bbc3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274061, "uuid": "c14278c5-f21f-4c9c-a62f-335458ae95ad", "value": "document-413399966.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3450b87d-92fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617290176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290176, "uuid": "604f3a56-7c37-4270-9218-1a038797aa9b", "comment": "Malware payload (Dridex)", "value": "85ee3181464e3b5a3f1fe8a98d6d7b40", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290176, "uuid": "72e4f212-1070-4dcd-b98a-bfca464f631b", "comment": "Malware payload (Dridex)", "value": "7aa63feea0f8b7313ac06cf2951b61b47ce715cab748357f832f6749132db68b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290176, "uuid": "23b460e5-5be6-4de1-afb3-b9a19ae759c1", "comment": "Malware payload (Dridex)", "value": "85e97ad91287c47e6af33051b7ff20aa52a0cd76", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617290176, "uuid": "eae60dd2-dd38-4492-b312-aed3ed8aee98", "comment": "Malware payload (Dridex)", "value": "7ef493e16c3368d135d9d20a73873941b06e95bffe7207ff8b06637c6ce906daca44905ecbe5d5568f6c6f3fd95952e9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290176, "uuid": "eed15d45-ddeb-4100-bfee-540de7334762", "value": "0914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290176, "uuid": "9be40992-f053-4ffc-8e12-eca2a838f6c7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290176, "uuid": "5e6b63db-3152-42fc-bc7b-b274e4b56b36", "value": "3072:bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:spjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617290176, "uuid": "0b693197-61b6-4f6a-9dfd-baf9ee663bab", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617290176, "uuid": "38bf50a3-31c7-4e58-abcd-5b51dd9fd116", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617290176, "uuid": "12ebbad9-4d0b-41b5-be13-76c71e049ba0", "value": "7aa63feea0f8b7313ac06cf2951b61b47ce715cab748357f832f6749132db68b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f97600-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287768, "uuid": "da1a234a-5155-4c79-a7d7-578602ef0e97", "comment": "Malware payload (IcedID)", "value": "c0f9d15a68ad8612330bc7da71f3c4d5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287768, "uuid": "b5db2e57-de12-441e-baba-8b4c27dbd008", "comment": "Malware payload (IcedID)", "value": "7b15add3a55fa2db4844b466cdc0ac0066db5f4ae3d441a67d1948293302a72c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287768, "uuid": "5ef679e5-2865-4392-b9df-4f73b1dd4ce6", "comment": "Malware payload (IcedID)", "value": "fd019cad6266a5949fb5952df37fbdf6726b8152", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287768, "uuid": "cea5a715-f8e9-4eaf-8928-020fde6403c7", "comment": "Malware payload (IcedID)", "value": "82e26a428521fa59caf7455d2d7b61541946ffa76b1eb376e03ae499667dfc481e0f5b7c347db6ae6dd667546808dc31", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287768, "uuid": "341a3df5-46a3-4867-8854-396380851ee3", "value": "48838CCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EA62E4C42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287768, "uuid": "52c770aa-5ef6-4b97-ae91-6d02a0721bfa", "value": "1536:IB240XZfcaaxf+EQliU2hawMCAIoo8+BNvMhfv7u:+2d1cBWEQXMM9o8+nEhHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287768, "uuid": "72408a38-45be-47d1-9357-b8704180ff14", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287768, "uuid": "5bfc753f-9df2-4cd3-b768-c122fe0b31e8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287768, "uuid": "55380ddb-b633-4314-b77e-e0616d8d169d", "value": "3237.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2b01ec-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617261900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261900, "uuid": "5be37c8a-756f-47f8-aacd-5ad7c72ef198", "comment": "Malware payload (SnakeKeylogger)", "value": "2172cb8925363880b0b40371583dbabd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261900, "uuid": "1f32017b-15a0-4d1b-b46c-14d3672981a7", "comment": "Malware payload (SnakeKeylogger)", "value": "7b329dc717b4955312cd3a4c48c18f940d7c6e43fd2afc86f9fb22a22b8caecb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261900, "uuid": "ac6e36a9-77ec-4f5a-b9e6-e8ee3065337b", "comment": "Malware payload (SnakeKeylogger)", "value": "e5b802bef6eaa999be87f6ed29beff21107c9745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261900, "uuid": "a9c42e8a-f4e3-429b-b299-a10f561202c2", "comment": "Malware payload (SnakeKeylogger)", "value": "3bfdc9395e7e1fd1b40a2cd1c4337b2579871bec8a9d8e39627cf6b2c3f45993b5e461c19f6bd172b13df444ed3aa8d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261900, "uuid": "bcc35fd8-b418-4177-8a7d-38f2aa96c5af", "value": "2B058B2337477BAEDDB853B61452410033F0AD36E76AD50CA8A5734D5F776C08BAE2A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261900, "uuid": "2d874ef6-209d-4704-b922-c999aaee492a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261900, "uuid": "f12cc829-8e07-48ff-8867-81666e79a75c", "value": "12288:vSq8sExjlaid8e5Fsw0ML7el/7VDcd3aLPcN8KvLL:vQhee4LMvoDcd3aLPcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261900, "uuid": "7f0fa42f-485e-4db7-aad2-c5d29e53d5ac", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261900, "uuid": "d362ce50-10ac-49a1-b3ca-0fcb3732f3ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261900, "uuid": "46419c57-8976-43cc-886e-84cadf4eaa7a", "value": "SWIFT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381c6604-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285888, "uuid": "e74fc923-eefb-4991-8751-1273321ec36e", "comment": "Malware payload (IcedID)", "value": "fce57d0286c25ea462688cce5ce7b3ad", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285888, "uuid": "86f861a9-d9c9-4c74-b4ad-c78c1f0a6439", "comment": "Malware payload (IcedID)", "value": "7b5836e2c7ef1cf21042c69f825e1d06eae3862a73908bb7bd6e316cb93cb2e6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285888, "uuid": "e843af73-bcd7-487a-870c-91f4c47603cc", "comment": "Malware payload (IcedID)", "value": "5448cfd334510b42aee5ed1f3e725253f8721f09", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285888, "uuid": "01ba0a22-57a5-41cb-8dd5-03b6272d1051", "comment": "Malware payload (IcedID)", "value": "8a30a04589201fb1fd2a7e53ee498226bb3d962e013182e3d1664c17badd9c42b6181c8930e9e7b4523b104fface3430", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285888, "uuid": "2e914fb0-f6f2-4160-81a3-4501c58b8194", "value": "F6838CCDC913E1D9C2559FBD5A09308112F4E0B6276FF11B148EAA2E0D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285888, "uuid": "e3d83fe4-ce98-468a-af54-04ff0cc6cc3b", "value": "1536:IB240XZfcaaxf+EQliU2haw+CAIoo8+BNvMhfvWa:+2d1cBWEQXM+9o8+nEhH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285888, "uuid": "ccca78c4-2dc6-4fa6-8885-469b933c0c3b", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285888, "uuid": "d5658dfd-3859-492b-9db5-35d9e4b1fa70", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285888, "uuid": "21d13a44-3bc0-42e5-8548-bacd61465e9f", "value": "2381.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e5c83b-9319-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617302465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302465, "uuid": "b1e5dd28-aa29-4930-a942-2172a1c684af", "comment": "Malware payload (IcedID)", "value": "1f0d08d72cf3706a5e8aec0845c8febc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302465, "uuid": "4c245075-bcb6-4f57-b744-28ebfc1c8ebb", "comment": "Malware payload (IcedID)", "value": "7b80dff118be136e90e2aac531c369ff9c9b8a5ef1fb3faebe45e1f021d2e14e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302465, "uuid": "92b78b8a-95a1-48ef-aaff-9da40a483d5b", "comment": "Malware payload (IcedID)", "value": "fa5364e3f94823b5d7216e76bcdfe363f4106905", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617302465, "uuid": "d2e832e9-1618-43cb-901c-bcfbd3ccdae8", "comment": "Malware payload (IcedID)", "value": "40b442d8a8a042da9ffecaf156829148aaa06be8f6c18d8cc141a709217eec73e01841d9f17f7f5588d56180e34f6012", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302465, "uuid": "4114dc1b-e53a-4a8b-828b-8b7451416a9a", "value": "D51408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302465, "uuid": "fac7dbd6-91aa-4200-a9de-a50f6602fa78", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302465, "uuid": "1f4af5a3-91a3-40c3-b2c2-0bcc45ee6250", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617302465, "uuid": "7dddd102-5767-48ac-9cb8-087360a7ff56", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617302465, "uuid": "18ac0414-6ba9-4f60-b72b-1f3ad0c15c27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617302465, "uuid": "2aef417f-46ff-4a22-8b07-778d4f3ec083", "value": "7b80dff118be136e90e2aac531c369ff9c9b8a5ef1fb3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1321fe17-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291409, "uuid": "d0c08dbe-bc83-4690-b7de-f7d2c457a540", "comment": "Malware payload (IcedID)", "value": "59bc36cf94ba642cd789d65fb0219756", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291409, "uuid": "6963219a-92a6-4473-9c06-71991892a147", "comment": "Malware payload (IcedID)", "value": "7b8d52fe4b4bd5815b5ee3e1d5893bae8e3d4863ad4d1f6f4f17c9405e48023d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291409, "uuid": "9af1daea-6706-4a4d-8af4-22aafb104dae", "comment": "Malware payload (IcedID)", "value": "35b15e640e67ed3e88e8319926a21bc0b0b35fca", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291409, "uuid": "38709757-1311-4f59-96c9-c2c8e1718dc8", "comment": "Malware payload (IcedID)", "value": "bfd553aaf2487a2e0bbc58ef0d29df86bfed7f8c1fd581b4700c41dcc7c2c70a2d7bb7febebb8fa22b28c81fc37bef56", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291409, "uuid": "fd5968c7-bb3d-4c10-99bb-6106a96e089e", "value": "A4838DCDC913E1D9C2559FBD5A0A308511F4E0B6276FF11B148EAA2E0C42FA80A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291409, "uuid": "3fdd3290-c73c-4830-b7da-e5fc89d0cc62", "value": "1536:IB240XZfcaaxf+EQliU2haw7CAIoo8+BNvMhfv7l:+2d1cBWEQXM79o8+nEhHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291409, "uuid": "0e9d0c80-9698-479d-a12a-1ff8bef31b90", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291409, "uuid": "134eefd7-9eb1-499c-b038-e5ea95e9feb9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291409, "uuid": "d80f896c-f89b-4ac6-aaf4-233ea96e700d", "value": "2099.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a902c3d-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617298777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298777, "uuid": "0957c5b3-8d91-413f-8222-de0b5251c6fc", "comment": "Malware payload", "value": "b0527860dce067ded04f8ed8cf99b7c1", "object_relation": "md5", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "VBA STOMP", "colour": "#35A860", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298777, "uuid": "7eea1748-9c41-47cf-9b5f-ab51da9d008d", "comment": "Malware payload", "value": "7bc840f3e200c5c877b411614a96a364f5402060db380a7691aeaabff18b602c", "object_relation": "sha256", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "VBA STOMP", "colour": "#35A860", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298777, "uuid": "0c80b7bc-8906-4334-9291-6517d355a10d", "comment": "Malware payload", "value": "4827966bf79e78991d8c1d94a1a2ff1d71ab371a", "object_relation": "sha1", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "VBA STOMP", "colour": "#35A860", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298777, "uuid": "36b5cbf9-519e-471f-aa92-044a86ff1b05", "comment": "Malware payload", "value": "36d437d6880b041aeac7ebfffaabd8f00a6aa0a1ad51710f1649fcc0de7a678f7631a20c38dfd55d512ff3317b05a9ab", "object_relation": "sha3-384", "Tag": [ { "name": "BuerLoader", "colour": "#7D08A5", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "VBA STOMP", "colour": "#35A860", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298777, "uuid": "6c647661-1bad-4720-865c-71d2e9038b62", "value": "36F533DD2D098C27C61AA17E2E95148DF0645B6D92EEFEFE00F680818D4FB4D8E74A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298777, "uuid": "fc35a5a5-6bff-485e-bebf-14d11bf6b02b", "value": "98304:nwBbG0VW2D7zB8yatr4xP2GsiTggLDoSFiC:wRGKrq1tsxP2GhPLDoSFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298777, "uuid": "4e7d987d-b8b1-419c-9f69-146889826825", "value": 3487837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298777, "uuid": "80261985-0521-4118-91cd-62836ef042fd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298777, "uuid": "ce44360c-71d8-451a-9b1c-a9d3f9b0af33", "value": "invoice_document.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f291daf9-929b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617248405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248405, "uuid": "6c71c2c9-38e9-4e84-872d-2aff0b3b68e5", "comment": "Malware payload (Dridex)", "value": "89ee4ec36193fd602caa41b410610dd5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248405, "uuid": "9bf161fc-2ee5-411c-95f8-20322b0f6ef5", "comment": "Malware payload (Dridex)", "value": "7bd8e6a0d2bdb676e901a80bcd9bc1b12302e1cb770d08f72a0afea1be0bdaf4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248405, "uuid": "93dfc019-a1bd-4c26-81ea-d3b5600c37fc", "comment": "Malware payload (Dridex)", "value": "93a5cb5f21dd2950ca73b6ccc2c65d50e9229170", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617248405, "uuid": "40666c5a-73e6-4e38-8407-71c25cb09064", "comment": "Malware payload (Dridex)", "value": "556b2fb6e0daae392a07cb867b15c06dadc00177c4f8a2fedfae268197723a1993bf2bef967c8ad8bb4d4c4a03aaf2ed", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248405, "uuid": "a5592643-fc9a-4dd2-b10d-6b95dedb0ce7", "value": "5C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248405, "uuid": "de2a715e-fde2-44d0-bdbd-bd03e19f70f3", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248405, "uuid": "aea6e0bb-5062-4ede-b768-6c03aa777f07", "value": "3072:21i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:+i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617248405, "uuid": "872d8a0d-ef3f-49ba-bef1-4b338130fc77", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617248405, "uuid": "90f1cc65-8396-4176-8013-3900a636d59e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617248405, "uuid": "5a1c9091-137e-429b-9fce-217e8b5d053c", "value": "7bd8e6a0d2bdb676e901a80bcd9bc1b12302e1cb770d08f72a0afea1be0bdaf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1b6d1e-9333-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617313651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313651, "uuid": "171cef01-9ed1-4ab3-82f4-4b0694ca3d0a", "comment": "Malware payload", "value": "e7e6fd011d170581d7f720b1ce65a566", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313651, "uuid": "91f0a2d6-2c5e-42d1-a0cb-3d32b485267f", "comment": "Malware payload", "value": "7c269905fb834d5ccadf281e854c1638ff61ee82b36d5a78717d991b754c5429", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313651, "uuid": "af013dae-9164-4847-886a-d0104039ddfb", "comment": "Malware payload", "value": "45335f7abfda3ffa1d9f8cace8191a695bc2e29d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617313651, "uuid": "8800b777-95a1-46c6-a095-e0933b95b017", "comment": "Malware payload", "value": "f596015c27824ee68d3673d5d20156009019c3ec58b29ee5e2dbfc2f2fb736868d4ad2bdbcf9f878d96880b88f853b19", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313651, "uuid": "7b4ebff1-df3c-47be-9b32-cd09088824a0", "value": "7714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313651, "uuid": "06668114-f362-4647-b0cc-36ee57e5e060", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313651, "uuid": "28ce6fed-834a-4ab5-acc9-1e6c438ac418", "value": "3072:eopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:BpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617313651, "uuid": "32c69c56-8f95-48dc-86ff-fab77016f197", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617313651, "uuid": "e953347a-b7d5-4257-9084-9df42fd3282f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617313651, "uuid": "9eacf397-477d-40ad-a51a-034a5c2a3162", "value": "7c269905fb834d5ccadf281e854c1638ff61ee82b36d5a78717d991b754c5429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504d7a40-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617282492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282492, "uuid": "dd488704-e278-4eac-89c9-a9aaf57ef55b", "comment": "Malware payload (IcedID)", "value": "f3cbb4b7e884be9c050aa8826ee134b9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282492, "uuid": "ceaeabbb-6424-4c73-894a-8b5479a35c18", "comment": "Malware payload (IcedID)", "value": "7c3bfa8944f5dd5d1b3d06d4a61cdc45633623f1296fad9aef5cafe76f5f4a63", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282492, "uuid": "ffee28d5-b5b7-4110-8f74-3ef819ff9e31", "comment": "Malware payload (IcedID)", "value": "285cb06dc46e30f1cc3701c7b89030b36c68f4cc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282492, "uuid": "41a53bc9-bd06-49f0-bd4c-63c595d0f779", "comment": "Malware payload (IcedID)", "value": "3babed78c6cbb287011c02e778de8e08bfd29fcb1bb0a7630806ef2c7b41da3125ffb344f83b0edff0e42625b62bb695", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282492, "uuid": "4585d9f1-0bdc-4ec1-993f-2fecebb5f635", "value": "37044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282492, "uuid": "0287c53c-83a2-4037-ae8c-2e893338720b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282492, "uuid": "6eb5cc51-9bd1-4bf2-9d29-ea60757d07e2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282492, "uuid": "e59abb5d-988f-4cd8-9433-65343d1fe40c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282492, "uuid": "6d728606-dcf5-4bd7-bc71-389d50f17197", "value": "document-584569254.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acf40c9-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285865, "uuid": "097bcc6e-a94e-49b9-92d9-f2db3bc56a03", "comment": "Malware payload (IcedID)", "value": "fd95581e32fe34a1a899b86d9987778c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285865, "uuid": "de529f95-4d35-476f-ac8f-17f5882fc1ee", "comment": "Malware payload (IcedID)", "value": "7c3eba2bf6ceab55c6c34df5b5fcd2c8cdb451d4fe44d967c9a6a8f848e90d22", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285865, "uuid": "b0d806e7-8652-4f54-9422-2e368568e3cd", "comment": "Malware payload (IcedID)", "value": "6fb06c2300087a066bcf4c7179b611ee0e01969e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285865, "uuid": "25515cb6-c859-4920-b391-2663ae1a4505", "comment": "Malware payload (IcedID)", "value": "195e776bfef427a3a61a056362b9fce6e03ff6a86628eaca5314511f7956c7c535066d16b34dbc46106b4bdad963e58e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285865, "uuid": "55bfc608-cf4c-46e2-a1d5-877c05d55eaf", "value": "14044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285865, "uuid": "1de3c73d-5a25-40f7-9b4a-297d84e427b9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285865, "uuid": "0674ac48-1670-445f-8440-4e9e17359e29", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285865, "uuid": "afb3c8cd-1f80-4dfb-ac2b-81089c5f54ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285865, "uuid": "9daa8f26-d923-497b-8138-a36276be1d01", "value": "document-1153430680.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c1a045-92ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617255738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255738, "uuid": "9867a858-e890-4fc0-9a28-89594820b744", "comment": "Malware payload (AgentTesla)", "value": "4148e108cad58d9110d144228816ae6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255738, "uuid": "4d3a6773-7742-428d-9104-097801d33649", "comment": "Malware payload (AgentTesla)", "value": "7c5f8a44d779547d1fafecc0d0797d15e09779b2bef71aded94d47d3cd9fea74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255738, "uuid": "12ca80a1-5e34-4f83-a6c9-6212a5ba88d8", "comment": "Malware payload (AgentTesla)", "value": "fdee0ebe64c978ca6b4d56c42bae45ebc15ed670", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255738, "uuid": "a872ec4c-71bf-4a78-bb95-adf3666d1f7f", "comment": "Malware payload (AgentTesla)", "value": "f6c0fea18a42f238a4c6f8e4cf86e545a45f039f2f48122789d37918e08701c9999f9432be951b2dec029b2d145d2681", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255738, "uuid": "d5ece8d3-9622-4806-95eb-91de1c54d842", "value": "E0E46A7773437BAFCE7402B61002910072A4AD7AE66AE94CAD51738D6FBB3C04B9D179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255738, "uuid": "3fee1f74-9acd-49fb-9d6a-cbaa68c969f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255738, "uuid": "73a03aa2-30e0-4953-8143-b2e682922c86", "value": "12288:3GLIAoHq7L9AnGcH6XsOIEbaMo8xYbJ7oB3gNF:3GLIFHMEH+or82Fey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617255738, "uuid": "ef23bc6c-3171-48d1-93a8-a8591406f177", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617255738, "uuid": "897923a6-6306-40eb-9d1c-901db227d154", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255738, "uuid": "83890374-f95f-4d2b-b318-d4e2563b0b98", "value": "money.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab701f6-9323-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617306427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617306427, "uuid": "3dbaa1ab-dd41-4b22-aedf-32660505fd56", "comment": "Malware payload (Dridex)", "value": "60a75d3f5e0988307b7cc7a64172cd1a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617306427, "uuid": "5977b98d-3b3e-4c66-b5a5-5b4ebbce23b9", "comment": "Malware payload (Dridex)", "value": "7d1066fc4ad46a295e771c8617e296c963bdc6fe7b72ced9357b9ea59fdb6e7e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617306427, "uuid": "1203b3f0-deb3-450b-8569-7fa116197aaa", "comment": "Malware payload (Dridex)", "value": "a0c94003f7aa6c9a154a08f140af897d42437fcc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617306427, "uuid": "fe8a5438-6057-43cb-96da-08fa8bbc3c54", "comment": "Malware payload (Dridex)", "value": "9ea123a6daf93aa74d0d3037565b8fc36c7ea981a021ad7880a602026d5c4d9668818a4ff16feb7f14267afdc1a6df28", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617306427, "uuid": "1ce0a1ea-4fc7-4a18-bdbf-98b9e9a767ac", "value": "DE14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617306427, "uuid": "b50bad3c-6b65-4759-9176-d5043a06634f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617306427, "uuid": "8ee0e17b-0dae-439d-b209-0c0c50c5b823", "value": "3072:popj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:upjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617306427, "uuid": "6a8e72c3-554f-4897-9a1c-cc7772d770f6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617306427, "uuid": "d6439cca-215d-490e-b9c7-38857b2f982b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617306427, "uuid": "eb7be6dc-09ec-44be-bbac-191bd941d7f8", "value": "7d1066fc4ad46a295e771c8617e296c963bdc6fe7b72ced9357b9ea59fdb6e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b887b7-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277488, "uuid": "3a29db79-e029-4469-87f1-b71890512e32", "comment": "Malware payload (IcedID)", "value": "bb1c75cdd2ad766ca3ea2c45a91bfee7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277488, "uuid": "dd186611-82b6-4645-b976-ead9ee762855", "comment": "Malware payload (IcedID)", "value": "7d476b69f7fb9b036a9e51e7b768aafca782f29f52177de6e904264871b75bfd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277488, "uuid": "aaefdaf1-a378-478a-83a2-a8c6b58ec081", "comment": "Malware payload (IcedID)", "value": "a27ef1c5ee05ef51ff13de8373d108c8a2e8e3df", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277488, "uuid": "670ac51c-423f-41fc-a3c3-ce1539738c72", "comment": "Malware payload (IcedID)", "value": "6f6474b04cd76f6d2dcb48ac9372c673463b7caffa2246d39ab4d6cf04c6413920778542422b2e28c7fb10795608428d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277488, "uuid": "9ef8113f-b5b2-4403-952b-3ea07cad6543", "value": "83044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277488, "uuid": "42792e68-3f0a-49ef-86f0-8260702bc8a0", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277488, "uuid": "0992a99a-e58a-45f6-88ed-de26ee41f548", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277488, "uuid": "f852ea30-36b0-4320-a29e-566e7c007511", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277488, "uuid": "b56c9122-239f-43ac-8b85-3f6567e76db5", "value": "document-367185406.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43f70d2-9307-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617294739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294739, "uuid": "272055c8-e638-4215-a0af-0f40a26914fb", "comment": "Malware payload (IcedID)", "value": "0fbfbf9a3e34f385e0c0d016f24bdd21", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294739, "uuid": "e1135e0e-1821-4317-b416-e597cad9ea4b", "comment": "Malware payload (IcedID)", "value": "7d549bdf0a539d3b4f21ae06f006f4676e41dffea1e9a97bfad4c6a210e8dd57", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294739, "uuid": "1ffe2c6e-5cac-4eb6-86f5-b1fbb95e87d7", "comment": "Malware payload (IcedID)", "value": "bb1136922d4f94f9921ef6325ae53c825c212384", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617294739, "uuid": "46147636-9f69-4a8b-a26b-43acf1c97498", "comment": "Malware payload (IcedID)", "value": "dd9e87072f7424d9b6d0abcd7dd6f5d59bdbb49f445bdecc4be1abce29728ee2f16b53aec989c145261e95414b5dc0ce", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294739, "uuid": "2e5b4be7-2fc5-432b-96de-c1e3ece13c1a", "value": "30838DCDC913E1D9C2559FBD5A0A308511F4E0B7276FF11B148EAA2E0D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294739, "uuid": "af6fc9dd-3ed1-481f-9a8d-d86873b8d2c1", "value": "1536:IB240XZfcaaxf+EQliU2hawDCCAIoo8+BNvMhfvUZ:+2d1cBWEQXMDC9o8+nEhHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617294739, "uuid": "94be003b-24f5-40c8-b3ce-041ab8df1dea", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617294739, "uuid": "2666d07b-1c11-4770-8810-4d59b97be66b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617294739, "uuid": "fe5fdb0e-60b2-445a-b707-24d33d5fc843", "value": "427.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddfc3e1-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617259295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259295, "uuid": "bd470bf2-7935-4dc9-9a73-5eb279c4ccda", "comment": "Malware payload (Dridex)", "value": "4a0b7a44cc87103b6595db3767769c37", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259295, "uuid": "fbba5521-075d-4952-8747-f22d0ce456f0", "comment": "Malware payload (Dridex)", "value": "7d787e18e77b03f7883c1a9fb55639457789e0bbf6fab9c380fd625f6e334b84", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259295, "uuid": "aa478996-6e9b-4814-a3a9-3a43f9a5a828", "comment": "Malware payload (Dridex)", "value": "0180fc2779c7b5f52fbe7a797ea247b7911ba4cb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259295, "uuid": "54e40b1b-5698-438a-84c1-8ab99ba24257", "comment": "Malware payload (Dridex)", "value": "0218379c543043f2a5ce402790c568b8606e8842a56d69f14747b17a7492035d4a9a395c0aebf7291ac78aab0d616649", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259295, "uuid": "e011f70e-7957-4ddf-87ab-675eac02990b", "value": "9814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259295, "uuid": "55012a71-6f12-4448-8f07-142e7d58aff6", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259295, "uuid": "12a3f47f-3be6-4c0c-89db-b4b6f4481d22", "value": "3072:Uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:LpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259295, "uuid": "265b5d3b-6e1a-43d0-9a81-509b4de36a37", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259295, "uuid": "4086612f-4ef4-49c7-8cab-89c3cb2d36d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259295, "uuid": "360861a3-2312-402d-858a-098197375653", "value": "7d787e18e77b03f7883c1a9fb55639457789e0bbf6fab9c380fd625f6e334b84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dff78a2-92e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617278167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278167, "uuid": "b458cdf8-c458-4f15-a847-74abc8cac455", "comment": "Malware payload (IcedID)", "value": "c3aa97423a23fc7916bbf11d06b6a95d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278167, "uuid": "bf6c0b34-b336-4b5a-a7b2-5c6d296b23aa", "comment": "Malware payload (IcedID)", "value": "7ddb32b6d1481f39161384dc4915e073c4ef011f99f7ba529b9b1c742fda0488", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278167, "uuid": "8b4e9bc8-a217-4149-90f8-92ac4809edaf", "comment": "Malware payload (IcedID)", "value": "caa95beca822f3e820d0bbff8cece2ba09fb0ae1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617278167, "uuid": "963784e9-bea7-43d6-ad34-9e3dcf28f161", "comment": "Malware payload (IcedID)", "value": "5c0f57d734b5fd57ed50603144c3b663951cdcbae5534f4182bec118d4c7f185daa08a732cc9fa5a358a3501a4b9bfd0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278167, "uuid": "2179b448-5055-419a-a409-c51c828ab1b9", "value": "7A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278167, "uuid": "ac0f4429-0ee3-4068-9fb3-0db0eb274e8f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617278167, "uuid": "7a1de8b9-87ed-400c-b21e-38e3698156b2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617278167, "uuid": "788490cc-27ca-4dcb-9e0b-bc9e5580f9e5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617278167, "uuid": "1156fcee-2893-4958-ad9e-2c43a35c0717", "value": "document-2032888146.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa6ea91-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617291422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291422, "uuid": "96a5ea13-3578-4ae8-8562-3bf2733c590a", "comment": "Malware payload (IcedID)", "value": "d05f038c574ac597efe14851d9837d56", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291422, "uuid": "c70018f4-6717-4c38-9fb5-1a73c98ddc4b", "comment": "Malware payload (IcedID)", "value": "7de3cc4acdde4dca724bb3ac0710ba1c7a40155d6a9026d5ceab7068cb65c9ab", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291422, "uuid": "413ec01f-de67-403a-8257-0d66c6d94276", "comment": "Malware payload (IcedID)", "value": "e5f27e0e21d02c385fb2a6276ab96fa257e9140a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291422, "uuid": "6437d4c9-33fe-4615-8de6-a533c088d8c8", "comment": "Malware payload (IcedID)", "value": "a66a7a3e8dee28f1739e1c725d6563d4e45adfcd63b5aaaabe70f64d82c0abc22b9f9f6c7901ed6fbb41286affbdce2b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291422, "uuid": "7f77e455-001a-4001-b047-33b5a4af138c", "value": "0E838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291422, "uuid": "8755677b-04fd-4cfb-838a-445b2701aa13", "value": "1536:IB240XZfcaaxf+EQliU2hawyCAIoo8+BNvMhfv9G:+2d1cBWEQXMy9o8+nEhH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291422, "uuid": "1854cfa4-d521-441c-806d-ed4491dd77de", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291422, "uuid": "8b362135-073c-41f9-8d70-3fcfc28e6071", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291422, "uuid": "997af3ce-5132-4ed9-a8f5-7762e6d9dd94", "value": "2865.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c7e538-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617262042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262042, "uuid": "8972061e-539a-48de-bc77-f556f70d0e9f", "comment": "Malware payload", "value": "a7f37abc65de8b02ac67af17a289ad69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262042, "uuid": "8d0cb7e0-1182-4481-9827-5d57c59a8fa3", "comment": "Malware payload", "value": "7dfb08f5a669070d545d5e1e4d72c27b8c80d9c95820e441bbbacf1e9dd4aa31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262042, "uuid": "ac03412f-357e-4912-a054-ed7b5142c3af", "comment": "Malware payload", "value": "6d271d0f377728657f4c284253cdc51faa3fdb5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617262042, "uuid": "bea55f3e-fe85-4094-b4ca-3a0f10b0ec3f", "comment": "Malware payload", "value": "a34a1e9e1f7cd21d82eb4ac06c83a1ee4e486e11e297544063e0a3a769c075f94a006ce86c0f2b7b79c96c3be0c164cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262042, "uuid": "f8fd0f53-daf3-4f68-aebc-62bdb375cd73", "value": "1484F01AB7D20E87E9BA6EB12F9791F042B3B85B1FA7464B7640723D2821F114C9471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262042, "uuid": "561d1c04-fa40-4732-b0d8-435fa0ec9053", "value": "ce1c6fdc67e50426e322780731487a52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262042, "uuid": "e7739030-9138-44d1-88af-541ad73b7fe1", "value": "6144:run1cQ1S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYRJ:rx46A9jmP/uhu/yMS08CkntxYRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617262042, "uuid": "053ad42a-add3-427c-8715-f8c66f702b5e", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617262042, "uuid": "5628dfa9-d591-4179-a131-a1478e8f0b31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617262042, "uuid": "f0f8316c-0b40-4d9c-9485-46866705cd9c", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b9a2ef-9304-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617293096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293096, "uuid": "e8384f55-954d-4fa9-aafb-f4832febb95c", "comment": "Malware payload (IcedID)", "value": "849ed4be278bf5186bc8d507f015c6bb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293096, "uuid": "2d716f59-789b-4029-a3ab-b739d5257115", "comment": "Malware payload (IcedID)", "value": "7e08db8a8fa300b4cd3ffe9b5be146b148b09fb292a3f02a7724bf3679e535fd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293096, "uuid": "e8535eb8-1986-464c-9f3f-1f448e175b30", "comment": "Malware payload (IcedID)", "value": "5511c4b113895d24a3c99ffa24db15d73a5da8d1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617293096, "uuid": "31eb3ee0-ae7d-41ed-afbd-ce7ff57144e9", "comment": "Malware payload (IcedID)", "value": "dc081a0500223da189054917052f7283a3d2f310238717eaf5dcefd4771a19d94ae8b9379891f04d0867897727aae8cc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293096, "uuid": "95be9902-d2fa-4425-9fcf-f22d5871e2e4", "value": "0E838DCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E4C42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293096, "uuid": "f90cb6b3-a5ad-4f31-8e2f-4a70701a1e9b", "value": "1536:IB240XZfcaaxf+EQliU2hawrCAIoo8+BNvMhfvP:+2d1cBWEQXMr9o8+nEhHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617293096, "uuid": "4bd4a850-5051-4ba0-922d-b151f466b07b", "value": 86229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617293096, "uuid": "0af5090e-60e8-478c-addb-ee1f3ed4c36f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617293096, "uuid": "d932d5f5-0b6c-404f-b772-b3e3538560dd", "value": "50.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e01435c-9314-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617300232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300232, "uuid": "c65471bc-b95e-422b-a227-ade54f70d112", "comment": "Malware payload (IcedID)", "value": "334d00797a81510d43a72ff0362c7646", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300232, "uuid": "abf3a124-881e-46cb-a77a-181c2fe6c399", "comment": "Malware payload (IcedID)", "value": "7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c10ffea21a2f1de5ab1e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300232, "uuid": "734d18ce-0502-43fc-ae79-98d941145650", "comment": "Malware payload (IcedID)", "value": "8f26e583f534fd1c938e90ad6be2cb2e8b72be66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300232, "uuid": "b9d6d28c-54f9-4bdc-9566-ca28fd74a0e7", "comment": "Malware payload (IcedID)", "value": "d3abace591db71d160f1da8ac7ee391253e9586b75cc53ca4e9526a80476976ce3cefa5cfdc206fb44f0d948f3dbc85f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300232, "uuid": "b1e55193-f686-4dd1-8793-ad90802f0fd5", "value": "111408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300232, "uuid": "ab4d9b2b-535f-4e72-abc0-1a248520ef33", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300232, "uuid": "21b9dbc9-d5eb-4b76-ac8e-52b5bbd60efb", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300232, "uuid": "e2141564-8165-4544-bfa8-ca724badff6b", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300232, "uuid": "16c80ca9-0ff5-43a9-8702-4f61a3429118", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300232, "uuid": "0a42fea1-269d-4a48-b91e-7b089ec05309", "value": "7e0f852c50ed0664130482f2683c99ce6bbb67750bd5c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b286a605-92d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617274067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274067, "uuid": "eb6eaf16-a11b-49e9-8bd2-5b88a5a12849", "comment": "Malware payload (IcedID)", "value": "c0fad6c960483c8c90011c9a708dd289", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274067, "uuid": "7654bb79-733d-418e-abf6-68cae68bca72", "comment": "Malware payload (IcedID)", "value": "7e31cd28250f8447176ab0832e51fc4fdd39c4e11341fd8578f5521c2f389b3d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274067, "uuid": "48c38d6a-44b3-46bf-a7a5-86c1163fefb3", "comment": "Malware payload (IcedID)", "value": "00d62993f0e48be3dc87d008ff548071e342a8f8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617274067, "uuid": "0324f2de-8601-484f-bb82-f7591528f495", "comment": "Malware payload (IcedID)", "value": "2781a33eacc02673045079c4d8cea8330dbc4045a413c18f9632c20a417dcc16bf3997e15c411104787743ece50de0a6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274067, "uuid": "9de8699c-fa31-45f6-b074-fc67b26ccfa2", "value": "CC044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274067, "uuid": "7b8d446f-49af-4edd-8ccb-8943f09f5fe9", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617274067, "uuid": "8feabfa0-9baf-48d9-bfc1-385de23efcad", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617274067, "uuid": "0d246421-c8e0-4d99-927b-3f8851514cb6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617274067, "uuid": "0aaf059c-ff5a-4f70-8e9c-0bd49330d24d", "value": "document-2035883902.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9131d9a-92ce-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617270239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617270239, "uuid": "f28a7c98-5b97-46e9-bd28-33b722c5e370", "comment": "Malware payload", "value": "8d366bae07d5957d52b939e97ca4e390", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617270239, "uuid": "125c2464-3d37-4fd0-90dc-68a57ededcb2", "comment": "Malware payload", "value": "7e3b3b39085b938163b3618b5f4614d77cef3fd4ddde0bef1a1a418bc71e5f6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617270239, "uuid": "8cd164cd-5ce4-4fd0-a4af-45643ea30c88", "comment": "Malware payload", "value": "5e84947c91404fc4da2745748be76b739a0c3ce0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617270239, "uuid": "217ed49b-57d2-42f8-8b88-9b640cdc445d", "comment": "Malware payload", "value": "9898c3ee8017766b5fe552d1b30ccb30418c370ede1c46ad677ad492e27c9ee1fb035114daa666b49bdef7ed92a96d90", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617270239, "uuid": "e2ae67d4-adae-4d05-9295-3d5b13088d0b", "value": "9075F80561C1E1FCD81C6D8820DF0D7E25D99A01712EBFFABF756A212AFB249017D27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617270239, "uuid": "2d4db26c-1d89-43b4-9112-8676f7586240", "value": "24576:EKNbzj2EaI9AnpSl02y1GDWYcU/0tLEhyGJI:bzj2EaI9ysi0D+cDHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617270239, "uuid": "4b4f3cbc-66f5-4a0d-ad3d-a5a8cecab181", "value": 1665378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617270239, "uuid": "4cc0eff6-7398-4e81-a82f-d2226c4541db", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617270239, "uuid": "fab35bab-1b77-46d5-bc95-ff868a540f7a", "value": "lol.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cf2bd7-92e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617279096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279096, "uuid": "b7755820-e9f2-4c26-9115-b544843ac933", "comment": "Malware payload (IcedID)", "value": "e45039c49cf29b4587cf20efda96fee3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279096, "uuid": "88f76159-c63a-40e7-9756-51e1597507ee", "comment": "Malware payload (IcedID)", "value": "7e5969c8cb0502377ca88030dd6b4e487c4e5c5aa7c3587152bfee028dad6de3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279096, "uuid": "3eceb001-f45e-41ff-b9e9-4371e5d7ec2a", "comment": "Malware payload (IcedID)", "value": "60a283fb05160f6d320ec89cd5983d3ad93a44ee", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617279096, "uuid": "c673a6a3-718a-43fc-aa43-32adfbbfe1af", "comment": "Malware payload (IcedID)", "value": "11fedcb7ad5e2449a03e53260abf37837ac36f5800622adb7a5071a5d135e88c8f75f5ad52895b3aba23a52a3d9dd62e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279096, "uuid": "5a1a4a28-7b13-4072-abbd-18b4cde47748", "value": "05044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279096, "uuid": "e7a45a12-9d86-4a4c-93c0-1d60e2761d76", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUT:4PmxIEudkLeXPD/PjYwe2DMo3S/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617279096, "uuid": "82ebe1f8-1559-4c82-b033-f39309f38726", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617279096, "uuid": "fc4a3f7b-b8c2-4f38-a7ae-06d7ed14d986", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617279096, "uuid": "6f316d12-6245-41cb-ba36-8dd7d9397efc", "value": "document-413212810.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc79d3d-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275294, "uuid": "f180ff8a-ca7b-4cf8-9c01-c2dcde4ed10e", "comment": "Malware payload (IcedID)", "value": "a112c680fce3907f807e8fdea444bf13", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275294, "uuid": "acca6d75-00f6-42ad-b11b-fb300f81075a", "comment": "Malware payload (IcedID)", "value": "7ebcfa361c25e7eb88753028fadef258fcd5e6a05a7889e5866b2815e8f63b99", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275294, "uuid": "3ff20769-0c27-4bae-b4ff-acdb93b0c6ca", "comment": "Malware payload (IcedID)", "value": "32c169c6bcc6da3d73e98096795747d35a6c79c3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275294, "uuid": "a077a277-2d26-4e9d-81f6-ab452f695cf8", "comment": "Malware payload (IcedID)", "value": "c997df15273d1f61c19291ea058699269fdd2cb84027bf99ef64fe48461042bfa5be005a26effe7736c9d9af6b28b8ab", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275294, "uuid": "d816e6d0-8c99-41a4-93ca-716e1ebcbc82", "value": "06044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275294, "uuid": "10c96e38-6c5d-4902-9cd6-4411f89665f3", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUD:4PmxIEudkLeXPD/PjYwe2DMo3S/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275294, "uuid": "db409e43-c5d0-4eef-aac5-7865f6368bad", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275294, "uuid": "7a58027c-b454-4419-af97-6a1125225527", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275294, "uuid": "ae4f3a1e-9845-4fa2-be94-463ad5ae33ad", "value": "document-2125236592.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd32b06-92da-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617275291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275291, "uuid": "ef158ba9-db90-4bcf-9d16-effdfec9c210", "comment": "Malware payload (IcedID)", "value": "37d5352c9cd8ac7c3b187e08e2e13ec9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275291, "uuid": "987fd388-611a-4097-8b11-23cfb9d3e5c6", "comment": "Malware payload (IcedID)", "value": "7ec0fa501247e4dc5b96b13fe1527517ac553d6921d6c0443eecea0442b3a3e0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275291, "uuid": "08828390-a44f-4411-aea7-832d1955a824", "comment": "Malware payload (IcedID)", "value": "1b04992b7a9b161b0fbe8188acbf06fe0f7ba024", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617275291, "uuid": "6854828c-724f-4781-b6d9-f9c1a58678f1", "comment": "Malware payload (IcedID)", "value": "491d74f8371802a882511695492aa01fe0031337eb6b1f138cca572d7f027af0838d37435d069c002730c4554df9b3e6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275291, "uuid": "a2edcf8b-953c-4d94-b17e-d2dfea14db1a", "value": "8F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275291, "uuid": "89f355f8-f363-4791-a92b-e54368667b13", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU/:4PmxIEudkLeXPD/PjYwe2DMo3S/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617275291, "uuid": "1709db19-3e86-41e8-847f-a55b516f0206", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617275291, "uuid": "cb0d5ded-6381-4e36-8725-8c47714b9a0d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617275291, "uuid": "376ef753-f8ab-4e3c-87bd-90c67ab5c80a", "value": "document-1979178991.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb20b65-92f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617285894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285894, "uuid": "52f145ee-c239-40b0-b563-114b720b1079", "comment": "Malware payload (IcedID)", "value": "6f6765a4676be055429abec9d699d576", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285894, "uuid": "782f1dcd-9b2f-4699-85e6-effbc471a0b5", "comment": "Malware payload (IcedID)", "value": "7ec7fa2547c00836abe7b5419ec03d0d4fafda0b35bad738c5675e3663dea081", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285894, "uuid": "9458970b-32ec-441d-afdd-f7c95e4815ee", "comment": "Malware payload (IcedID)", "value": "071fd4a92946bf3997d495af20dac35f929c4493", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285894, "uuid": "cbdf55aa-37e0-4f5b-ad7b-8a5d8e918733", "comment": "Malware payload (IcedID)", "value": "09f7f30cf2b4721ea9e98c4fadbe13ea51d957e8b96d27fbb6101356bef38aef79dfa836c9a1b548655d723d16af055a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285894, "uuid": "30768d5e-37f4-491d-be79-efc9546aca07", "value": "66838CCDC913E1D9C2559FBD5A0A308512F4E0B6276FF11B148EA63E0D42FA80A5E79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285894, "uuid": "47e3a486-cf6c-4fc2-a3e9-e6b0b7152aa0", "value": "1536:IB240XZfcaaxf+EQliU2hawZbCAIoo8+BNvMhfvZT:+2d1cBWEQXMZb9o8+nEhHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285894, "uuid": "36648f68-a57d-4263-921a-58366297d764", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285894, "uuid": "29a7e6ee-f511-44cd-9c86-3165dfcdf105", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285894, "uuid": "b1c5acf5-01b2-424b-95e6-f0dcca7cf437", "value": "1132.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42a9eac-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280915, "uuid": "5b1a0ba6-fdd0-42a0-be6d-b043d455b788", "comment": "Malware payload (IcedID)", "value": "1abff5a255b3d80ed690e619b9d82b99", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280915, "uuid": "72dcb4f2-f517-4fc8-87c3-8eca7a0e84a5", "comment": "Malware payload (IcedID)", "value": "7efab70a6fac6165b99d557b693329421ee30c0d4499554c21a5e31e0f8f7a59", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280915, "uuid": "46499dbf-d37d-4d88-94ce-12f3efa49c81", "comment": "Malware payload (IcedID)", "value": "9ef8b8939b744c4cf2de97520ec1a0b4392ad3d1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280915, "uuid": "02388003-e226-438f-a814-87189c1bb471", "comment": "Malware payload (IcedID)", "value": "da09072253b1cc3387b33a36c1969bae654edcc0327823972e1af542fbdd4bc73d48412715b6195e53ed7432f41f8b1e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280915, "uuid": "afb4d33d-e21d-4487-8d74-6f55b4e7db06", "value": "8B044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280915, "uuid": "2b77b074-74f2-4648-8667-aa206d12e5d8", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUP:4PmxIEudkLeXPD/PjYwe2DMo3S/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280915, "uuid": "a7596512-ef0d-4094-a326-3d0300ff9e0c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280915, "uuid": "b45fa82f-14ed-4059-b6ce-a7ccaf12d6f3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280915, "uuid": "36962c56-46e0-4766-b868-b67da5b6c569", "value": "document-56164775.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71f562d-92ba-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261727, "uuid": "96a6b062-60b9-4d9a-9a02-0ff6203345da", "comment": "Malware payload (Formbook)", "value": "146df9b86840579f7bdf40693a83edc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261727, "uuid": "49662eab-3a38-4bf3-aea1-da64809b8c66", "comment": "Malware payload (Formbook)", "value": "7f6694752a3e50d4f811fb5c807f305ba5c4b422c3fa10468132575c6c2505b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261727, "uuid": "d4565ad4-10d7-46a8-b68e-17cac7f833ff", "comment": "Malware payload (Formbook)", "value": "277d53db9c1c88189d59e98c5aa3c7a14e72faa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261727, "uuid": "a089cd5e-2d53-4507-9fc0-fdd9c1a11206", "comment": "Malware payload (Formbook)", "value": "977862f1d6aecc0e41dcab3387796d633e21d7ea1943885ab3caf6720208f9fc393d01529f869dd03e5e6a272550eec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261727, "uuid": "4e04b634-333d-4db7-83ab-1f42ef171567", "value": "D4C4692333467F5AED7F17751052010023B3AD26EE2AD3CDA8647E5C7E776C086AA263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261727, "uuid": "06b82f33-4e58-4fbc-b783-68ee62fe6018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261727, "uuid": "28353d11-f0f4-4ad3-a7a3-9680245dbfa6", "value": "12288:nQR83xj4nSQlNEed9o+U10LfVq1jFdQuBD5:nn4nSQnTd9SGfVq13b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261727, "uuid": "2c32931f-4d43-4809-9e41-1b9dca522f4a", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261727, "uuid": "97accacc-3a61-41ad-b7cf-1ee6f4354c63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261727, "uuid": "1389cf95-761f-49a5-babd-ea6a752bc0d0", "value": "PO PL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0032cbbd-930a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617295672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295672, "uuid": "02d4f3c7-ded0-4024-b4de-1aa52b6f7635", "comment": "Malware payload (IcedID)", "value": "f53f9ccadab47092fdacea5b01f5175f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295672, "uuid": "2674f98f-7cc0-42ed-84e6-f427c1e123d3", "comment": "Malware payload (IcedID)", "value": "7f669fa226e74a5e772dc1e1e46633fc9ad9c5f3becee5edadd418156bc053cc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295672, "uuid": "260a7041-c2ae-4bc6-a121-f1edcad139d8", "comment": "Malware payload (IcedID)", "value": "bfacdb4cd5c9ed75dc5a3da2afd276d9b7323ab2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617295672, "uuid": "37a7effe-6a5b-4230-bc65-876a72e64e29", "comment": "Malware payload (IcedID)", "value": "9d734340edc44d6ff31214f6a7ebb9e05fac45cae52625e2be26cfee2d1493067bc8267f42b2c74593f404bc77b95465", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295672, "uuid": "5a039132-9419-42c6-a09d-88ce6661dbc5", "value": "CD838DCDC913E1D9C2559FBD5A09308512F4E0B72B6FF11B148EAA3E0D42FA40A5E79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295672, "uuid": "afc9164f-6a71-4886-8359-62a7954922b1", "value": "1536:IB240XZfcaaxf+EQliU2hawxQCAIoo8+BNvMhfvM:+2d1cBWEQXMxQ9o8+nEhHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617295672, "uuid": "9f90cd96-e653-42bd-9a1b-6b3ee76fe580", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617295672, "uuid": "880e7cd0-448b-482f-ac87-3cc2161da4e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617295672, "uuid": "98df7655-8f3c-4839-92d5-bff196b5f69f", "value": "63.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768a7506-92ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617255928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255928, "uuid": "f10b6b0d-d2a6-4aee-af15-a05a8ed39fcf", "comment": "Malware payload (AgentTesla)", "value": "28ea592744f4ed020b6f1ccf4d4ebd24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255928, "uuid": "7e480853-abeb-4118-b0c6-93b66e6da709", "comment": "Malware payload (AgentTesla)", "value": "7f924ede2a53847cf7cba66d3530dbad9cff59478768bc1b846d7c605a756bfc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255928, "uuid": "26ebebd2-a66b-439a-943b-078c37e966f6", "comment": "Malware payload (AgentTesla)", "value": "cb83940ed19192d035e85f9f5a690315865b75de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255928, "uuid": "cc2144d0-0eb9-438d-8c74-35ce9da9d76d", "comment": "Malware payload (AgentTesla)", "value": "5a570b8c28fc8328061319650efb5360a724c2b95f3afa8268919bd152a6e269a6fa7ec2ed2ef6b191a5cf2180179052", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255928, "uuid": "42e8d505-99a8-40b9-ad99-8b7eed14cf70", "value": "F99423966A5B4591F1E286147D77518CC504AAA33F3264EA4EE701CEEFE41F90EFCC90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255928, "uuid": "14c2d52b-be3d-4506-8060-831c24bbf3ba", "value": "12288:D5mfg/WkaX/vCm09kvfh1ciDweYur2jVSFdnqH1y58++Bs1M:DofUWkKnCmiCJ76VSTbTWCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617255928, "uuid": "6579229b-1c67-45cb-a468-79659214113f", "value": 423583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617255928, "uuid": "2f5648af-2e0a-4c9c-9d1a-22ba7474af51", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255928, "uuid": "81945cae-21f3-4188-a8ba-b34e50864d03", "value": "Documentos de DHL..PDF.....gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40d7ea7-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280968, "uuid": "6d81bb73-80b3-4e5f-9969-0dbc73c7d214", "comment": "Malware payload (IcedID)", "value": "725cdad60a50b40bd335ef839bd10bd5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280968, "uuid": "05d3a6cf-a2d6-45c7-9da4-d2f6985f4287", "comment": "Malware payload (IcedID)", "value": "7fc5061fd3c8ff2b90fe6abdd48447d340938619490c232ea06b9076999fa076", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280968, "uuid": "06c49c7f-2c04-442d-8070-5600939c79ce", "comment": "Malware payload (IcedID)", "value": "4a4029be34e64a2ecafe7a50c0b3e746a8f22fa4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280968, "uuid": "6dc85e2c-0f84-4131-a956-b0d08f16e956", "comment": "Malware payload (IcedID)", "value": "0382cd74a0d0958838a6317e7c35bf652cf125adcfa4f1ce007b44280c9a633fc608f1a208df11be714bfb295264c390", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280968, "uuid": "fda566c1-1405-499f-bf6f-5f16a055c5a9", "value": "1F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280968, "uuid": "a7f96b9b-3128-4c6f-93b9-9f6bd40bfc4b", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280968, "uuid": "aac2f467-f007-4cdb-8495-e78f3bea273d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280968, "uuid": "ff36061e-7765-41f3-9606-25a68ca1fa78", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280968, "uuid": "3ff2a758-0687-4bd9-8558-f15c6f1f1f83", "value": "document-1203349197.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8eb98b-92f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617285122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285122, "uuid": "9b0ab336-3e7f-4144-8229-2c692e5aa7c4", "comment": "Malware payload", "value": "bc19fd2a134a569c55c8fbd277554cff", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285122, "uuid": "84ef02fc-ca18-49f5-820e-452801f41e2e", "comment": "Malware payload", "value": "7fea2a750341c08af57eeae9a3dd0b978e3f0c2f1cc6dd335916cf47e3f170df", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285122, "uuid": "3af1a5fb-7d07-429e-9671-ca480f9e1a08", "comment": "Malware payload", "value": "59cf9ee51ddbe5e70a640cd9705ba1aff8fd7fcc", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617285122, "uuid": "aaf680d9-9a72-46a1-9c3f-bd95a75c0e51", "comment": "Malware payload", "value": "c749fef1a3fef5b24636dd19fd4e6c16bfc2da9c3ab51bb6c53e2be3d3c8eb100f64088031ba72759f8a618800d43eef", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285122, "uuid": "cf3e7752-6a27-409e-9291-8a6f65b3faae", "value": "4005BF53F3E640BAC0AB9671CA12671BEBF1B80A0134D74B57D49EA52F13B62672F311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285122, "uuid": "1be6e0fd-b528-4ea4-94aa-a6c54fe8a419", "value": "12288:cJtsjUjFW/kX5OAmmB6vYqTCLRm/RBeI1HpI2f6TiD+R3acHMiHFxybLRCOm8:YtnFWsX5SmBKbZh1plf6THJMilxAm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617285122, "uuid": "3fc2ea0b-b81e-4503-9142-e8e48e6f0378", "value": 803752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617285122, "uuid": "d3ffb692-9344-441e-a03a-b71e8fa3e1ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617285122, "uuid": "6d38b496-9b5a-4ea8-a991-3d1d12acac61", "value": "10296c58.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7790fa-92f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617288583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288583, "uuid": "622e99e4-ed14-4cbd-924d-f35f046ba9fb", "comment": "Malware payload (IcedID)", "value": "10e4c55a34b4671899a95943d0f2267e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288583, "uuid": "254fbcf2-dfbb-4cf1-b85c-c2e4a8673ea6", "comment": "Malware payload (IcedID)", "value": "800c67c85647be2db7b62cfd07aa481245b43443f1ea6da9032844a6cb2cf5be", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288583, "uuid": "56c4daf2-bdc4-477e-896d-2ded8ca1ea85", "comment": "Malware payload (IcedID)", "value": "71f84faa74c52af9f9a205d27f5c4a085916ac46", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617288583, "uuid": "108d4d53-b81d-422f-b61f-6960b4b72d7c", "comment": "Malware payload (IcedID)", "value": "b4f771e4de7f9f6e5e94130d0c8762612e098d96899b4ff480e85e505faa8c91a17a4905cfdd40a392121c0f5de4c3ab", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288583, "uuid": "04a958a6-882e-4532-9206-cf2ab41a707a", "value": "C8838CCDC913E1D9C2559FBD5A09308512F4E0B6276FF11B148EAA2E0D42FA80A5F79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288583, "uuid": "0e73e724-8318-4075-9944-1e684705a32a", "value": "1536:IB240XZfcaaxf+EQliU2hawPCAIoo8+BNvMhfvZ3:+2d1cBWEQXMP9o8+nEhH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617288583, "uuid": "c8f4283b-a0cc-4b4e-8188-eac938b21b67", "value": 86232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617288583, "uuid": "3986fd1f-d812-45dc-b08c-94e324307179", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617288583, "uuid": "1b084679-0e7b-439d-b1e0-ffa313d9142a", "value": "1308.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d97739c-92eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617282541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282541, "uuid": "366c2f67-9859-403f-942a-cdf4d66c6857", "comment": "Malware payload (AgentTesla)", "value": "7c22cc42613419161faa675ac0976561", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282541, "uuid": "a58834ee-49f0-4927-ab97-37c01cf25429", "comment": "Malware payload (AgentTesla)", "value": "800ffa522137b2f3c1680ae06422a45b92462e12d043b41df2607f5584f69971", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282541, "uuid": "9ce18f48-233f-42c7-8d11-cf89eb860f94", "comment": "Malware payload (AgentTesla)", "value": "05fde031ade66b6e918ef4cf53fc0e9c1871dade", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617282541, "uuid": "ec12e696-aceb-4f26-9bee-31e3ab15e563", "comment": "Malware payload (AgentTesla)", "value": "b2e69844176fb9824df863da3cd7a7ca29eeade83b67845cba8671efc00c9819d41e212da6f461e03c909e7ed915ed52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282541, "uuid": "ebe5cd1e-1df3-4560-9daf-96ee517b950b", "value": "2225BE293B20154EC4A636F85454D04C5BE27DA92592C2837EFD3BEB60B2F93CFA415E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282541, "uuid": "36f682de-fac9-42ee-8148-60db29c47d61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282541, "uuid": "2aa54565-417e-4033-b451-bf42688e2ba3", "value": "12288:2PJ+OpwdkGU/KCYeTdoL6mE0rCOkMzT610RbociSEa/0lkZCu:eDwdkGUyCYl2ntOknehiy0Ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617282541, "uuid": "f0fd59fb-17c7-4c14-a1c1-700d1390c4a7", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617282541, "uuid": "c4f28736-d067-4152-9e6a-7d1848fbe5f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617282541, "uuid": "d7c05f5f-d857-4c5b-9249-4091c71a85b2", "value": "Updated SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada8e99e-92df-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617277495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277495, "uuid": "69b9ecc4-1bd2-42f2-adca-528c524c17e5", "comment": "Malware payload (IcedID)", "value": "67f6b3988bda48e4fd9273bb6a3b2d52", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277495, "uuid": "398c4331-7698-44e1-bb2b-fedfdda275b2", "comment": "Malware payload (IcedID)", "value": "802b64abac9bba3d164a4765ca7aacb25db426b7db175602e67c0980113391d5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277495, "uuid": "1d9dcab8-d3ad-4e01-85e2-0a1be5cc97c7", "comment": "Malware payload (IcedID)", "value": "77a3f8e08c5f62ca744dbe6d747605bb5a6cb5cd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277495, "uuid": "28f37ebe-1060-40d9-890c-e5bf5b61e514", "comment": "Malware payload (IcedID)", "value": "7ee8c4329293e3597d92c4aefda54289e9bfc91268024279c932c178a4272da18c1a50ece40393936936b82c1c9ae62d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277495, "uuid": "dc13a2a3-2784-4978-a452-01a626965fc6", "value": "4C044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277495, "uuid": "a7a9ce66-cf37-4198-b09f-75a0d405e1cb", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277495, "uuid": "e8d77027-08ff-4ee3-a7b4-924b064ba8a0", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277495, "uuid": "73fa6da4-e1a4-4a08-bd43-b621b3078567", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277495, "uuid": "213fb9e1-89c3-4a2e-aa61-4cb115e09c3a", "value": "document-1654484307.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbaae86b-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283531, "uuid": "6f2ad834-e334-4b3a-9be5-481a2ae7f0b8", "comment": "Malware payload (IcedID)", "value": "47522bdd010883a9e74cb8181cbe9ca6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283531, "uuid": "c5865914-9945-4944-9c5e-4a96c35b945a", "comment": "Malware payload (IcedID)", "value": "8056bab3acd183eaa0e61874ffbb58360edb25708dfab50a45b34d6982d7d1d9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283531, "uuid": "c5b5cfba-d940-4717-a6c3-b849c8881d6d", "comment": "Malware payload (IcedID)", "value": "bc2d27feafe98e5192cd63457313e1ba584056da", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283531, "uuid": "b6c5c185-393e-4353-8f2c-eff4e517a009", "comment": "Malware payload (IcedID)", "value": "c05c6eeccb77a20237ceaf5e39e4471de4629dfbb3050122b6759869107b45189e78fb82235b104d139caa84e11ad7fa", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283531, "uuid": "b53e61c3-3639-4b7d-8fd5-30b2b284b052", "value": "18044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283531, "uuid": "f20c0df2-c1b3-4a2b-899d-a367a83113da", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUZ:4PmxIEudkLeXPD/PjYwe2DMo3S/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283531, "uuid": "9582f2ed-f8f2-4dea-b93a-73ad9bfe81db", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283531, "uuid": "f6c528a1-d48f-4f19-9f31-633e8925f5cd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283531, "uuid": "8cecc680-d706-4bba-83d6-f4bfc8223984", "value": "document-1930307749.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9397ed71-92e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617280887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280887, "uuid": "c1bed32a-5896-4219-8803-47e57b5db6fd", "comment": "Malware payload (IcedID)", "value": "a79449cafd9e03e642d37e4650c6ea46", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280887, "uuid": "ca3a9391-b67b-4f4f-bcf7-1d32b9fa38ab", "comment": "Malware payload (IcedID)", "value": "8097dc54b91e14ea991bc264e9aa81fbd8347ca316c8dfb2b4e82ab4e05f37d4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280887, "uuid": "958db0de-93b2-4143-812c-c25b8ce64b31", "comment": "Malware payload (IcedID)", "value": "ec136a2a484ff4c86c9cc2cdee7f6785d340ccd1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617280887, "uuid": "496733ee-1953-4b55-b950-0acca50a97d7", "comment": "Malware payload (IcedID)", "value": "a9343d5ca9ab86965bb0deb2bd3e4f603b439e94ed9bbbf703180244f717d1498cce8f38664acc63366054f545e41a9e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280887, "uuid": "5ffae9ef-e8cb-4d84-bd71-21ea5b0abafb", "value": "1F044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280887, "uuid": "8d884664-6e31-49e0-9c16-c2fed032b026", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617280887, "uuid": "37f8c3b0-8a3d-4d6e-ae4a-624b4c6b0b9e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617280887, "uuid": "dee18929-4682-4d9b-9b19-4e90beff3990", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617280887, "uuid": "86e3c628-1474-4151-8c94-320f311047eb", "value": "document-1332674951.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a45751d-92b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1617259665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259665, "uuid": "159c8379-f578-4383-9f51-2a661214afec", "comment": "Malware payload (ParallaxRAT)", "value": "a39fda372c7f2c9978a39b03a8c8e5dd", "object_relation": "md5", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259665, "uuid": "478812e6-2c41-43fc-be29-2445aeebd7cb", "comment": "Malware payload (ParallaxRAT)", "value": "80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01", "object_relation": "sha256", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259665, "uuid": "f83f9fb0-b9b6-4a6d-b0e5-66e7ed5cfc5e", "comment": "Malware payload (ParallaxRAT)", "value": "2b59bbb4ea1e8fb27ac82d30c2a7bb2433fdd567", "object_relation": "sha1", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259665, "uuid": "bab0b76a-5ba6-4a1b-8bff-7c48f7e7af4d", "comment": "Malware payload (ParallaxRAT)", "value": "7286b7dc39baff1ec5481c7c345ab477bd5c515f775fab8fd4fd56ef51f4da1fc09f30256ff6b849f67eb1f1fbc0115b", "object_relation": "sha3-384", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259665, "uuid": "b3bffebd-e6fa-4f48-93d2-098a1a18244f", "value": "2FA48D337290C43BE1A227B88854F7794E6AB9F46D35C207BBA155D8FD50B938E28371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259665, "uuid": "ca526dfa-5e9d-4da9-8f01-41f0a48a6677", "value": "425c54b6507d90a6e2c9eaf3ecf04a80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259665, "uuid": "756c3db2-c2ba-4cfa-a382-ed47b68a4e19", "value": "12288:gqFIlDHGjf9HdaVGizzEAbnJ/48FtPVqKY:9Wsjf9bizzDp1FTqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259665, "uuid": "933851ff-5c56-42e2-ab69-235f75ff513e", "value": 487448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259665, "uuid": "c62e060e-1fea-419e-8d32-3fd16cc8da4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259665, "uuid": "d2a38baf-ace0-4852-8b80-5f6d99db4688", "value": "80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b59a6c-92ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617283520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283520, "uuid": "b4422f68-658e-4c5f-acf3-51223a66d554", "comment": "Malware payload (IcedID)", "value": "458ba7275322918c265f46d0731eabeb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283520, "uuid": "8367d41c-ee76-4c85-b9cd-6e98b2dada61", "comment": "Malware payload (IcedID)", "value": "80e6bef400b1ab2ff3d1f030cb43ffa68b22ad128957f66d97f36d47d6899f96", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283520, "uuid": "8521b4e2-0c7c-441a-87a2-4b418670acc2", "comment": "Malware payload (IcedID)", "value": "693edd834308819201568801ee086949ff20b3f4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617283520, "uuid": "2654cdce-09c0-4383-98fe-1b4c16f74bf2", "comment": "Malware payload (IcedID)", "value": "fa4cd731dc07a6ec6117c5d9fc8baaa46ef6a46bd2dbf7a51c546591834dcaae5aa62ee0dc5b4fbbc6a2148cdd64b118", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283520, "uuid": "07c43852-e9c2-4213-9f6e-56524f00f7ca", "value": "5A044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283520, "uuid": "93c592e1-007b-470a-a0f9-e8a84e16da7f", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617283520, "uuid": "0b2b1ad2-60c4-4c57-bf4a-116755151328", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617283520, "uuid": "3a1ce59a-0404-4c97-8498-757e7aeb8de5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617283520, "uuid": "5fdd6359-955f-4f1f-8ee2-5a64f0190dc8", "value": "document-358627611.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00722ca-9300-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617291726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291726, "uuid": "95b1e76f-cbdc-4684-bb2f-66392b059f4c", "comment": "Malware payload (Formbook)", "value": "4669fdab7e906ca0b166d8b4b315e326", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291726, "uuid": "e986eb45-0783-4f60-84e7-1086ddda3f9e", "comment": "Malware payload (Formbook)", "value": "80eae8d63facb880887f4f54f862128e8d28e2a706ad0f9bad806e9b98fa7e3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291726, "uuid": "6417c1b0-2516-49e0-8b4e-6026d65f986a", "comment": "Malware payload (Formbook)", "value": "21b0f43548b7ead5b016e79aa0e03d2780e47d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617291726, "uuid": "71846c05-5a0b-452a-8e14-5094c39e1e43", "comment": "Malware payload (Formbook)", "value": "be15bddf9b843a31ddf51494cfce5c221eb5bfb1120c2ada438e2245deb5ab0ab722b65cc58c63e7899bc78b1942f38c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291726, "uuid": "6d72a314-8680-42f7-94c1-197b2a9249db", "value": "32A4BD7C32C46F47E16D9AF88A11530153FD98B119B1FE887D8469A90AE13C1DAB23DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291726, "uuid": "25b0b991-7ff4-4a67-82b9-eb6e86048d7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291726, "uuid": "5f60dfaf-3f46-4bfa-b1cb-281b41ab0696", "value": "6144:ucw3BWxWMDIGSvzAN4VJbvtr0sCgfiEOOWxudAFZukFdhBWGWNgp:ucw3tZpPztZidOWxu2F0kXWGWNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617291726, "uuid": "4d2e323c-8c85-4f3d-830b-b70c68c49e51", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617291726, "uuid": "6b087aa9-11dc-48ca-8aa5-1bec5f7ea975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617291726, "uuid": "88c7330d-4b90-48cb-8f66-c583c938a578", "value": "P1 032021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786aea80-92ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617284278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284278, "uuid": "9db6b9b6-fe61-468a-a571-59f3126e94fd", "comment": "Malware payload (IcedID)", "value": "6e091a23d18d86d48f4e292b05cc5a22", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284278, "uuid": "568947a5-df38-4e4e-9e92-7e5d9f028e9c", "comment": "Malware payload (IcedID)", "value": "812961c7818a3b8532bdb1f3d85a3420721635db1093d3ee49dbd43013e0bc85", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284278, "uuid": "e1edd463-6a59-4b43-b71e-5ea74037f0aa", "comment": "Malware payload (IcedID)", "value": "461e355b7510705f0d0886e77641ce608392dac6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617284278, "uuid": "fee63aab-4ff3-4856-8aed-a8fd872a5841", "comment": "Malware payload (IcedID)", "value": "c16ad43f7639f674847ec7c6157a82be48173937e60b3bca2b33bf224f1068095551915c45a7cbb84a84fd6b08726260", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284278, "uuid": "1b66a26d-037d-4159-a0da-0169505613e2", "value": "AD044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284278, "uuid": "9ebe88eb-e08a-4e12-b051-c0d93829ddaa", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUj:4PmxIEudkLeXPD/PjYwe2DMo3S/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617284278, "uuid": "8691a8e3-bfd5-4ae5-996f-30ce6001d901", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617284278, "uuid": "a7e5772d-e63b-4c00-8f20-8ba3aaa0247e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617284278, "uuid": "0f79648d-b29b-4079-b717-eb1d13fd182a", "value": "document-1261504611.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79a9fa6-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617298986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298986, "uuid": "2ca4d47d-ae16-465f-8423-28611fe760e9", "comment": "Malware payload (IcedID)", "value": "14477d5d2b31d536c4c2a54ce23b7936", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298986, "uuid": "8898264a-8b35-4b1b-90b3-8b07a52b7219", "comment": "Malware payload (IcedID)", "value": "812a5d20b3e3467471fd7d5478abe5fcf667a55cebf85fc5fab0030162a219dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298986, "uuid": "578ea1f9-cf53-4f0a-8bf5-e514749312e6", "comment": "Malware payload (IcedID)", "value": "fc278ed8b0bd68159d97aeca31eb85ef24eae687", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298986, "uuid": "abff4416-df9a-49f7-9477-6dc63576217a", "comment": "Malware payload (IcedID)", "value": "34d01f94a29025d5441c68b7ea58b780127f7383b9c11585dc5023cebe26df39984d3c8a2b3e5dbde132f511959e829a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298986, "uuid": "c4a80df6-b7f4-4799-bc4f-656fb23b02c6", "value": "291408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298986, "uuid": "997897b3-3bf2-474a-a2dd-2730c744cfff", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298986, "uuid": "744ff64c-fced-409b-875e-704ae5a79879", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298986, "uuid": "5dcb1812-0bc2-4046-9cb9-9b6703765641", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298986, "uuid": "1a1f28b0-7af7-4512-a3df-4d0b0d8ad523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298986, "uuid": "344c716b-7e04-4295-983f-e2fa795f0ef9", "value": "812a5d20b3e3467471fd7d5478abe5fcf667a55cebf85.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e5f258-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1617261839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261839, "uuid": "1dcbc673-8a58-48b2-b57e-8f54a0d3912e", "comment": "Malware payload (NetWire)", "value": "3a88bee6e28258945caae35adb921a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261839, "uuid": "1ab3811f-9771-49b0-8cf3-260be8a1e038", "comment": "Malware payload (NetWire)", "value": "8134262ab304b37a29171eecdcb31da91040fc713d1553a1042045195c5f321a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261839, "uuid": "311c71e3-2910-49bb-808f-2f2a796100e6", "comment": "Malware payload (NetWire)", "value": "31746e97275851ba17c221e1095e8bc190fda6e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261839, "uuid": "1b5a85f8-ef3f-4b25-ab44-a9f6e1a2181a", "comment": "Malware payload (NetWire)", "value": "aa4f498d0c18b00b381c04d71118ca0483be988f7112194a1e9091904fecfb431fce1cffe7f87e6267f2fc0448c6df7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261839, "uuid": "ad02c9d5-8579-457d-99d4-379cd3af3ea5", "value": "7F341850B555E08AD52B7E71BC2EE26006647C6F85E0D20D339DBF2F90B7352068FBA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261839, "uuid": "4633128d-8eb3-4603-b138-6937ceb1c412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261839, "uuid": "9d4d415c-edd7-4f1c-b161-783b525a7906", "value": "3072:hcqRUrJ0wKyg2XBXqy/+xYo2bqZZO6NfuYRVe/7kZPIffsUCHvzNZTRiU9kYYNpl:VRUNoYRX79o2OTZUCPzB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261839, "uuid": "9fa41f36-778b-4551-8d33-78aeb25eaffd", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261839, "uuid": "9a819613-2ec5-4032-a21d-008e90c3db67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261839, "uuid": "3b453095-6b16-4391-90f0-bcf0ecc76822", "value": "Operation_Copy_page-001_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fed6c4b-92fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289041, "uuid": "75478782-9e5a-4d9a-ba4d-eff899c49928", "comment": "Malware payload (IcedID)", "value": "171cdc668048dca7e05e379b204e20e0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289041, "uuid": "3bc6fef9-6e7e-446b-9d75-60b25a41792f", "comment": "Malware payload (IcedID)", "value": "8149286703d46302625a76ed5f947cc69a30d06f8f33755f766782c2d06f0b44", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289041, "uuid": "e85d2144-84fc-4240-97f1-6704f4ca6bb0", "comment": "Malware payload (IcedID)", "value": "cc1efda3986f31b01a52600d8949d5ec1f8c5761", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289041, "uuid": "8ea9b1d3-9bab-4446-a46e-77af81ac93a9", "comment": "Malware payload (IcedID)", "value": "db4f2eceaef152e4c85af003054e3648beb1c950f168564090a050df8662de150f6eaf7ff7df3610fc22beb449ec5596", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289041, "uuid": "fe18fb5c-9dcd-420a-9719-f70a6c993bf7", "value": "7D838DCDC913E1D9C2559FBD5A0A308512F4E0B72B6FF11B148EA62E0D42FA40A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289041, "uuid": "331ede87-0b9d-4751-a255-f4d761cbdcfe", "value": "1536:IB240XZfcaaxf+EQliU2hawDrCAIoo8+BNvMhfvlc:+2d1cBWEQXMDr9o8+nEhHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289041, "uuid": "57b2f452-3013-4114-a6af-869b72d5c72d", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289041, "uuid": "2035db2c-43de-4cfa-bcc0-f1f6f2d9c65c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289041, "uuid": "1aecbd2a-11f9-4448-a9e7-022a1e1ac54f", "value": "3032.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1588c6-92ad-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617256125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256125, "uuid": "3ba3f25c-6f89-4bb0-a2ae-c38c0a6d5c03", "comment": "Malware payload (SnakeKeylogger)", "value": "a752a585d1e7e9235bae55e1b1feb14e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256125, "uuid": "de0be818-2304-4efc-9057-347c2071f2a1", "comment": "Malware payload (SnakeKeylogger)", "value": "815358cc2dd8e2114683ba8490693ece886195b524f71a0e5702629b8af0789c", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256125, "uuid": "90e18efe-7103-4124-9b2e-b164dad6f86c", "comment": "Malware payload (SnakeKeylogger)", "value": "9d1c8ad6470814e2cc713123e81e51c992d6c7fe", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617256125, "uuid": "05f1cad8-946a-4b15-9dbc-c20e150b4d40", "comment": "Malware payload (SnakeKeylogger)", "value": "ef37ceaa273a7929d9c146ffc3ca298ddeef6ad53c68a666978f66bd262195fec2dd1ca9700aca26618bcacf0409b869", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256125, "uuid": "cbea76d6-0d73-4712-84de-4ee7438da096", "value": "BB05ADEC3640B9DEC91BCD7789982C60AA20B5F7530BC603A01755ADAD0DA9FCF951E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256125, "uuid": "9f3fe5e3-6130-42e9-8f40-1bb6e6f37ffc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256125, "uuid": "63c448b9-d1be-4055-b034-1e1d4c7304e0", "value": "12288:BWF2ifl9nEJhRqqpxW6QaPgPOBVUPYNzDibBdgKYcEw0IJXklcejpowJzJMUSxAq:YHN9ENFvdCOBVUPknijgKDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617256125, "uuid": "b151818a-49ec-495c-9e99-9d7298a6fa33", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617256125, "uuid": "b68c5480-166f-4f9e-a604-6d73e27207c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617256125, "uuid": "2708988e-60af-428e-a797-e6947f9f4895", "value": "Inquiries.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980697e8-92f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617287767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287767, "uuid": "4317f4be-ae0a-4fd2-9af3-6355532c9d48", "comment": "Malware payload (IcedID)", "value": "7069527ca75ad394f6c57654879fa669", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287767, "uuid": "9104d24c-9b0f-4fe5-8cae-5223418ac9d5", "comment": "Malware payload (IcedID)", "value": "816f2ac87568a298ea37625f4ac8441f95a2451db2550c2165d9e12580f510fb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287767, "uuid": "ec3c12d8-0095-48ae-b1ea-bdc841e10917", "comment": "Malware payload (IcedID)", "value": "322fe69dcb910ffb2aa8d820ae49da941feebcf6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617287767, "uuid": "d16633dc-2762-49fa-91dc-98e4dd56d6b4", "comment": "Malware payload (IcedID)", "value": "1ddc3db7f47185a164fe48e5eb4065872ebfe094a7ce511b654df4ba19037235cba0563f635a26877252b65485436fa5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287767, "uuid": "aea7b0ff-c34d-4622-abaa-cc7714819731", "value": "42838DCDC913E1D9C2559FBD5A09308512F4E0B7276FF11B148EA62E0C42FA84A5E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287767, "uuid": "6f5277d6-a0f2-491e-97f8-5627470965ce", "value": "1536:IB240XZfcaaxf+EQliU2hawyCAIoo8+BNvMhfvoA:+2d1cBWEQXMy9o8+nEhHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617287767, "uuid": "f6daf929-8a06-4bb8-8f77-b04550eb3552", "value": 86230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617287767, "uuid": "a6d7d6b2-2417-463a-94a1-a55ce5c6ad22", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617287767, "uuid": "7481d44a-6857-4f96-acbc-224de21da74d", "value": "3129.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871e5c88-92fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617289027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289027, "uuid": "d41e3ebf-7e75-4bbd-920e-28f73470cf71", "comment": "Malware payload (IcedID)", "value": "4682ae51ce4175261aa57ddefc1bb7ac", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289027, "uuid": "cd565c4d-60a4-41e1-a402-27a1ebb828d7", "comment": "Malware payload (IcedID)", "value": "818c5016c7f011bd1b42f37556d75727579baec0aa1ca6378b60b99688d89a3c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289027, "uuid": "c4ecd725-b066-4a4a-a485-41370089aaf7", "comment": "Malware payload (IcedID)", "value": "67c774d08ae3b25e9630be40f6e0458d8b498b7f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617289027, "uuid": "6ca73695-7dd0-44b2-8562-84b4bc989516", "comment": "Malware payload (IcedID)", "value": "c07e596a7da561d326bfef02bacc1d6c53d0055dded6e6b67d30b57455c9b494d9847e2cd09283ae857d14941eeea8e3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289027, "uuid": "d84c100f-8dfc-4ff8-a047-3d867e875c8e", "value": "7E838CCDC913E1D9C2559FBD5A0A308112F4E0B6276FF11B148EA62E4D42FA80A5F79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289027, "uuid": "8264e7b1-db6a-4471-8ff7-428faf114cad", "value": "1536:IB240XZfcaaxf+EQliU2hawHCAIoo8+BNvMhfvJ:+2d1cBWEQXMH9o8+nEhHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617289027, "uuid": "0f79c8a4-61df-4eca-81a1-81475b3985a9", "value": 86231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617289027, "uuid": "d6218572-2c04-4ea5-980b-562dd207a4dc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617289027, "uuid": "01fe87db-acac-4471-8696-df55898c9370", "value": "2973.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2013aab-92dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617276616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276616, "uuid": "04ff9340-908a-4b59-adeb-54de8586aff8", "comment": "Malware payload (IcedID)", "value": "80c430fb871d8b8d5814786157d0665e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276616, "uuid": "2374c5f5-da2e-4c44-98b4-ac0e5d792d77", "comment": "Malware payload (IcedID)", "value": "8196f2c260349e9435cf5a319be47a98bb88d7d4c4a8a1d6d8b9c399ec4cb638", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276616, "uuid": "4503e544-19bd-4e17-943d-7ff330ffcfcf", "comment": "Malware payload (IcedID)", "value": "25695b9376dd7c9f128a04287bf44093e2f9981e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617276616, "uuid": "55e723e4-041b-40b3-aecd-69e6c5b0e446", "comment": "Malware payload (IcedID)", "value": "63fe66b1bdea3ae6dcd9e2b26e6a73ace3d8d633cd98add250493290b05609ca6af0cbbbc79b1a0dbfcbb99d8c14d1bf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276616, "uuid": "6f1646cd-5150-412b-8925-ffabb0f5a344", "value": "74044003EEE7462FC6844B3941F3864576E29C4907DB46475688FB6EAF3DB862E10ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276616, "uuid": "57d40e1d-0d88-4803-a3e5-84f7f1d1454e", "value": "1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaU5:4PmxIEudkLeXPD/PjYwe2DMo3S/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617276616, "uuid": "b3222c46-a5dd-44dc-8f27-f26881ba4989", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617276616, "uuid": "6c574580-587d-4f1b-862f-51642bd59174", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617276616, "uuid": "b3a82772-da0f-47a0-a63b-4aaf14119ade", "value": "document-1021582986.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e304e21-92b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1617259376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259376, "uuid": "59064de6-9bac-44a4-a2d6-b100117d94ba", "comment": "Malware payload (ParallaxRAT)", "value": "7c4ac7601ff409585e404ce409744918", "object_relation": "md5", "Tag": [ { "name": "Al-Faris group d.o.o.", "colour": "#34309B", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259376, "uuid": "a6ea316b-66fb-4e46-8a82-e336bee17841", "comment": "Malware payload (ParallaxRAT)", "value": "823cb4b92a1266c880d917c7d6f71da37d524166287b30c0c89b6bb03c2e4b64", "object_relation": "sha256", "Tag": [ { "name": "Al-Faris group d.o.o.", "colour": "#34309B", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259376, "uuid": "809e10f4-9dc0-40fc-be14-1aca62fda874", "comment": "Malware payload (ParallaxRAT)", "value": "4f037fcc7ce0f5509ee451e4760e21b9ca3ff55f", "object_relation": "sha1", "Tag": [ { "name": "Al-Faris group d.o.o.", "colour": "#34309B", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259376, "uuid": "c52a793e-f14d-4852-b031-acfab0814953", "comment": "Malware payload (ParallaxRAT)", "value": "c7dff0c32067bb73064eff73b55ad074f95b73c6d37b1c82fdfd19dc923664857f9ff43e6ee3817f6e3117d8bb7a725c", "object_relation": "sha3-384", "Tag": [ { "name": "Al-Faris group d.o.o.", "colour": "#34309B", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259376, "uuid": "9e3d0b6c-2340-4787-8fa8-6a195a055957", "value": "54A6D0216250553ED4AB0B3A043BB6659A3FFF613A13C94B67F04C8C8F36691793E25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259376, "uuid": "c90799dd-d400-48ea-b4d9-bbfc956095a3", "value": "e1e1d85093a0cacbfab765cb75c85f36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259376, "uuid": "be98d14b-03fe-4e8c-a30a-e0cd542c78fc", "value": "98304:LMaZJSvOsQRt7puZQbAkfK0/IoAAtTqNEwRV3Q+rML7I5d4mt2BtxjK8uo:jKOs+1puybAylwNEwRV3Q4t5x2Twi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259376, "uuid": "83e58ee2-4d05-4f90-b665-d4d100639266", "value": 10163696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259376, "uuid": "d71ca938-d3da-4ff6-baa8-1b7a6d5d4df5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259376, "uuid": "0873ba69-0466-4486-a583-12f8a2205f4d", "value": "823cb4b92a1266c880d917c7d6f71da37d524166287b30c0c89b6bb03c2e4b64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e0b6fe-931f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617304996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617304996, "uuid": "35b92d4d-c799-436e-a109-ba83eacfe9e2", "comment": "Malware payload (IcedID)", "value": "304f9d66285b5ef874e8f96a01697fc8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617304996, "uuid": "3ca23c0d-a8d9-46dc-9a76-d4f80539c6b1", "comment": "Malware payload (IcedID)", "value": "82a74299d5adf4277e8b4291eb507aff433f832aed780bf4d4c89d4e379d8585", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617304996, "uuid": "dfc20a41-45de-4bd6-bb72-d762f8d99ea8", "comment": "Malware payload (IcedID)", "value": "0d8cf57aba90fa89214999f635da994c38ca96f7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617304996, "uuid": "9a670f86-0ecf-43c9-b626-5f1a271ef51c", "comment": "Malware payload (IcedID)", "value": "92ec6a537613045a37ce9b3b3b2d4eae20a8a88e3d7d0a3ee03b1e12b589ff7be078b458a275fef8cc49c7c3d65f8940", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617304996, "uuid": "b667efc1-6f07-4c8a-8cd6-a3ae4dac7d89", "value": "4F04123CC03B4D98C2E68437DC588546AC662523BDF8A5BD66887598EA136F30F6FF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617304996, "uuid": "e788406d-6747-44f5-ad29-ada773e5e3b1", "value": "3072:BXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGXKC:NE5SDvbXAyHbVt15wTQDmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617304996, "uuid": "37937fac-985a-45b5-b732-aa156a1a9d11", "value": 178001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617304996, "uuid": "67973358-794d-41e9-96bc-7c749afc1311", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617304996, "uuid": "638c362f-bc14-40d9-9ac7-e66893e81327", "value": "71983934789-04012021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d4d86d-92e0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617277809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277809, "uuid": "6341d783-4495-4c0d-8058-54a588011e7b", "comment": "Malware payload", "value": "789803b88c741d982b471c9dd89b6c63", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277809, "uuid": "18d15363-86d4-483f-9720-e018dbe2aa02", "comment": "Malware payload", "value": "82b7b4b021cc6e934b4a5b668fefbe54e8dc14a38f9d37f8e5aa3fde320ec4d2", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277809, "uuid": "81678a11-e482-4f44-b224-cdae963a550e", "comment": "Malware payload", "value": "dad2e3455525680acd9ae52441a7f79db526b3f3", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617277809, "uuid": "9e855cf1-24a9-43e1-ad57-7936a8bb67b4", "comment": "Malware payload", "value": "9101c334b2125db076f2cea822152c630a548f3a81c0dfd757c9d557354cccfba5981d298faebf4057644c3ea2f66802", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277809, "uuid": "2777f4e7-dee7-42ae-b124-f4d8210ca52b", "value": "D7446C11B284C835E5A7057589AADA6B4AB8BD30135FC4CBF3C43F7A5E706D1AA3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277809, "uuid": "5a61d780-254c-4094-8a88-d0d7344fba0a", "value": "7a88bb1cfb3dfaee57ad3099163aba64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277809, "uuid": "b5e341e7-c582-4b44-a0ea-2b9c1956c523", "value": "3072:yD8jqvFKUrBNEFhIWvmH1n7HjUx+HmVg0LcpBcS2rvM5MEkqIieEneH3S3GqZX0N:yD8jqjWc1n7DQ+GhcpBwrv4WWJfmzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617277809, "uuid": "a8b30b8b-39ff-49a9-ae94-c478b7005ee8", "value": 266536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617277809, "uuid": "e787171c-7cfc-4735-a045-75d20655011e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617277809, "uuid": "ba57a46b-7636-45e9-b5ed-0bb8083b95a0", "value": "winsm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e684d8f-92b6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617259672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259672, "uuid": "2474be79-ebb7-4aaa-9138-9b583c43c822", "comment": "Malware payload", "value": "4ffdb788b7971827509fe2e3ccadbae2", "object_relation": "md5", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259672, "uuid": "a36f7b99-add1-4965-8e68-0684371785ae", "comment": "Malware payload", "value": "82d174521f0b37950d8e768bce986175e318b4910be37a469f92bba3c4e40db4", "object_relation": "sha256", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259672, "uuid": "40157373-5837-4b75-a367-78fddbccfac3", "comment": "Malware payload", "value": "83507f734f507c0147120c03408b95d474046803", "object_relation": "sha1", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617259672, "uuid": "20b85aa9-21ec-4ea6-89d6-e74be8cea3ab", "comment": "Malware payload", "value": "726f2ac57782ce2575817f9cc454fee871edae99b165e7cf415f4053ebd25af23c29ea6e787b7d7484adbc5650b833e7", "object_relation": "sha3-384", "Tag": [ { "name": "Medium LLC", "colour": "#3304CD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259672, "uuid": "6038c1ac-c261-48a6-846f-4aaeeaf881c1", "value": "5755E1A0F16184B9E8470DB11F7DFA3171AABE9D4994018B62EDF71945B33B2107FB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259672, "uuid": "81ed5878-6621-45a5-8181-e2f87809aed4", "value": "bfffefca6535afcc9bd6b5d20058c57e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259672, "uuid": "41e8cff6-5901-4189-8bb0-a14d081e2777", "value": "24576:d0BG9gGUvH+u8JRpH97lF8qTS7L0G3i4+u6rpU4wuMS:d0PGAep/NT2pijuAALS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617259672, "uuid": "506c88f9-ecaf-4cb0-a191-6a4944853c1e", "value": 1379024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617259672, "uuid": "0b072a2d-ddc2-4d35-9c75-dac64ae0ec71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617259672, "uuid": "ee9ccf09-ebd0-4650-9de7-f8f8b25a6cef", "value": "82d174521f0b37950d8e768bce986175e318b4910be37a469f92bba3c4e40db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a841363-92bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617261867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261867, "uuid": "a4058e35-da5c-4f90-a562-0bcdacac98c9", "comment": "Malware payload (Formbook)", "value": "3ee38b2cd8972f9f5be29d8ace833c20", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261867, "uuid": "1719a5d6-e221-47ba-ae39-61c18a23ace8", "comment": "Malware payload (Formbook)", "value": "83082385dc9cd347df83560fad26ba22db847397a9c445b75ebcbea58b313a72", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261867, "uuid": "8fe06725-db98-41cc-9c8e-5619e11925e1", "comment": "Malware payload (Formbook)", "value": "97b264edfd8eb052a93b4faf3cd1327ca7614cee", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617261867, "uuid": "c869ecd2-7309-49a0-9196-871a14acba53", "comment": "Malware payload (Formbook)", "value": "3748f8611bfe356b9905def09570c14c907fb4ab5d1cabcbfe9dde00d17e3394246ba86844d0d1210b786ee010633bd5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261867, "uuid": "b837b760-0462-4637-a17d-84922221723e", "value": "549423ADDE9B79CBC501F060CA1B988526191DF61F238D8DDC35A83B463B2BCBC59341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261867, "uuid": "e5e1ac06-88c7-4e53-81e7-003c6de1b2c6", "value": "6144:/zEf9dQQh1sLv4wb+kLoXPb0ZIc0LIoYzXadtju7TmkXUakTpAl+lWrpjUgAxdEa:IN8LD+OsIZID+Lsom4UfApNjUgAxdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617261867, "uuid": "88c9c18e-8844-41dd-90fd-ba204909c685", "value": 431626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617261867, "uuid": "f16583f6-eeac-40ce-ae81-a0d1c329d314", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617261867, "uuid": "358acc20-175e-4be6-bf29-8b15a253f85a", "value": "IMG_963394832387043.jpg.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57ee77b-9344-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617320887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320887, "uuid": "e3a655cc-25d3-4254-928a-763a71be3e28", "comment": "Malware payload", "value": "8eeadc7c52554328bcbb4c49ddfc647b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320887, "uuid": "6f132df6-2a60-4c2f-a5b3-6a61eb40d107", "comment": "Malware payload", "value": "837a40c49a16ecd7ca4c60d41d69a7ba4774c0fdd48f5049018d98d105f191f3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320887, "uuid": "62110541-5db3-47c6-9c26-bb6b46b8a35b", "comment": "Malware payload", "value": "78f17496505a8deeda0ed169434920aaccf9f1cb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617320887, "uuid": "bdf4c1f0-a9fe-44d3-9400-09b2ed193053", "comment": "Malware payload", "value": "d89dda34c035b9483e2dfb92b2a404eb17b729d6b2daf3e2bc17407dd73bb322e52a17084b18cfa9774b2fed91c46d2d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320887, "uuid": "05015b1c-b248-4ab4-921c-6f3ee80e7fa9", "value": "5214BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320887, "uuid": "a648ad6c-156e-460b-8ded-dc54115df9f6", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320887, "uuid": "c3dbac5e-f82c-41d5-9ef3-dd69fa9abc0f", "value": "3072:Wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ppjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617320887, "uuid": "386ca6aa-16ed-469e-a060-ec89b21f5ce3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617320887, "uuid": "ec618a7b-73ae-4543-b24e-6e3790cde2f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617320887, "uuid": "d23f6a22-0855-4cdc-8ebb-a54314e72b2e", "value": "837a40c49a16ecd7ca4c60d41d69a7ba4774c0fdd48f5049018d98d105f191f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56158e87-9315-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617300541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300541, "uuid": "72e68b9e-e9e0-47f0-8de4-499527942c15", "comment": "Malware payload", "value": "76f537b9fa6f6cc7791839d013a0f543", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300541, "uuid": "d80f30f7-00ae-4597-a1ad-fe85f20400d4", "comment": "Malware payload", "value": "8396975f95a8b20da75e6e39e210d716dac33ace6e2e51e6719d887f79218aa7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300541, "uuid": "f6a7d131-cc87-4e06-bca2-4d02ece57da7", "comment": "Malware payload", "value": "c4cc98c15ac56ddce09b16f1390a3e957b2a8858", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617300541, "uuid": "fe69f71d-0c6d-41aa-a957-b43abb110bec", "comment": "Malware payload", "value": "596610e6ef36c0c60b866d9bf6f99c2ed96d17606068ce292269ffca691d6b25ae278926a8a3dd4b9bf722ee792b7393", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300541, "uuid": "63b513ed-5e82-460b-ad9f-8bb6f7d7874e", "value": "CA14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300541, "uuid": "fb3eaa37-f6a7-40e7-8712-a3d605ccb73e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300541, "uuid": "3f95269b-9f3f-41d5-9897-1fed5d19874c", "value": "3072:Jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:OpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617300541, "uuid": "bee0ac33-7109-444d-95dd-8ead54df835f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617300541, "uuid": "7028494b-5f47-45cf-b0d3-0f1c53d0b404", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617300541, "uuid": "1dc34ffb-7bbc-43e5-8b73-70478dbaa161", "value": "8396975f95a8b20da75e6e39e210d716dac33ace6e2e51e6719d887f79218aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ab3a3a-9311-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617298985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298985, "uuid": "cb630658-e4d2-4bec-9541-10822efa11e0", "comment": "Malware payload (IcedID)", "value": "23741dd2eb07e9e8788c4c57640e52ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298985, "uuid": "e6de7d14-c442-4ca6-a8e4-b6b21dba7773", "comment": "Malware payload (IcedID)", "value": "83eaf3c53ddd3464a09440270750c23e44353da28d86d5f0bae3cf658f187e42", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298985, "uuid": "33b9e952-0476-4ca6-ac90-21edab564149", "comment": "Malware payload (IcedID)", "value": "2e1a39c95cda5f4ec81cdcfa4ac71c4e6fbd3d8b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617298985, "uuid": "8dd6d911-cf4a-47fb-9a80-8edad9bca782", "comment": "Malware payload (IcedID)", "value": "38e25b6ce7dfec2985419342785815d40d9dd834802e6b19f6d974fe054843ffbfb42b284826ff2baff5bee85c6061d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298985, "uuid": "eb32e299-6409-470a-9af0-88b4a9cacba0", "value": "371408CA88DF66ABC82F81B0B4A40F3D07243AF547E697CBDA281715D5CB7D5E852324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298985, "uuid": "28f8c47e-f3f5-4200-b56e-b02d5697fdf1", "value": "bc76ade5e3961b619a50b800daf6c158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298985, "uuid": "d26338b5-ade4-491f-b17d-433d906e6f53", "value": "1536:VKSBy3lkoC5UchQqbjZxcDTDh3XUDU37/UZ3hFR+Gq0QRqKlMyoNBQT/K5InG4X:VKbkoC/hQqbjg0oLyR7CTc7FHQbqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617298985, "uuid": "73337e18-56ba-40b8-ae94-82ba60b1fd18", "value": 203296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617298985, "uuid": "ce5a4a74-706a-43b0-8452-00621d49a8af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617298985, "uuid": "2287668d-8670-415f-a5be-9d3b6963d438", "value": "83eaf3c53ddd3464a09440270750c23e44353da28d86d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80b5084-92ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617255689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255689, "uuid": "4f2bddfa-af78-4959-89d1-29fd618c0e4b", "comment": "Malware payload (AgentTesla)", "value": "649cbf01eacefca9900520746a99fe94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255689, "uuid": "5bb20e6d-581b-4cc3-9730-1348b5e2331d", "comment": "Malware payload (AgentTesla)", "value": "84228b439980a337d1ebc688d6b5838f74f9aec40fd46133591489aad3e2a40e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255689, "uuid": "2b6403f1-525f-45fe-a57e-2e96bca7ed19", "comment": "Malware payload (AgentTesla)", "value": "fef8b43fdc4369dc15f43760b946bcb884806a4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617255689, "uuid": "4a012013-2093-491a-806b-bbf79952657b", "comment": "Malware payload (AgentTesla)", "value": "dded85af0b13567822df2e4487ff66b6be710ea0b6ba0d81430cdb7fae8202fc42e9b294cc9fc1375d8b15556f98c7e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255689, "uuid": "0fa3b61d-d487-43eb-8690-dfaed5061396", "value": "2AE46A2337477BAEDD7813B62452910033B0AD36E76AD20DAC64725C5F776C08BEE662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255689, "uuid": "f170fb39-9f8c-451b-8df3-b1eaa846b56a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617255689, "uuid": "737b0cea-2f3d-4c9f-b1dd-2ca206212207", "value": "12288:2aM83EGjfbrBf