{ "Event": { "published": true, "date": "2021-03-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-03-31", "timestamp": 1617235381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c2c22626-e691-49a9-b5d9-608c3286f9e0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b97d54-9246-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617211691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211691, "uuid": "0914ca5c-71ac-4865-8be2-162ceb71e081", "comment": "Malware payload (Dridex)", "value": "b6f92a5d64e7524c33a8a565960c94ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211691, "uuid": "3971eef3-e86f-4139-b005-710ab0699054", "comment": "Malware payload (Dridex)", "value": "00090e5b10ab488a011b561ed2fa32e9bd4e1ee138e9c888b305d08076357536", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211691, "uuid": "18b7c56b-fb4f-46f7-accf-0b5c1a0d3885", "comment": "Malware payload (Dridex)", "value": "9506e1d650a3771ed3728f7270fa96ca2300e0d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211691, "uuid": "8c4461f5-bf36-4c90-bc18-8142dda7b17b", "comment": "Malware payload (Dridex)", "value": "ded7cc180dccadab276e241247d0c91270310f9a6450e5a52ee7072a6673bb2baece82dc0e7eca7b518cb46327f2d41c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211691, "uuid": "1df3a25e-3ea8-4953-a40d-ee6d03ff8884", "value": "F6E3121F93F0F864C9A2C0BF87188856BE274AE3C58495AC291D70383F9659ACB45DDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211691, "uuid": "814a2d6d-6595-419d-94c7-7223435380b9", "value": "3072:Bf0JQHH4cPXYO9T2I+qIjCXszGYWZ410a6hhGnLk0WUIUgyZ7XjLF4gt+D:Bf0JSH4aXqI+q3szKHa6LGo06+RlsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617211691, "uuid": "c32f807a-b183-4f9f-ad93-ab1d0fbb0833", "value": 151785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617211691, "uuid": "26c3ec0d-32ef-4995-a3b5-d20f350f020c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211691, "uuid": "fd098a3b-087f-45b4-bdbb-5831f155ac66", "value": "Reports-93038691.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392073cc-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617163483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163483, "uuid": "665fcf85-9e7f-4608-bd6c-249ca5cf398e", "comment": "Malware payload (AsyncRAT)", "value": "49b5fe923e469f9d86a08c733a163b2e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163483, "uuid": "b7d4d0cf-770b-42e5-8b27-beabd20aaa0e", "comment": "Malware payload (AsyncRAT)", "value": "0057b0550356d6d892717baacc90cfe433f68357200537fadf3851df3d2f36af", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163483, "uuid": "065d6194-510b-4156-a384-b657710bcf3b", "comment": "Malware payload (AsyncRAT)", "value": "d57091101b1657dd4b35534a0a684de3f22a6332", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163483, "uuid": "69df37ae-c05f-40d9-896c-94ba34a4c0b8", "comment": "Malware payload (AsyncRAT)", "value": "1eefdefbb2e6a9b4cb9758040c2dd535b6d7fe652d638400d754c0b294f21a2df65ab307bca99cb9d89afcd188876f96", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163483, "uuid": "60cffb97-88c9-4875-9672-a750de845230", "value": "9B04081BB6858911C25C6932C1E711151371DB876763EA0F7AC913926E033EFAD8FACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163483, "uuid": "018f7525-ceec-4618-ba5f-1ce03dd3bee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163483, "uuid": "cd075d03-6673-4bca-abc7-b60c57930643", "value": "3072:sSFbUo87pQQoso/mSJZHpfRDOOSENzDYOFnF4bDntkkgZM:dYkQosyTUEpJf0Dukg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163483, "uuid": "4907213a-e7a2-4306-bedf-9c6d8f557d9f", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163483, "uuid": "ad07b9aa-62b7-4fa8-a7f1-aba3ea657531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163483, "uuid": "8be1dea7-5455-49e4-81e7-ba79e73d46e0", "value": "FYI-Orderimg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75396612-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617216841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216841, "uuid": "fc0bd4c2-e55c-4b55-b2b4-d950849bb045", "comment": "Malware payload", "value": "efb962a1c9cce692c035f58ee99dcb3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216841, "uuid": "4af50d6c-078f-4839-bd49-af836d62256a", "comment": "Malware payload", "value": "007b982d8c612faaf3305f2a45ea52d972c4a52c7fc0f791ba1d0cbf61b55c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216841, "uuid": "291138f9-9dc9-485b-a952-68995609d39c", "comment": "Malware payload", "value": "a275c7c9b9ef39c23483f7d8309022f6e3626be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216841, "uuid": "97a2a668-d2f0-4d93-a2d4-184460f197e3", "comment": "Malware payload", "value": "6ed05b7f02a2820ba088513084de076ff692f83d419bd32b1621e0a4ddc793d2f007a02578cc534f6e131ad98213715f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216841, "uuid": "5ae0c503-1786-476a-896e-ab681fe589fb", "value": "98C402F42941DAE9CA2C1BFE752914150BB9EFF240134FD8C958F6A2356BE8D1DE8183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216841, "uuid": "89c347c0-aa50-4d62-82b8-4a4644609d51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216841, "uuid": "6e8d2f8a-4f41-4e8a-a433-9b08fcf0e0fd", "value": "12288:3SZmxPuwrhVI0ELgVUVnVjhkvtajISTrJci2cF0:BPLr05LkSyvgjISNTjF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216841, "uuid": "efe950d3-2e13-4946-a43c-aa2dca4b1052", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216841, "uuid": "886c5170-6098-4fa7-a3b8-90fb5fa4b7f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216841, "uuid": "562996c7-7292-40e9-99ea-c5c36915208d", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99f9912-9245-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617211372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211372, "uuid": "504933b4-9834-40de-a523-7700f47bb93b", "comment": "Malware payload (RedLineStealer)", "value": "c1a8db8e516f517ae86460ef11e04957", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211372, "uuid": "a7181dd3-d480-45dd-945b-d8bbde6430b5", "comment": "Malware payload (RedLineStealer)", "value": "008286d251f77f033a952f0312c198fd8c354a1a73911a48a912c1e75b522d3f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211372, "uuid": "3c8ccadf-fb84-4630-9dfd-bae73c9bfc62", "comment": "Malware payload (RedLineStealer)", "value": "3121b808ea3a907cbd5b77c3b138590df103b9a7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211372, "uuid": "e8fc93d1-8936-45af-91a6-f8168a992f7a", "comment": "Malware payload (RedLineStealer)", "value": "403a35dbc28756097c9169aecb78dc73f104a496b46395cf3cdc835b4511e35a38018b3ada4c64aed017d09263c589c3", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211372, "uuid": "dfdbd970-9403-4757-8d11-e8b13428b4c5", "value": "8164E00076E5C433E24206750821C6A55D36FCB29F38A6CB7BD16F6A6F362D14B3A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211372, "uuid": "18f6d549-4b3a-4edb-b5a5-f7a07ef4414e", "value": "502aa3b38338aa092a67a446a205b8f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211372, "uuid": "63c292e8-3c6e-437d-b46a-450d5a64c3bd", "value": "6144:ttcRlbFILuB782esadRZqtEJuzFaykCO3rKVn8Owy:URZaCBQnTltEFamO3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617211372, "uuid": "459fe296-d4b2-49ab-88f4-0019e867a63f", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617211372, "uuid": "7671dca1-9729-4413-855d-ac0d5cb85a66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211372, "uuid": "2d0bb52c-fdc3-48a3-ae5b-1395b90234b0", "value": "SecuriteInfo.com.W32.AIDetect.malware1.15360.11239", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b44735-9212-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617189537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617189537, "uuid": "63fe5f54-598d-4d77-a6dd-ba4c46c55196", "comment": "Malware payload (RaccoonStealer)", "value": "6be41709f8bfbf06307cc56d04249801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617189537, "uuid": "2f993392-806a-4ea7-ba12-e744ee0e9195", "comment": "Malware payload (RaccoonStealer)", "value": "0099e62ea3beb0f1631eb088bd697fd829963713ef4cb0e3a0a72b8c950c2383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617189537, "uuid": "6432585a-b3bb-4f5d-95cf-c061d29081b9", "comment": "Malware payload (RaccoonStealer)", "value": "911d8ade72bef752233237351fbdb7a9f96e2cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617189537, "uuid": "eb13731c-227e-4451-9208-99ab7ca68eca", "comment": "Malware payload (RaccoonStealer)", "value": "9a9000cfa2f569df8815e9afe7d0fd0437fbc6493ae21e199d9d38429e1e1a0bbe204f5202b02948114c938035e3ddd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617189537, "uuid": "94d00872-9311-434e-80c7-250ffd931599", "value": "FDF1E700F7D08636D5F70B7AACA392504335FB55AD97DBAE68D8115BAD33B4009A2332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617189537, "uuid": "6788bc6f-837c-403b-9eb6-91c08ea640aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617189537, "uuid": "77d7631c-a117-49c9-ac2b-60d58967755b", "value": "192:3rFqRMky3fM9V7FKI47Wd+h4+0XoQ9DWhL3mj9:3rFqRMh3KlFP47Wd+hr059UL3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617189537, "uuid": "40349ef5-5bd8-4266-90b5-a7e01aff2128", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617189537, "uuid": "0151b8c9-ee30-4733-8051-a7b158e9a545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617189537, "uuid": "ced3125c-de5a-4479-9fed-46cbd97fe7f9", "value": "6be41709f8bfbf06307cc56d04249801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3550bc-9246-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617211650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211650, "uuid": "de6f323b-10fa-43b3-a83a-5ebfca814522", "comment": "Malware payload (IcedID)", "value": "25ee69c289af4602d0e4a5ebfc824003", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211650, "uuid": "5a9d64b5-f217-4bba-b864-7e356f1a7b3e", "comment": "Malware payload (IcedID)", "value": "012f5ed78eb2fc8afbea5c73b1e2f0d2ba88a42dcf7ccca626b9c2c3cecacf3e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211650, "uuid": "544ceeb2-b0e3-4289-898e-16167630c82d", "comment": "Malware payload (IcedID)", "value": "a0e6215ea989a3e271ba01b8d3ce7b8fa181062c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211650, "uuid": "011dbf58-1f30-473b-989b-529c99db19d3", "comment": "Malware payload (IcedID)", "value": "99bc4ebb08b442d5121e7a66d03567edc4b4be4e06e2d5c88bc65fa0fb03e324e834d4eb068b1de6b1307e34e0ab1c80", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211650, "uuid": "fedd31c3-eb9b-45df-a981-4587ee367f0b", "value": "09B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211650, "uuid": "536c0bb9-191c-45c0-8c90-32f8bd686ebd", "value": "3072:w2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:wqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617211650, "uuid": "6d19651c-68d0-4787-9057-5488c61a80e4", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617211650, "uuid": "7a512d39-167b-4894-bd11-f3fe64d5557a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211650, "uuid": "402ef576-a199-43e2-a8dc-160e94eff9fa", "value": "document-1113405161.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bd094e-91ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160155, "uuid": "e95a8c34-7897-4e63-80e6-750e494626b5", "comment": "Malware payload (IcedID)", "value": "774a448bc84757684d4491e5efa143bf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160155, "uuid": "8807bbab-4515-4bd9-bdff-1d1c48d86635", "comment": "Malware payload (IcedID)", "value": "0189c634c85f9e9162cc7a596f5a60f9f20e826ab9db4c9c544ffb6ab304752f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160155, "uuid": "742f4100-aec3-4148-aec9-b1e1af101d73", "comment": "Malware payload (IcedID)", "value": "d05b754704491274355192b162ca8581c8c56993", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160155, "uuid": "d8c3be1a-6515-41b0-900c-491bfd35c0d2", "comment": "Malware payload (IcedID)", "value": "75b0a2da6eaf89e144a6403be2725bc787165e38112fe6bbae080f74a7e976fdf43fa20bd32713d460b24a88597e5a13", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160155, "uuid": "fd543f32-7a30-4ab3-9833-8fc92b5d07ac", "value": "B4B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160155, "uuid": "ba71a444-a691-4561-ba0a-85d71f39a3c9", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160155, "uuid": "9c299f6e-e061-44eb-9ff0-c7b27199e607", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160155, "uuid": "762e7e35-61d7-4264-bbd9-16fdd190e091", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160155, "uuid": "d2675062-27e3-4e44-ba3d-71028d2fc6ef", "value": "document-163136221.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950588aa-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617173945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173945, "uuid": "31fec9f0-6ddd-4dc5-bbba-405c89132638", "comment": "Malware payload", "value": "5ed97211220671294ee925c64b1e3ebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173945, "uuid": "58db20f6-0be5-479f-9bd1-2257638f82da", "comment": "Malware payload", "value": "01bac3adf5b25f8dad0afe3fd753eefa5b31f2b3550e44069f594280e084f9b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173945, "uuid": "e50194a9-1b2e-453f-8a64-490f3b26d485", "comment": "Malware payload", "value": "22651d893883c0e0df19df33a31cb75ded09d102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173945, "uuid": "fa7c3534-7e8b-4927-863a-6f3f95fb8bc3", "comment": "Malware payload", "value": "2edcee018efd5e8441e0dcb3b2705f3da122728290087ba52670ebab7368d12eae3bc90aaffff32dd320365ea590b753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173945, "uuid": "08fbefbf-5f03-4c56-84a2-4f9b4e76111e", "value": "C6352322FA3CD5E3D63A0930D0078D25CF75B125AD122A774BF27A0E2A66379D42F197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173945, "uuid": "c4322bb2-6faf-469f-8c47-fa9bec5ae06d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173945, "uuid": "dba7b4f2-2e72-45b2-ad48-acf45fb630bc", "value": "24576:+CxEaK5DgQKq+ighMy04fJDzxtdXPv61DDAEg+hb4d2vx:L5/hRrBDzxtdXPv61DsEzxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173945, "uuid": "699dd328-fca5-421e-baaf-6eee722d2566", "value": 1080804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173945, "uuid": "4d1ae047-93d6-4552-a104-161c43a73ebf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173945, "uuid": "956db7d6-10f4-4f0a-8102-942c6da88d8c", "value": "Ref150420190619A-B0270PEL. pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4038fa21-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213316, "uuid": "0822aab1-7b88-401e-956c-feb09ed3d5e4", "comment": "Malware payload (Dridex)", "value": "d90a19a7dc5563d2edfb6a8fb3e3379e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213316, "uuid": "03cc9b25-03f3-4820-99cf-8e55c3d8334d", "comment": "Malware payload (Dridex)", "value": "01e3bb4ae4bd227cba068d341c69f2401ce9098036ebf951b0ccf79fe90b3f22", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213316, "uuid": "be3cd2e8-b877-47b4-984d-33efd5d083ec", "comment": "Malware payload (Dridex)", "value": "606c0519386d10076a5a02c6117eb5aad050f4a5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213316, "uuid": "0d9478af-ca98-43cb-830b-a2966101602e", "comment": "Malware payload (Dridex)", "value": "bb7e0f9fcef25328fe4b562effae4339a526b55fa9638bb598990df9f7e8ed469f89f196dd5ea8e9a0da0d7aba71d1ce", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213316, "uuid": "2ce0a2f0-9681-4bc1-a8ce-a7bdc9b03132", "value": "C8248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213316, "uuid": "2456c068-1e63-4c11-ba8c-4c7c5ddb71e4", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213316, "uuid": "f8f31910-bb88-4258-8840-45dcde468c5d", "value": "3072:S6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:SoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213316, "uuid": "b63e739e-093a-44fd-b540-22591d60e2a0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213316, "uuid": "48f8fb10-c96b-41b0-a61b-9f169a1ed585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213316, "uuid": "1653fbf1-bbda-4920-9c0a-50d53b9102a3", "value": "01e3bb4ae4bd227cba068d341c69f2401ce9098036ebf951b0ccf79fe90b3f22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e976ce05-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232498, "uuid": "126c6b36-49b2-4eed-a216-a103c4591a37", "comment": "Malware payload", "value": "0b2350cacaa63317b5967d102945f2c7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232498, "uuid": "a054d524-5d5f-4cb2-aabf-e8affc0ede87", "comment": "Malware payload", "value": "01fd97d8537562c8c37a20305d877d54c53e3cd1195fc23117bf53d4a28c1d4e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232498, "uuid": "1b497a65-388d-4777-8b64-d0eb9ae70141", "comment": "Malware payload", "value": "bcdb067c7f02098f1818fa20e6ef58cdaa1a0a54", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232498, "uuid": "f5da2277-a7cc-4664-92e9-ccf201f8ac06", "comment": "Malware payload", "value": "9be69e30e07faeb92a50330720906680347717275fbd4cc5b73a4b32c4f374c5a955c783b967739bf293e2d2a66d77a2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232498, "uuid": "97062aa0-ebce-4f4c-b9e8-2c9414e8d0e4", "value": "7014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232498, "uuid": "a70b9a3e-f077-406f-9c38-2dcc14b334a0", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232498, "uuid": "64a3fe2d-68e3-4e6e-8bda-9444794a3d45", "value": "3072:5opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:+pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232498, "uuid": "499650c6-eb6d-49a1-88a3-57ca1f94a726", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232498, "uuid": "85524882-e8fc-4958-bbf3-e6523d792a06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232498, "uuid": "a2fe63b4-af77-4b20-82cb-27b8a12bc352", "value": "01fd97d8537562c8c37a20305d877d54c53e3cd1195fc23117bf53d4a28c1d4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d895a59f-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158596, "uuid": "24e3a5ad-5d1e-446b-85a2-696982bb670b", "comment": "Malware payload (IcedID)", "value": "4a34120caee838a8f7de5f7663109820", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158596, "uuid": "79749e69-982a-4766-bb63-a84a352b6110", "comment": "Malware payload (IcedID)", "value": "0217b1118fb3d23de093e47fff9b2c06b5b32b3440a352f9c70ae35f7f7bf651", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158596, "uuid": "57f8b5b8-95aa-4cb7-8329-7cad156998b7", "comment": "Malware payload (IcedID)", "value": "6db49db06985fa9653c072ed5350e62606f50a97", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158596, "uuid": "a697890a-ff9d-465f-8c3d-c637791807ac", "comment": "Malware payload (IcedID)", "value": "70e21b372ee9115288d17f9335ad2365ecac05cbce61f9fda72b4513e49b2168963f3c74ca0e7ca189b2c2c6ac398a83", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158596, "uuid": "d19ce441-b837-4ff0-abdb-905bec92a06e", "value": "03B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158596, "uuid": "f1ccafc8-582f-4daf-ad37-69b5e9bd3b91", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158596, "uuid": "5b42b371-b0ba-4514-bb59-995848166678", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158596, "uuid": "b474d2ae-a848-43e7-8af8-cfed85c0c0bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158596, "uuid": "8c7928aa-fc23-4c32-85fb-70590ff4242c", "value": "document-1560569683.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8dba130-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617213062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213062, "uuid": "245a5633-5eeb-4f74-ac9b-dd0fdf93c0ce", "comment": "Malware payload", "value": "00f51f5d59dd2e5927f50ba9a836d9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213062, "uuid": "836f93ca-54ed-4aa2-8ff5-37abc9478ec2", "comment": "Malware payload", "value": "022c00f6eac7106624812a7799887aef0b5f151a2a3ef1dfdbed2f7a4250f336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213062, "uuid": "f5216194-e820-471a-8e25-ec575f73fbcb", "comment": "Malware payload", "value": "afe7453a0a49edf49b87c84b006f48a54af05af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213062, "uuid": "15b6524d-6378-4765-9c91-e47a3489fd10", "comment": "Malware payload", "value": "19d14fa181e27d271b03d32a54c859d9ec197beea539b55406b60d1b094d9fed0dc64baabae68c4282ae57c63d1f6b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213062, "uuid": "29337979-d78b-4de2-b097-e6ad2a14e9e0", "value": "7DE50A7A3D6F3204F1B7102E958B4D26AF8D71162B69D02E247EA71DFB970648F43E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213062, "uuid": "3df9e8ad-dcaf-43de-95e0-adea355859b8", "value": "6144:FcYg1i+pOQSuEE04jnY/PZL4/4byILPAL/zFQZWx9JU4Ln5iT+xlGgZQwRbIewI1:FcYg1iYEE04jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213062, "uuid": "010a7227-3d04-4623-9f22-f5043c165c6c", "value": 3166762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213062, "uuid": "b51836a6-47c4-4d07-a3ba-64b37e31208e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213062, "uuid": "9980c856-1935-4b12-a59c-0d4547949cf6", "value": "00f51f5d59dd2e5927f50ba9a836d9c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a38512-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212998, "uuid": "e546da95-bba9-40f2-9ca0-c58b0b2c1d69", "comment": "Malware payload (Dridex)", "value": "b8d414078deda06178689d8afd778fef", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212998, "uuid": "91ebdd71-7d73-4f43-91c9-977c91570c45", "comment": "Malware payload (Dridex)", "value": "023c951f7070292c89075be626fefa48e45450d48ef64ff56550b58d15e7778f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212998, "uuid": "f21dc859-aafe-4412-9d95-6e32c37cf0e6", "comment": "Malware payload (Dridex)", "value": "28680b811f1d603114da4b8140a603354315c519", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212998, "uuid": "dadce59d-58c8-4d96-af64-c8b83456c722", "comment": "Malware payload (Dridex)", "value": "4ca9983999669b1fdbf7dcb93a350c0b595f5d3faf35592ba3433b5ddea13fb0815ccda1f96b224a0dae2685275bbf9e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212998, "uuid": "2dfcc81d-2b38-4837-9619-79963065aa95", "value": "35248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212998, "uuid": "004d14c1-b4a7-4045-8e41-395938d46110", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212998, "uuid": "7d2f072f-1d4d-4b65-a217-aa83554ff2b5", "value": "3072:L6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:LoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212998, "uuid": "c9aa819a-0afe-4e1f-9a37-5616f920f306", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212998, "uuid": "e8e9585c-5ec8-4e63-aea0-00ffcc74633c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212998, "uuid": "520372ca-7d44-4faa-8f87-847ae8b85ffb", "value": "023c951f7070292c89075be626fefa48e45450d48ef64ff56550b58d15e7778f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2437e8-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218114, "uuid": "468c966e-d850-4222-aac0-ce36f96d5da4", "comment": "Malware payload (Dridex)", "value": "8c476eb4188672be0ac601284c801ed0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218114, "uuid": "0e0e011a-c37f-469e-8e5a-625ef96c110c", "comment": "Malware payload (Dridex)", "value": "0242129fabd15bac7348da30d4198457c87460b9b085eaec17056ffd01cbec56", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218114, "uuid": "81872660-0515-42a8-8c49-a6d2bb324990", "comment": "Malware payload (Dridex)", "value": "85b27c1b63f9fb87f24b8a18131b60f7b5b83a52", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218114, "uuid": "ca634965-05be-4a84-a7f0-fe7225b7cd78", "comment": "Malware payload (Dridex)", "value": "edc3a0017bcc278c02d33569849d10963283fbc2198e45a6f6e268683a525a92adcd8b2fd9bc357d99917129406c20e2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218114, "uuid": "82102dca-2e44-4a15-a5f6-4d026f1359b5", "value": "FA14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218114, "uuid": "68bb2497-4b52-4930-b2c4-010fe4720f33", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218114, "uuid": "49120803-eb90-49c0-9abe-66ec37f9f2e0", "value": "3072:sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:zpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218114, "uuid": "899d352b-6a8b-4b6d-be5e-68597c5e0714", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218114, "uuid": "bb05579f-386d-4040-b7a2-a79554ee52c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218114, "uuid": "03d74ed1-edf3-4ac5-8e91-15be8d25a24f", "value": "0242129fabd15bac7348da30d4198457c87460b9b085eaec17056ffd01cbec56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d91e49-9238-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205586, "uuid": "9fcbfca2-237f-4dbe-a6b2-9cb6cbc3aad5", "comment": "Malware payload (IcedID)", "value": "2158589fdeb3c36723282fef5f10c34f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205586, "uuid": "c5af4e69-df62-4fec-901d-891550cf10a0", "comment": "Malware payload (IcedID)", "value": "025789a871eafe36196bcefa3e2c024f02147e87ae496bce2bc26ac268d3bc06", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205586, "uuid": "5ba3a660-0cfb-49f1-ae64-449070389d7a", "comment": "Malware payload (IcedID)", "value": "208b11d8bea551f9a484f99da5e1cf0eca5c2fbf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205586, "uuid": "7c5ff88e-62d4-4b2b-867e-85da49b65bbf", "comment": "Malware payload (IcedID)", "value": "0e162defb69606e0c45891157d6cf936ff32a76e1d6344e63113446f36aeeeec4f228f336a0c40f01f56ed8e95c59522", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205586, "uuid": "14f26035-ed1a-46ea-856a-8ffa888d844a", "value": "F2B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205586, "uuid": "bfc06a6a-9094-40ae-96c8-a975394d1f6c", "value": "3072:E2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:EqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205586, "uuid": "0aab761a-49e1-4fe8-bf0c-9e248f904ff8", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205586, "uuid": "787184e0-c66f-4636-8769-347ef7d1ac5c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205586, "uuid": "e693d73e-7227-409a-af75-c2104154b7dc", "value": "document-1044898013.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80daf2db-9270-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617229746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229746, "uuid": "6ecc1f30-b55d-44d6-a501-d8aae1ed69af", "comment": "Malware payload", "value": "155edc36e519d851a2843748ad202b82", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229746, "uuid": "f251a517-49d3-40e6-8b47-cc889edb06ad", "comment": "Malware payload", "value": "026d7ee9ab4fe6ac443e8b0f35a7f3dbe6d471ba285816354248fd28d9a4abf0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229746, "uuid": "c80fe5f9-40f9-41e1-9f8e-63c37813e663", "comment": "Malware payload", "value": "23124d9f706a05a4be2f44f6bc554ab45ecea321", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229746, "uuid": "06242071-66ff-4a2b-87c5-e9b37b9e9fdb", "comment": "Malware payload", "value": "003bcb986d763c88038c33fe02d62c6878b2aa584d760d424b41889334fe98a634ca49fc91d0ac8cbeac937e044d7615", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229746, "uuid": "743ccad0-f769-4596-8a9e-1a942aedcc23", "value": "22248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229746, "uuid": "80fa90f0-d679-4474-84ec-3ec510381e22", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229746, "uuid": "d324e53f-4525-453f-9173-0b89ed613e34", "value": "3072:86TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:8oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229746, "uuid": "e46256d1-1a35-49df-8058-208c3f16140a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229746, "uuid": "313bcf82-ea0a-45de-8e6f-fe4dc2439ce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229746, "uuid": "c8d9b5c4-9cb6-4d63-9c30-3ea3231a3916", "value": "026d7ee9ab4fe6ac443e8b0f35a7f3dbe6d471ba285816354248fd28d9a4abf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1662034-925a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617220459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220459, "uuid": "8bcfa9e4-4e1f-41d4-be7a-37b84b669751", "comment": "Malware payload (Dridex)", "value": "bff2d270e818c1bba8b09273bb6be4ba", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220459, "uuid": "6ad55f9d-f578-42fa-85d0-3b9bf7d890b0", "comment": "Malware payload (Dridex)", "value": "034264fabf14f61f921f627ef0333cba42429b8bdcb2500a528889d93f1abe7c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220459, "uuid": "456ad257-59cf-4cef-98ab-22963d400b34", "comment": "Malware payload (Dridex)", "value": "276f39b47a63331769f905e82110f041dc7848a5", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220459, "uuid": "4dbdb167-d7e5-45fd-8c00-db6f67e26a7b", "comment": "Malware payload (Dridex)", "value": "5832815e5a0d920d9b829be87128420f21b2ea87c45cfbdf38f60cf10a61ff96ec865c6e83eec745b502ca9af9c5a42c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220459, "uuid": "98fb37fb-5b69-4f2b-9029-b7a3b8d90483", "value": "3614BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220459, "uuid": "f8b3a0e9-fe6f-4a50-8650-6234d137f6fe", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220459, "uuid": "902d6976-7b4f-4c17-9420-951a168d07e2", "value": "3072:Qopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:3pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617220459, "uuid": "73b0e07a-e5c3-47d4-ad4f-28a77522c01d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617220459, "uuid": "37458293-0bbd-4787-bddc-c5e9cbcb8cf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220459, "uuid": "a12054f0-f4b7-4cec-a696-faca9dff48c9", "value": "034264fabf14f61f921f627ef0333cba42429b8bdcb2500a528889d93f1abe7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a5143b-926b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617227708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227708, "uuid": "9a7dec53-6481-45c3-a9b2-e44faf213a99", "comment": "Malware payload", "value": "ee1064d85056ff668be1627a461e05f8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227708, "uuid": "65023833-209c-495b-80f2-11e6427f8bbb", "comment": "Malware payload", "value": "03adfe1971dde98d0303c0339caa705778fdd9d245e03dee5ab3f0eacb880fc9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227708, "uuid": "51cd48ee-da19-4dd6-9b29-e59a20769905", "comment": "Malware payload", "value": "27a6c11fb7341c6b24c8b81f9f554e7acbbeeccf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227708, "uuid": "91f51bf9-19fb-4821-8071-a9d6a89d4c06", "comment": "Malware payload", "value": "0163eecf59b96ef8ea8050120462689b51d2227317f5dcb6bc7921cb6c9b019405792355191732a0cb1d4c4e4a24718e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227708, "uuid": "e74eaa52-8d2a-4a91-a8b4-e8a850017204", "value": "0C248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227708, "uuid": "3a46b9cd-2c1b-4c46-bca8-11d6c3cbfd83", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227708, "uuid": "4a4f07f6-791d-442d-a536-5a17341c8305", "value": "3072:S6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:SoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617227708, "uuid": "2ca5dfe3-d041-46df-8062-99e070d1296c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617227708, "uuid": "67ae0e76-30ca-4ffc-9b01-54f336b91568", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227708, "uuid": "8c07917f-d81e-43b0-a6fe-e401c2b88394", "value": "03adfe1971dde98d0303c0339caa705778fdd9d245e03dee5ab3f0eacb880fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e973848-91d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162284, "uuid": "c5a88f50-b23e-4a9d-8069-128355f94333", "comment": "Malware payload (IcedID)", "value": "c74ffad24f006a6ceb7d23d9ff8d8999", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162284, "uuid": "df99b3af-5d25-4028-b129-0d98edce87f8", "comment": "Malware payload (IcedID)", "value": "03affc70e3b8e7fba0502195c176783bf774e7750c4a5e9941082f69b917bfef", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162284, "uuid": "897aedb6-d08f-482c-8298-d5f936a02b98", "comment": "Malware payload (IcedID)", "value": "e40d1f2929b4b4d1bd165d230250ceab1c817e4a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162284, "uuid": "1f59e410-3f1b-42c0-8847-855030df08c8", "comment": "Malware payload (IcedID)", "value": "7c58b39503bd192d5d257738a5d6e224635978a18cc85fff4f5bc48f57efe91e7981bda6fff9e514ad6c343a9cc822de", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162284, "uuid": "9d995dcb-ee69-425a-9873-47f141c3c893", "value": "3CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162284, "uuid": "4a572870-798d-43ad-a035-ae384279fdcf", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162284, "uuid": "5dba0f70-b40d-44ee-a103-9b978dc06baa", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162284, "uuid": "7736b6bb-b0c3-49f6-bb0e-f9d990e08963", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162284, "uuid": "b8878398-2361-48ad-894d-ad7e8a5a0c4a", "value": "document-300539637.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf17b37-923c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617207509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207509, "uuid": "ecbc7c31-dd70-4d3a-bc0b-d566b34b3eb2", "comment": "Malware payload (IcedID)", "value": "f579e1a811bba1a87be2468db01cbe1b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207509, "uuid": "8501caeb-b5cc-47f3-9869-8839dc70f503", "comment": "Malware payload (IcedID)", "value": "03c1e9912198dcdf6f80cd945874534e48ebd1676d22e722f2379944e928d042", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207509, "uuid": "d58951da-561e-4a29-bd57-c5e4a9dd291f", "comment": "Malware payload (IcedID)", "value": "9b32fa67c17ba9290cd48b1ea5474a2740c901c8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207509, "uuid": "fa1708b0-8574-4184-abf8-0a8a76ccafec", "comment": "Malware payload (IcedID)", "value": "ef559b733015690301186ac1f2ff787b3311d06dfa15e101f3de9738ab715504bb519ae5e9971c7e2957fe8e788e3cc1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207509, "uuid": "2cad38dc-5a3a-420f-86b6-8cc862c28e67", "value": "EDB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207509, "uuid": "21e663d4-699c-4fb6-93c2-01f293f189a0", "value": "3072:s2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:sqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207509, "uuid": "b052e95a-4074-4573-b742-231dfb46a80e", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207509, "uuid": "be6620e2-f91d-4523-a495-be521fd52b87", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207509, "uuid": "5c6cf055-8953-433d-af83-b662483efd9b", "value": "document-1226087494.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f63b952-91c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617156729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156729, "uuid": "e199315e-4589-4e39-b812-f2a6501c9575", "comment": "Malware payload (AZORult)", "value": "073ce5fc8b772f0568d08ed4232e5819", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156729, "uuid": "4968d9de-d496-4dcb-be52-4ee0d0df5827", "comment": "Malware payload (AZORult)", "value": "040343ed3920a4420938a8969fbb3bcebfe337f43aa4ec27477a9aad1ce4c885", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156729, "uuid": "1800b939-e261-49d7-b299-217620183dac", "comment": "Malware payload (AZORult)", "value": "92ae1d0f596ef783a4d9a2190df8c802b17bd6ca", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156729, "uuid": "524677c7-ca94-49a4-9867-7b206a372920", "comment": "Malware payload (AZORult)", "value": "7053bcd5d32f63952265767d65abc9b2de158c6ff021141813cf085f3d985dcc62b6cd598ed021140c8406da09b18109", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156729, "uuid": "4c08993f-566d-4763-9976-573aa48092fe", "value": "C5F49CEC3640B5DFC81BCD7689642C60AA60A5F7530BC603901755EDAA0DAEFDF942E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156729, "uuid": "452d4c79-98e1-4ad6-bcb9-1849c089227f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156729, "uuid": "0bff5dec-1e70-4a07-8073-7b39e7f1a6c4", "value": "12288:XBIB0O9EO+wdUK4I/PuQwtoEbQAY6u85zVwHjUaozWJ8cOO3Gfox82oxbtteaRG7:XBDOeO+wN4QrEiCVcw6ePZfa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617156729, "uuid": "52dbd735-84a4-44b5-9bbe-5ab067195ed5", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617156729, "uuid": "c7ce902c-c795-4b49-be2f-833e7483d91d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156729, "uuid": "fde35e98-2333-4f97-a1b7-0bcef65d8424", "value": "PO#5509126990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d80ab30-91cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159786, "uuid": "e2824e0c-6045-45d9-bf63-a495f37b4ee6", "comment": "Malware payload (IcedID)", "value": "6f9adeb1b8a77ab8fc5b4e382be9dbf5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159786, "uuid": "c22ee34b-eea6-4ac1-bc36-7fdb2a151c71", "comment": "Malware payload (IcedID)", "value": "0417460159c548acaba3829cfd2930c3fa1ff7b29876074baf27df4049960044", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159786, "uuid": "ecbf0c12-36a7-4a76-b16b-e1eab923f612", "comment": "Malware payload (IcedID)", "value": "42f8c0367968f066b1ae1c72adecb40e75d4891b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159786, "uuid": "8820b5c7-ead7-4ce4-8b1d-f298a97e1760", "comment": "Malware payload (IcedID)", "value": "f14d023bd94538637d5a3e5103db8f46399ad2951906c01a1b22c9b93565412786b6e50d7bc7c7a13cb2e39c95c8faf4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159786, "uuid": "9d17402d-d01c-4c86-9f3f-0a767f9b416d", "value": "ACB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159786, "uuid": "36fc49ec-eda1-4bdd-a680-b02cbf6a7e99", "value": "3072:C2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:CzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159786, "uuid": "d71be87c-9219-4166-bdcd-34b3b7965980", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159786, "uuid": "fe0ddbc9-763c-4952-bcd3-0e188a10778b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159786, "uuid": "c1edd918-6a1b-4991-8d51-9448bea7b486", "value": "document-134362331.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba34757-9272-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230435, "uuid": "0aba9844-f8e5-4a00-b9de-504b7340c96e", "comment": "Malware payload", "value": "e8fbe6f81cbfcc429f785c9d30de0eec", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230435, "uuid": "c67ac536-0175-4247-a76e-4ad48d21e44b", "comment": "Malware payload", "value": "04442d2a6a964d1baf2169ae1c8c9cc6d71e5f1b5a20bf0313b0195072e69b9c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230435, "uuid": "887512d8-3aab-4d56-8441-c3699877711d", "comment": "Malware payload", "value": "f350ea1928b0fe9b263dcb7210586f60d6f13944", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230435, "uuid": "ea9a84df-06a6-4052-a8fb-db4591c85556", "comment": "Malware payload", "value": "1406485f8195ff9ed31d53c02dbcba803c2d1e1a38abe5abb86a6db19b9c239e2b4f58c40115ea047ffd598899bd53b2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230435, "uuid": "d63c376e-a8b4-4ca8-b074-25ffa5a760d7", "value": "74248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230435, "uuid": "d91df53d-ccc8-4888-9dad-94dc106ba394", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230435, "uuid": "be2dc525-077d-4aba-a69e-d16507b7aa5c", "value": "3072:h6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:hoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230435, "uuid": "25b20ed3-22d4-4ec6-a3f6-40fc251d61fb", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230435, "uuid": "977612f2-f92f-4275-82c1-3e9af92bac96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230435, "uuid": "a0ade836-ee1f-485b-96e4-cf2063a0c098", "value": "04442d2a6a964d1baf2169ae1c8c9cc6d71e5f1b5a20bf0313b0195072e69b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4161a0-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216529, "uuid": "b53c041e-c6da-4d69-901b-06b666e9299b", "comment": "Malware payload (Dridex)", "value": "8efe5f6cf21997076afda26c713a1d3a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216529, "uuid": "f8ab6d56-62e2-4b69-9c2f-99c96df73b42", "comment": "Malware payload (Dridex)", "value": "0444694a02c70595ccfde90c8157f9d0390dea11ce54950399b360256dac96c0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216529, "uuid": "06cfc0de-190a-40e8-9508-67339be93fb4", "comment": "Malware payload (Dridex)", "value": "60b88667bb1887be21dcbd93af949ae8bc3a7543", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216529, "uuid": "1874fca7-d4d8-4d36-b9cc-039487f00667", "comment": "Malware payload (Dridex)", "value": "6821ed0cc85c332c931fd578e7b216f8cc0529b926b769a0e58c0a27fcb953ceea9d9067207d6af881b06e1d6940f195", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216529, "uuid": "17e49bb7-4e65-4428-aacb-d090e4bc3d70", "value": "0E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216529, "uuid": "ee4bdfbe-75a6-4adc-9ee4-f849a6cc8ace", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216529, "uuid": "1af1fa75-12b0-4835-bf1f-2b4dd6b9bdfa", "value": "3072:uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:RpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216529, "uuid": "4ff0b609-602d-49a0-8061-cee525208cc7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216529, "uuid": "10a9b64e-7788-4829-8469-962ed6792598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216529, "uuid": "94cd5a81-0b23-46d3-90e0-777d3fe930c7", "value": "0444694a02c70595ccfde90c8157f9d0390dea11ce54950399b360256dac96c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4161726-9263-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617224329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224329, "uuid": "b612a41c-d70c-41da-b9a0-d48a5d385346", "comment": "Malware payload (Dridex)", "value": "8dfb662b164e3f2994d3e0826e776c35", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224329, "uuid": "79c3d1b1-ac37-4fcb-9e34-d40e9b7371d0", "comment": "Malware payload (Dridex)", "value": "047b9802b70453e7586bea3a3da2b5579454a1c0a91f47bc81426a48a7f73b95", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224329, "uuid": "c35189bf-bb1c-468f-b701-0d04051a927c", "comment": "Malware payload (Dridex)", "value": "7f25dd364de0bae6fc1df702758fc7f99d6598cd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224329, "uuid": "5ace6e79-7e69-4f24-a897-f7869a870996", "comment": "Malware payload (Dridex)", "value": "6d8c1f7377cd5517a47d2a1fdec8f2c4bd453529add32ab552eac668bfa458d1e7e6d7e701c7f7be45e240bdfa919357", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224329, "uuid": "ca0acf39-c7d5-4e04-85f3-891b66c0222c", "value": "76248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224329, "uuid": "881400a8-dc71-4218-ac93-e4674098658b", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224329, "uuid": "111e0fbb-64ad-432a-82d2-2c4c6864daf0", "value": "3072:36TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:3oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224329, "uuid": "08ac8688-400b-4e75-b30c-f9b91f361578", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224329, "uuid": "a5898c0d-eb68-4f56-aef2-c9558dd2c18d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224329, "uuid": "390ad901-f6b1-40ea-b5ab-b5414cbc29c9", "value": "047b9802b70453e7586bea3a3da2b5579454a1c0a91f47bc81426a48a7f73b95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b09ba01-9242-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209845, "uuid": "7828556a-6da5-4a15-9266-f6ac85681ac0", "comment": "Malware payload (IcedID)", "value": "f86ad5ede70082931d0f9ccca8e29f3d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209845, "uuid": "df3bdcfc-a9b8-49b4-9e12-366b3ebf56df", "comment": "Malware payload (IcedID)", "value": "049fb1ba6d534fd38d57b8c474eda436cfe2b28a533a7e6e4b02ca13cd7cbe94", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209845, "uuid": "f54002ad-294a-4471-9f92-59ff56d1846f", "comment": "Malware payload (IcedID)", "value": "4bb2b0232f116cc79079591fe513e24eece932b8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209845, "uuid": "5d6e7dd4-7ac1-446c-953f-3e4c2bc9ed51", "comment": "Malware payload (IcedID)", "value": "94ec9a97cdcf7a2c6946429d8a313ebd3e6eb7aa44ccf07edec896f7f85768e8507d2f08c338b264e1404e4350435bde", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209845, "uuid": "3ed4d86e-0d5f-415d-8544-09f20862fe81", "value": "28B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209845, "uuid": "e7796d29-8765-4991-85aa-82bf3409ba11", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209845, "uuid": "77052896-27e3-4f0f-b36c-5074f9c2f10e", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209845, "uuid": "a1a3e870-aa54-4bc5-9a8f-ba4862fda574", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209845, "uuid": "b5655727-73b6-41d7-9387-ad02b1f2f7d1", "value": "document-1514820959.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f0bf49-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212995, "uuid": "c07641d9-30a0-4a93-904e-798a71526069", "comment": "Malware payload (Dridex)", "value": "6c5f0c4ce12111a0b58114c3a2289e11", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212995, "uuid": "e5c29d84-e8ca-4c93-bad6-019b304da76b", "comment": "Malware payload (Dridex)", "value": "04abf7dd64adbe1cc76579488b2e1b39930ec1d76bf0aa87cfb8301c9f1567eb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212995, "uuid": "082c55f4-7114-45a6-a610-a1075c5aa51d", "comment": "Malware payload (Dridex)", "value": "6e6cf2bdcba601327b13c40926b830af759df0e2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212995, "uuid": "8f0a770d-b42a-4d42-8f86-c4b6aa3d963b", "comment": "Malware payload (Dridex)", "value": "62cb190eba0abaf66c66b738de3f225971a78ce931648a624498c9338134659c6fcadd9015b90f8c226c3764ed3f3864", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212995, "uuid": "d9b4282c-b3c1-4d0a-aa41-e6ada5094930", "value": "2F248C5FE339E486FAE3CAF44186A72296A39C92436F680DA0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212995, "uuid": "1ebbd7a8-79c7-4628-983a-155842642c46", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212995, "uuid": "752dce1c-0e53-498d-8151-ea9e79d8bc74", "value": "3072:l6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:loMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212995, "uuid": "9bcf011a-00f3-4d65-a819-c21d83ac1bd3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212995, "uuid": "20c762d1-5c53-4a2f-904f-1d0df8847d9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212995, "uuid": "221f7a11-008f-4c2e-ae3c-f5ec5b8fb39e", "value": "04abf7dd64adbe1cc76579488b2e1b39930ec1d76bf0aa87cfb8301c9f1567eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3f029b-923f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617208530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208530, "uuid": "fa47f207-b15d-475c-b49a-3476ba00d931", "comment": "Malware payload (IcedID)", "value": "93a776d611e4f5c9756e4d2d860f613f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208530, "uuid": "fd3f5452-6611-4662-b11f-80017972a5e9", "comment": "Malware payload (IcedID)", "value": "04e6320dce594194eeea6da52f8cf8227eb3385dbe001778f0b58587254bb2ed", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208530, "uuid": "d8eaea54-5572-4b11-aa9c-720ded96b524", "comment": "Malware payload (IcedID)", "value": "5def03122ffc5810a929c2bcf3eb8cf060c0764b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208530, "uuid": "8637f210-6e20-4f3f-8e33-ebef4a07af2a", "comment": "Malware payload (IcedID)", "value": "571a69a56d8d23a2ba8d5e9d75e95094f79da8011fd9f606948203cd37d7da9a5111a3e26637b09ff15a1e2503b688de", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208530, "uuid": "e509d61d-cc55-4baf-b2a0-fb05c90a9a97", "value": "D6B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208530, "uuid": "60c57c0e-678a-4f5e-9765-590fdfda6c20", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617208530, "uuid": "561773f9-c3fa-4c31-a4f8-693d659f9873", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617208530, "uuid": "d1ab0ab3-c5a3-448a-b587-5634004226a6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208530, "uuid": "2dc87aed-be09-4bd5-a0b1-7d8837744d2e", "value": "document-278691849.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b124aa-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218535, "uuid": "92e0c751-3f7c-4acc-a4a8-21ae0bccb1e7", "comment": "Malware payload (Dridex)", "value": "5ff468b4451c95e47469652be2bf422f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218535, "uuid": "29f835e0-77eb-4d75-923b-9e3336b903c1", "comment": "Malware payload (Dridex)", "value": "0565b84148992336a2d17174ec1fec069984360ede0a29f50872b540a50efba2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218535, "uuid": "6f4b4d75-aa74-40a3-a651-cc4721afacff", "comment": "Malware payload (Dridex)", "value": "aae220a1aaabb079f63e1380269afa96804bdbab", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218535, "uuid": "3e992f7f-dda6-4228-b9fe-1848be25dc9c", "comment": "Malware payload (Dridex)", "value": "cb0197ae121405bbcdb47f86c0aafed635c73cf17e7c10bfbc7d5a9fde7f8e9f6ecbd996213a7245148346efd91e3284", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218535, "uuid": "214cf2d5-28e6-4868-af38-1b569d14d6aa", "value": "9514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218535, "uuid": "7223fdc2-45ba-4abe-b834-9e934f281a1a", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218535, "uuid": "ef4dce58-7133-4871-8c88-0649e19cd770", "value": "3072:zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:0pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218535, "uuid": "ae337fef-29e0-48e1-8465-f5daafe14406", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218535, "uuid": "2722c847-eebf-4198-8ee8-8896f3a88b16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218535, "uuid": "207991aa-d03f-4708-a895-bee8a44a9f4b", "value": "0565b84148992336a2d17174ec1fec069984360ede0a29f50872b540a50efba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02933b3-91c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157321, "uuid": "d5b0a701-8c33-451e-842a-cdf70a5bc685", "comment": "Malware payload (IcedID)", "value": "08132972e11804825a8d90162da1ae16", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157321, "uuid": "1922814f-4995-4d3f-a63f-2b93f5e8de43", "comment": "Malware payload (IcedID)", "value": "05863cdb6908c76bc543843d3f26483647f2ccdec06f4b275ec88d5ea98e0ac1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157321, "uuid": "16f2334e-362e-4a40-b629-f8ce8f76a2e2", "comment": "Malware payload (IcedID)", "value": "52f935e2a38bb49b63cc152bf12355e1a4a77627", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157321, "uuid": "f3eb58b8-05ac-49f7-9d22-44946e4e3c11", "comment": "Malware payload (IcedID)", "value": "2743151cfee8b6a6e5b920987531709cd6820a606f8df2564e444401671ca428c55e7a851c2c3b1c3e2d936184cfb3ec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157321, "uuid": "b438d621-f611-4bfc-8c3e-ffaf18dcb796", "value": "4CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157321, "uuid": "32cd58c7-9628-4f8a-9853-750063a4c2dc", "value": "3072:Q2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:QzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157321, "uuid": "392e7ebc-fc77-48a0-871a-b4f72d93f34e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157321, "uuid": "3463e173-782b-4a6b-b7fb-4da8f2700625", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157321, "uuid": "736b6cf8-6bb2-43ba-8b3f-fd3435dca931", "value": "document-1004529661.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ee1331-925c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617221033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221033, "uuid": "15db169f-5ee9-4d85-9a72-df30d8f91937", "comment": "Malware payload (Dridex)", "value": "3eff1ebfa5561d086c903772b3125a47", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221033, "uuid": "891ec75c-3b75-4053-a389-aae5d4999da0", "comment": "Malware payload (Dridex)", "value": "05a0449567fda53bc5f0e7c4c76f10295074e3f5589501e3318246933aaf2347", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221033, "uuid": "0ee9ea2f-3f9c-42f3-b6c7-25b71172f91e", "comment": "Malware payload (Dridex)", "value": "e63b05342a30bdc22f830eb18d3ea7bef886a669", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221033, "uuid": "64d4829d-2018-4a8b-b540-33655f3e3fca", "comment": "Malware payload (Dridex)", "value": "ef1c19c2b8c3273b50d05479d0b425b2f85047244255fb2c8f648825c68886ba46c9a1989ba4a7b1fb109595912dded6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221033, "uuid": "f85b7f93-3fdd-4803-960b-9d139565f6e8", "value": "0E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221033, "uuid": "62489782-f26a-429d-8fa8-170a2e53716b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221033, "uuid": "e80b6270-b48f-412d-91c2-96265098c1cf", "value": "3072:Fopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:qpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617221033, "uuid": "a18cc832-d07d-4869-b74e-e7e33cff915b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617221033, "uuid": "13d5d892-33d5-4fba-80f9-cb97a011b570", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221033, "uuid": "87165b5a-019f-456c-83bd-167f2f7c1829", "value": "05a0449567fda53bc5f0e7c4c76f10295074e3f5589501e3318246933aaf2347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e34427-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223766, "uuid": "d32a4027-cc3a-4ca4-8682-0f140c3bd72f", "comment": "Malware payload (Dridex)", "value": "15806c97e70ea76bfd5fe6e3baeda8f9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223766, "uuid": "04b08dd5-e4fa-477a-a8d1-28230f13b18c", "comment": "Malware payload (Dridex)", "value": "05e61a8450318e334bed11f5659c166e3f98f223d936f13ffbff7ecd937dedc9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223766, "uuid": "ceb02e44-b42a-4201-8d30-25d1a2596646", "comment": "Malware payload (Dridex)", "value": "9dfcc4c0816d2fd9b731359bd1fe5a22271f1f9a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223766, "uuid": "7ceebd0f-e051-4385-a231-53838f4ff9bb", "comment": "Malware payload (Dridex)", "value": "537bccd1b12c3be0660bd54564509eca9130327ac378280053e7b87cca3343462968bfb74d9b891e6c5f340499f2bc3c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223766, "uuid": "62585198-9be9-4e0d-9f33-189371447f30", "value": "9F248C5FE339E486FAE3CAF44186A72296A39C92436F580DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223766, "uuid": "01701786-9e17-478c-ac0b-e04831625622", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223766, "uuid": "2f104bb5-c780-404a-94b1-2b98cbf54a0c", "value": "3072:06TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:0oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223766, "uuid": "8ec8f398-c6f2-4ff0-ad4f-a2a3cd03648c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223766, "uuid": "944a3bcc-0bff-4225-958f-267dbaeb8ffb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223766, "uuid": "9aaf0b5b-5b82-48a3-8771-3eca7eb5eed4", "value": "05e61a8450318e334bed11f5659c166e3f98f223d936f13ffbff7ecd937dedc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba331b9-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222784, "uuid": "1f05a97b-4f4e-4d49-8abf-2d41424598d9", "comment": "Malware payload (Dridex)", "value": "fa7469dccd5894b5f2a97b81434a4aa2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222784, "uuid": "b7936695-f78e-4984-86ba-2397fe2e32c8", "comment": "Malware payload (Dridex)", "value": "06172336b284993aa2e866262e4e50ade8451f7f8060b72d45944295a43f1537", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222784, "uuid": "d92a9a0d-4fb0-40a8-99f3-2bca369cf461", "comment": "Malware payload (Dridex)", "value": "5a4189a0de5299f7316c65c14220c56e797255f1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222784, "uuid": "767cbffe-7a65-4c46-8c5d-55ba1e424740", "comment": "Malware payload (Dridex)", "value": "bbc3ea22a539cbc3b79d0d6b96e846b740a8e6f57ef39044fbf14ff7e2925b69141c1a8a682554e5e54e9366990c11ef", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222784, "uuid": "66ae77d4-404a-45d4-b823-c8a5a4ceb150", "value": "AD248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222784, "uuid": "6aa196ee-8478-4a8f-bb51-c19f21e8a2ed", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222784, "uuid": "64f69c1e-9a56-49ef-83ca-6c87e004b3c2", "value": "3072:J6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:JoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222784, "uuid": "f5be705c-fa72-45b5-a53f-ab42ac625ebb", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222784, "uuid": "74561630-0bd3-4678-b8cb-4c7d15816262", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222784, "uuid": "32a947ba-258f-4339-9ece-3c6c623e81d6", "value": "06172336b284993aa2e866262e4e50ade8451f7f8060b72d45944295a43f1537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f82b0b5-91f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617174768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174768, "uuid": "323cacbe-e4de-45a4-928d-377680ae06d4", "comment": "Malware payload (AgentTesla)", "value": "62abdc91eb1e51dcc49e92924c711d8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174768, "uuid": "2f609e79-ec86-4d6f-9fd0-5a7cf38f17bc", "comment": "Malware payload (AgentTesla)", "value": "0695b7a39b824d4476ac61ebd1f33267e573f1a9f0082b7fb9c89468a5e30df8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174768, "uuid": "6a005b99-8ba7-4918-b030-ebf58801d86b", "comment": "Malware payload (AgentTesla)", "value": "f511359fbe267654767f5a3b7829140b7ad9631f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174768, "uuid": "6cada3b3-d283-4345-8ec4-721e1edf6175", "comment": "Malware payload (AgentTesla)", "value": "79ff42c3018c0d448b8a19c24f3b5600764bb7a1067ea52c8beeb09b574b36bafe54b721219aa05a271de05044456494", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174768, "uuid": "debe6d54-05c2-4aa6-b728-3143b9d7a867", "value": "2F15AD2421E57AC0DCBA86B142F8476162E35F948AC0E4B9FF4CB17C3B9619D76D62C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174768, "uuid": "ba09bf7c-29bb-4795-8d5e-b30c5213a25c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174768, "uuid": "276e6c00-1241-4eb5-aa62-b80bd19bd2d3", "value": "24576:QtIFfhBhEStCFJpw1A3CvU7/mJW1uOUc5yv0aQxU7Of:Np7mm3Lv1UU7Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174768, "uuid": "3ce7d49e-1339-40d8-95a4-4405b53bead6", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174768, "uuid": "546b34ec-fc8f-458f-babc-e7e0afc99ca1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174768, "uuid": "29f9cd08-81ef-4bba-b1bf-09b9f7bb5048", "value": "PO#KIS3345j_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9900833-91fc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617180126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180126, "uuid": "94f392e4-dad3-42ba-93c8-4ea34b0e895e", "comment": "Malware payload", "value": "376d8e1dd303942d204661e00552be26", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180126, "uuid": "7b2c60a8-21d6-4d3b-bc01-bb1dadba2045", "comment": "Malware payload", "value": "07106658bc0e608667a987849f8ef91fff217a5a05a94c64fdfd7e3d91ac436f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180126, "uuid": "315a9aa8-2f45-45fe-b1e5-38fffb3d9ee3", "comment": "Malware payload", "value": "de9a9a37f23c276a978c73d839bbe6d03e861dd4", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180126, "uuid": "c8d8b8e8-dd63-4af0-8558-a24b9b8713b6", "comment": "Malware payload", "value": "8d7f634e6bf3d522cb989129e503d6bf611a6e3535fd4656a07177e3f372ab91591530d6e10dd113ed382cefc5194d36", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180126, "uuid": "97a3aabe-6910-42c4-b8dd-b8db1937bdd3", "value": "64B36D326602FDCA677F1F84F1182E925CB07AA38BB05544FAC40D9A79E5244DF2DAF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180126, "uuid": "03f00fa3-dd5b-473d-9a0c-8bbc2968f9e9", "value": "3072:+c5h/f7dqAz1+FRBgvTgxF0vYQk6OP2IbWbcOd:ph/f7dqo1+zBgv00vYQkn2IKbcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617180126, "uuid": "5530e8e6-b338-4a29-9a5c-7921f78ff44f", "value": 109787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617180126, "uuid": "944551b0-02a7-4366-8ff9-86f08c1f18b4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180126, "uuid": "cfad3baa-ecb6-4ca5-8b4a-ef23350db756", "value": "pow.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf959d3d-91e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617171010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171010, "uuid": "26b87022-370d-47ea-886b-766d884567c1", "comment": "Malware payload (RemcosRAT)", "value": "d266c9d09e829cf6a20a0dffe15d4723", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171010, "uuid": "e44bd703-9ab8-46c3-aa03-2e3c571bd83d", "comment": "Malware payload (RemcosRAT)", "value": "0731a41bd8d8fad2ca1c2e8a06fac439b8e8f3a6371e8d6a0c0d59a9ff9cd31d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171010, "uuid": "48dfc426-041d-44b5-8b34-25d7a2e23cf3", "comment": "Malware payload (RemcosRAT)", "value": "c16e01cd97aba0817689f33a5445423f733049ef", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171010, "uuid": "5094fe8f-7496-4260-8920-23f010f9fce5", "comment": "Malware payload (RemcosRAT)", "value": "dd428799e1e29fb3bc56369e599e019de7774cd6542564fb1d32aaf62ac64d7f48d21d3c07f68fbc93e20022ba84c234", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171010, "uuid": "c1341648-f945-4692-902d-cff182ab3751", "value": "1AB5331ABE906F37E16F2B7D056B547016681DB0AF38ED167299B63770372F182E620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171010, "uuid": "13ae8d4f-94ac-4e8a-a1e8-0a42d3fdb483", "value": "49152:52tu0ZqMq4V73joXmsprlqAo++DjNqFbJ0W7U8mFUA15:+cMB13jHmQAJ+0FbJ0WY7h15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171010, "uuid": "6737cf74-7fa6-4fb4-9e24-5c3e9a9bf569", "value": 2378240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171010, "uuid": "f827f326-b252-40cb-805e-9c88abaa6c4b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171010, "uuid": "66f33fe0-3e6c-4a6c-b34b-1c84ba0fbed1", "value": "RFQ for MDPE Pipes .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1aba061-923c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617207494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207494, "uuid": "afbf31f0-70e5-4277-8819-4b33892066b5", "comment": "Malware payload (IcedID)", "value": "ca8e509db97ba3e3848fe57ce131ece4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207494, "uuid": "e8ef9815-5ba4-4091-93ab-7e0e6a0898d6", "comment": "Malware payload (IcedID)", "value": "07758dfe13c9c0fdd9aff122123511aaedc68ca23ae3bb8b8def6213bb79a7dc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207494, "uuid": "ee983de6-4d4d-4701-9b83-879b3ebfa0bb", "comment": "Malware payload (IcedID)", "value": "f013aa67decdeb9ca09906e92ba9f57589b4947e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207494, "uuid": "85475bef-d9e0-4cb7-92a6-400a8f68e698", "comment": "Malware payload (IcedID)", "value": "05558cee16fda253ec5d6ed7b4bdc487242a060141cc17c7bf39d946ed7ca38aca46c5c10bb45bcb56749b4050acb8ac", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207494, "uuid": "24bc36e8-0873-459b-89db-a381c2bd0382", "value": "B9B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207494, "uuid": "f0e303d6-e841-4d63-be24-b95760c808de", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207494, "uuid": "c3b33405-b604-4125-a366-63c8329ca32c", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207494, "uuid": "6e452b7f-0e39-4aab-bcbb-f20cb14d66e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207494, "uuid": "f63b2aa6-838c-49b7-b55a-3f1e5e2338da", "value": "document-134608471.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e640e4f-91cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159787, "uuid": "64a13168-7f3e-4836-8800-b748cb3cc717", "comment": "Malware payload (IcedID)", "value": "6fc87738337a74b7f0f20eaf4c1effe9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159787, "uuid": "401ed64d-9699-4262-8872-9be90420c321", "comment": "Malware payload (IcedID)", "value": "07899b73efeb3ce5d2966caaae7e79e77497de509371d91b8fa11c9815e57e66", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159787, "uuid": "4c0cbcc1-eb81-4766-9113-4b587048e705", "comment": "Malware payload (IcedID)", "value": "b0bb2cae0dce6fab8da65749f277824d5115f078", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159787, "uuid": "6294fdd8-d594-4e8b-a17b-9a5b5f83ed40", "comment": "Malware payload (IcedID)", "value": "e9da5141adc0431efee3bc7da3446742ef1060838e077ef5457195cabc31cf5de96a941108bfe90cddd93ef065714dbc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159787, "uuid": "188b69ed-8aeb-4d99-bc60-111f32e36036", "value": "A8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159787, "uuid": "2a226bb3-0f00-4201-8fec-e59695181ea6", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159787, "uuid": "a599428b-35cd-43b9-b717-173d51640f92", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159787, "uuid": "cc283ded-7012-4d46-b14e-70670bef239c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159787, "uuid": "223b188d-4adf-4d91-8469-67a287f012fd", "value": "document-1804899271.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a77a68-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158236, "uuid": "2650da73-a061-41fa-a3a8-e9961ef7be32", "comment": "Malware payload (IcedID)", "value": "325fd86cde8e7acde610693e2709b1f9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158236, "uuid": "4291da8a-44c2-47c8-9565-f53c5da00a17", "comment": "Malware payload (IcedID)", "value": "07b2be79eadc2ef476f220a1ff153eb6506319b7c041151794e2c8d9c8aa8947", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158236, "uuid": "25cdfcf5-4051-43e5-a86a-9c275ab99250", "comment": "Malware payload (IcedID)", "value": "72c3aa23a6f50b70efe0391eb8fbb2d4381d29c7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158236, "uuid": "aa2eb4ca-f463-4e51-8d34-45540c69dad5", "comment": "Malware payload (IcedID)", "value": "3b0831489843ec3dce26accb66a4d7e2b20ae7268e65c2b7a9dd6a2e4dd47bf5ab1ab66d15a532f7057ef443262045d6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158236, "uuid": "7e36fbf1-06e7-49a4-97eb-3236fc8b76c1", "value": "CFB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158236, "uuid": "6227a17d-ad3f-4a6b-a724-f3d789308bf2", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158236, "uuid": "00463e81-256e-4187-9fb3-b71025901dc3", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158236, "uuid": "55285750-d47a-4e0f-9346-05fd2456c1f0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158236, "uuid": "2a3f9ae2-4a12-422f-b2a2-54e12fbed3f7", "value": "document-1415726992.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1daab735-921f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617194790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194790, "uuid": "b26207db-84bd-4f5a-805f-39a6f48c3072", "comment": "Malware payload (Dridex)", "value": "be3dda0d213a580e773c97645d566347", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194790, "uuid": "ab5444a0-3e10-4015-bdff-ca1906e4c90b", "comment": "Malware payload (Dridex)", "value": "07ec5c0e81ff4f5073993471925cd8604464d169a4649f60bb493aea378f339d", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194790, "uuid": "c61c8aff-805d-4d79-9f9e-96093eefa92f", "comment": "Malware payload (Dridex)", "value": "32c0da1605934c5d393e54c8022cbb9834cc854f", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194790, "uuid": "e8f09387-0ec1-4a61-98ed-6b6649b9487b", "comment": "Malware payload (Dridex)", "value": "4a9d1160424be1b08dbf16804c823849bd35a41acc098358b1108e4022459678a49a609a0919a71863c24e46004f4701", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194790, "uuid": "7e259c45-d7e3-4ab4-a4a8-505aa5c3bcd1", "value": "C0C49E016962A039E8B386BE89FB564D46AEBD50073464DBB3CC985D1F6B6E17F30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194790, "uuid": "09e9a131-5330-484c-ba33-66c6998e184f", "value": "c481640479b1f140aa694701dbc594d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194790, "uuid": "27e0e364-aa65-4fed-8a19-7456d386d00d", "value": "12288:LJfvOjRSY7eIDmMPhdLXhnkSx7lCUjg6DlHk+KAQV:Vudr9raynDVk+2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617194790, "uuid": "0c24a816-a126-4fbb-9e20-f7283a1668b5", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617194790, "uuid": "70790c9a-bfe3-4521-bbe5-6ff883d43997", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194790, "uuid": "6d277e98-9cd7-4203-893d-dd3827a6af2e", "value": "07ec5c0e81ff4f5073993471925cd8604464d169a4649f60bb493aea378f339d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76214e53-9274-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617231446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231446, "uuid": "05d8135c-0781-49e2-b414-70c42ad4fbdf", "comment": "Malware payload", "value": "7e8e0e81b084c03b1ad31929dd17a4e7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231446, "uuid": "a9794fd2-cf94-434b-9d37-73b9f55d5d13", "comment": "Malware payload", "value": "0800f75e1fa45c80d90d29b8fcc0be52790407b5be8ae89f67732ecceddf2048", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231446, "uuid": "2d10b8bb-e701-4ff1-88e5-72896f954196", "comment": "Malware payload", "value": "fc01edd3708ff04ef5e78947d7c41b2d6c90174d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231446, "uuid": "51b6a093-656f-45e8-ac7c-138411cf7a77", "comment": "Malware payload", "value": "52ab3803f56546cae43fe94521e6f973b544c9547f9cd715abf1be1e531cf0748e45c37b61acaa03c1abd611f800b109", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231446, "uuid": "48144a8c-7748-458c-a3f9-bb5d6e23fcb8", "value": "4714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231446, "uuid": "e5ac2490-fd17-46d2-b4b5-62ee87b9d407", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231446, "uuid": "dccf389b-4d5b-4337-8c6e-54663726678a", "value": "3072:Copj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:VpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617231446, "uuid": "87171a6b-da76-4d7a-865b-0f7cdf3aa786", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617231446, "uuid": "718fce25-bde3-479e-9009-4bfa15e6995e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231446, "uuid": "4fc1e68a-fb0b-44a7-ab7a-fd447b456ac4", "value": "0800f75e1fa45c80d90d29b8fcc0be52790407b5be8ae89f67732ecceddf2048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6d262f-91ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617172268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172268, "uuid": "22d21a8f-50bd-4f6b-806f-113d3e3c94f8", "comment": "Malware payload (STRRAT)", "value": "15900ee0dbafe42bcb3aa5653c27908e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172268, "uuid": "81ec59a3-21ee-4e3a-b37d-445c2fa132e8", "comment": "Malware payload (STRRAT)", "value": "080240f1973b889a1042beea9966c3d96f3737137397d98343594afa73620447", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172268, "uuid": "705c5dde-ff94-4485-96b0-aaf6af9425b6", "comment": "Malware payload (STRRAT)", "value": "f343c4161df29df8bc3c4890881f17e9d801cec3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172268, "uuid": "d1eaf3fa-eaf2-405a-85c4-0df06dfb500f", "comment": "Malware payload (STRRAT)", "value": "deece13ae44ca2f74c5d46e2ece42ba5c84a0682864c1dcb04225fa52f78f4fd08b219bac9f1129a21c7ef732971b3bf", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172268, "uuid": "7ae5a914-b75b-4994-9814-57c0d84a0268", "value": "00A3DF1BBA9BC1E4E80B49B601CD5A72D71D41E9D449927F66FC19084EB4C7E8B03E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172268, "uuid": "5d9083d3-b496-4fb1-b6dc-c9a7d6138b1c", "value": "1536:0me9jlyLInQNs2fvn3iPrEqpdoUM/Xa430XtlOeOXik8PK23t8HFZ6+W:hkQaIvn6jGpkXtcXik8iYeHnBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617172268, "uuid": "ecf544ed-9979-43c1-ac8a-e7a08f58ca22", "value": 100681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617172268, "uuid": "0d0a0caf-9dc8-4df0-83ae-e5040c3c92af", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172268, "uuid": "fce91e57-e6a7-4159-8640-499ed26df599", "value": "DHLMar 2021 at 9.708BZ290PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aee05c7-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212958, "uuid": "cf13f23a-3327-49d3-84c9-fe1356b203a6", "comment": "Malware payload (Dridex)", "value": "44546d741e19ac97e61ef049eb816640", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212958, "uuid": "82030f64-be2f-4cb7-ade9-085285c8f90d", "comment": "Malware payload (Dridex)", "value": "081b62edeecb68f10b469fd2ad07513a0e656f584be7419a48f0af7b96dcab07", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212958, "uuid": "189bb996-d7d9-4ca2-9bfd-097c894cfab7", "comment": "Malware payload (Dridex)", "value": "93c6e00c5ca17aa825c3a66ba9bfd3f7aa091b98", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212958, "uuid": "e0a81ae1-f515-4742-bdd7-adf8bd4d84e3", "comment": "Malware payload (Dridex)", "value": "8441e897038bddedfc7acc8199a896bfcbafb214eb529612e85cdc0ae0677b41d189f03616d8d35589d282112498345b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212958, "uuid": "b600da97-8142-4e17-9c96-f2f23c876e82", "value": "92248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212958, "uuid": "02cc2b52-73e2-41ca-b3a0-be0fcb51d600", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212958, "uuid": "ef2290d9-86f0-4030-84ba-dd414526f670", "value": "3072:I6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:IoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212958, "uuid": "be797786-298b-4f5b-bfa8-07bdec82af2f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212958, "uuid": "955dcd8e-a144-44f7-91c2-186490fbf020", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212958, "uuid": "bd3657b6-e1df-4a63-8a00-e9c0736e38aa", "value": "081b62edeecb68f10b469fd2ad07513a0e656f584be7419a48f0af7b96dcab07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dab65f1-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617195676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195676, "uuid": "9d59f804-86d6-4443-8a1b-282fe4a63ce3", "comment": "Malware payload (Vjw0rm)", "value": "145361c2733f4b003d97872e8de7773f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195676, "uuid": "d1aef4c9-f3d2-4351-bc55-d2cfb4b1a8c5", "comment": "Malware payload (Vjw0rm)", "value": "085dba2eb623a4b4601798c155e00d3ddcc8148b7c6816fb4c6b4d3c644ef4bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195676, "uuid": "ab51c154-665d-480f-9ab6-386eb8cf02db", "comment": "Malware payload (Vjw0rm)", "value": "f9358104397da247b471629c6fd97300e02354e1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195676, "uuid": "25f36fb2-45f4-44b9-982f-c3ee9a26ab4f", "comment": "Malware payload (Vjw0rm)", "value": "5f59291617f6423ecff7e8f10d78ae29e3ee3e7c65823477456b269b97fdb8fdb18499e8db3c3a5514a887fb53fac2ed", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195676, "uuid": "b086f19c-4a03-4366-88d1-078afb79d6e5", "value": "5B92E1842B155B3AE1A56E35C3632D9AC732897B235F8113CA3CEE7D8D2B24049BD91D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195676, "uuid": "ed2e2d9e-1d25-4c2d-9c36-e3a6040282c1", "value": "384:bXaf/YrhElazyeU6hv0+i78EUXTS4NOA5LgzG6EVy3Qn47TtTs:bXLSlQyeU6Z1ZNB5LgzG6EB4fBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195676, "uuid": "24255d32-1afb-4072-af34-134a383599f1", "value": 19912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195676, "uuid": "4dc02186-11f7-4466-84bd-15945cf618df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195676, "uuid": "7c04e372-f3e0-465a-b69c-47cee6d0deb0", "value": "CLAIMS TRANSACTIONS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641a3dc1-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212947, "uuid": "9e43d1ce-63a8-49d7-8bd2-275d5f645553", "comment": "Malware payload (Dridex)", "value": "71debd149e88d08f98276a65d22435ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212947, "uuid": "f59c6bd3-056f-4b98-8aa0-e90ceec35708", "comment": "Malware payload (Dridex)", "value": "08d8e6428ac19ae411db38b09e445ac6b92f16ddc2b0fee69d8ccf8bf3a4a46a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212947, "uuid": "4c8dcc84-c1df-49b7-8df8-1d801c3f9ce3", "comment": "Malware payload (Dridex)", "value": "22dada18f1761c8f6e111803b286cb4792609757", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212947, "uuid": "462b4b82-5331-4905-a36b-7d8349c151fb", "comment": "Malware payload (Dridex)", "value": "9cd4ba699d671a08966ac48d1b3103df112f6a25ef79d6b48118fefb3b0e2cbb9075b1a02536aea8a5922a75268ffb9c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212947, "uuid": "e6e114ea-a606-47fa-9bcb-e6cb5f1548be", "value": "2514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212947, "uuid": "dee8fabc-b4b3-421e-8a1c-9f7f98343bd9", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212947, "uuid": "1a33bec9-dacf-47a6-b41e-1c911e80c0dc", "value": "3072:Vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:6pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212947, "uuid": "cc78a776-be1a-4d86-a99c-17c6baeaaac3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212947, "uuid": "39dd80ad-47fb-4eed-8eee-7a85da87285d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212947, "uuid": "56e3f7df-f549-4678-9653-573e7d8eecde", "value": "r2InpX42nh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a19021a-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202112, "uuid": "03b6d183-002f-4601-b7d2-9413c47d8393", "comment": "Malware payload (IcedID)", "value": "b6b7b042b108d11d63395567157e4625", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202112, "uuid": "e4f4e9b3-d9f4-4468-b356-c3825091a27a", "comment": "Malware payload (IcedID)", "value": "08e37d7cce350f62be54ab703d66e482bbebe881ce1e70c352146c7dc3ee0ca0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202112, "uuid": "7fce51d9-3889-415a-957b-a61bbb2dea75", "comment": "Malware payload (IcedID)", "value": "19bffdd28d450084996684b07098ca5c95f05435", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202112, "uuid": "0eb9824f-c7fe-47f0-a5f9-2e6a36cbd4fd", "comment": "Malware payload (IcedID)", "value": "eaf8449a6da5011ab7a5af506bef590da27024fa5b0fa41a700ec186e43392d1fbce7a6ca95b81b3eb059c5dfa988abf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202112, "uuid": "385b847c-8925-4654-a7e0-75d9e4b9b512", "value": "ECB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202112, "uuid": "66384107-3f80-4d52-b84f-c0dca5da7775", "value": "3072:m2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:mqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202112, "uuid": "6711f62a-ce8f-4240-9e71-93d80288d648", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202112, "uuid": "c84bb787-7c5e-4259-83b9-fe93f6f51b58", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202112, "uuid": "de3731ca-60e2-4a9d-8fcf-abd9bb748caf", "value": "document-98364281.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144a0553-9231-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202505, "uuid": "e4c1f74f-84f4-4f34-86f5-165c9a0b228c", "comment": "Malware payload (IcedID)", "value": "5a226c3b24cdd99999c24f29104e947f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202505, "uuid": "57893fad-a2a8-42d1-af4f-39a41d694d48", "comment": "Malware payload (IcedID)", "value": "092f415cb127d6a7fd1e3e6643bc20bb8b0ead9c2f8d36707bf8e624592739f2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202505, "uuid": "3c4480d2-9a6c-47a5-863c-10ba25d465f0", "comment": "Malware payload (IcedID)", "value": "709651e7a3ec608675d1801cd7913077a0afc8f4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202505, "uuid": "74b863c3-ad79-4cad-89d9-36d3db10501a", "comment": "Malware payload (IcedID)", "value": "54a441b1423ce3cbde2c287eaa7c19b90f88ba2d43cba3c1d344b29f9947fc838e25f6cede18a406a45ccb0bb79a3c74", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202505, "uuid": "87c3c7cb-5c2f-4978-9eaa-d13a40da64a8", "value": "2CB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202505, "uuid": "bd9684fd-76d7-4f62-917c-dc00e8476415", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202505, "uuid": "24cf22b5-112a-4191-8b51-6a3cc28352f5", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202505, "uuid": "f63aeec6-b5be-4545-9dee-04724c923ae1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202505, "uuid": "12a22f57-e3fa-46a7-8e06-7c1809792afd", "value": "document-602226512.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe913def-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218360, "uuid": "20f2e6d1-dbd7-499f-a9d7-52e1b5017a51", "comment": "Malware payload (Dridex)", "value": "2a787a313d3a7ac9b60dc9f9dbe716fd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218360, "uuid": "ac8fa246-792a-4347-a9b5-ae6c85664a5a", "comment": "Malware payload (Dridex)", "value": "09362d6f15776a51eeda9d502cfbf3f42ca6d3741e9713278660cbb7a8be6f5f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218360, "uuid": "51a77da0-9acf-4e8e-9b07-a84b23969852", "comment": "Malware payload (Dridex)", "value": "94f73a23aa235f70fdb511c3bbcb47b80e643c6d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218360, "uuid": "32f01f77-5167-437b-b604-4297f82bb8a6", "comment": "Malware payload (Dridex)", "value": "5b28cbdefa38a20bc190f712454a5d09a6fbcf614a2e6fc0c0db6f0f6f6cf5c780221c2c96e07148ffa80221f0887aea", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218360, "uuid": "fb48ff99-1d62-49c4-9290-48aa8470c7ee", "value": "0614BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218360, "uuid": "d38c3397-bfbb-4fa6-9846-e7b090c6eab3", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218360, "uuid": "6ba5c3b2-c357-4360-af51-d9ce1702be61", "value": "3072:Gopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ZpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218360, "uuid": "e61e8977-6eb3-4890-895f-012c65fffa76", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218360, "uuid": "50af2e2a-dfa3-4352-8d09-50c6f96465de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218360, "uuid": "2ef35f37-a670-4953-8038-266b6d4190a0", "value": "09362d6f15776a51eeda9d502cfbf3f42ca6d3741e9713278660cbb7a8be6f5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4b678b-91d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160997, "uuid": "c25ef6e3-7d89-4e4b-8514-7e2ab61a90dc", "comment": "Malware payload (IcedID)", "value": "980514e179574a0f28199e682935ac34", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160997, "uuid": "b081660d-5d87-47b2-9d07-dd99d430b6c8", "comment": "Malware payload (IcedID)", "value": "09e772572a52821176c06f18cbe5bb6f9a90b9dd67588f589bc77e0675d8cbe2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160997, "uuid": "711a30b1-533e-40d8-b7ba-b5d16e0ad9a3", "comment": "Malware payload (IcedID)", "value": "2fed431c83a05c493ea7346a6b5d5eba6bbd0fb0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160997, "uuid": "b445ca62-4a3a-4ec9-90a2-251d3452ddfc", "comment": "Malware payload (IcedID)", "value": "9ccbbb67aba46836b427ac10ba4d47d32c136b1c9c20fc570e18daac2ad13e71ac1610931da805674b697d64bd403984", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160997, "uuid": "c6807393-2b81-4c3f-b672-3859608349b1", "value": "D5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160997, "uuid": "8469b7d0-1d9b-4867-96bd-fa70100a8630", "value": "3072:S2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:SzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160997, "uuid": "182dda39-b197-4536-a8e7-c07c4031b932", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160997, "uuid": "35b50dfd-d5c3-4646-944d-db9fc20747d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160997, "uuid": "ec7cbd8f-b2d8-480e-995e-c59f26f617ae", "value": "document-597986020.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d7cf06-9261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223142, "uuid": "4891c99e-15e6-4799-9293-f50015768e3a", "comment": "Malware payload (Dridex)", "value": "ac5369481c71142b06f8af4d07988378", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223142, "uuid": "6bf7d59f-c2c2-4c48-ad30-60a43d381456", "comment": "Malware payload (Dridex)", "value": "0a3debbaf95a6dbd863159d9e854be928878f00b86a46f213945e7199682d788", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223142, "uuid": "1c5c3a37-450b-4f2a-88fc-f960b7ab6aac", "comment": "Malware payload (Dridex)", "value": "b7286101f5d20a5d19c7ddf51a72952d384352ad", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223142, "uuid": "ae7e50d1-a095-499d-b412-cdaf3853a588", "comment": "Malware payload (Dridex)", "value": "1a0a0bf79077b63f3abf5415aa42bc7a7bcb0bd9fb47547b21b859af2f88950adcd869b40f739c68811e1178a06a2936", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223142, "uuid": "c6100c93-efb2-464d-b721-4666c404e7a6", "value": "83248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223142, "uuid": "c77dd368-78d1-420d-b4f6-4555d1915c83", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223142, "uuid": "5cc1e280-d678-4faa-9fd1-8ba696f4ef87", "value": "3072:d6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:doMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223142, "uuid": "ca72df8c-6532-48dc-9d35-b6be79f5d4d3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223142, "uuid": "8fa253e2-5da8-4906-a04f-06d50bb3041c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223142, "uuid": "304ff9d9-86bd-4b93-aa6d-084b781c5bf1", "value": "0a3debbaf95a6dbd863159d9e854be928878f00b86a46f213945e7199682d788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3c369d-9232-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617203082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203082, "uuid": "01f8db6e-2e7a-4b4b-ab59-58d995b8c195", "comment": "Malware payload (IcedID)", "value": "508b8863d2ec32d61520a079e4c963e2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203082, "uuid": "9194a135-3d6c-4015-b603-8114bf9e69af", "comment": "Malware payload (IcedID)", "value": "0a581a3594f050a6bfb15ff48c229a00d436bbda3ba2188d39d94fc8a8192f80", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203082, "uuid": "3f6dccda-4461-40b6-a2eb-0516d4b2acc4", "comment": "Malware payload (IcedID)", "value": "fa617808fc2d6e27fd6b600177560fffd586973c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203082, "uuid": "d7f2c076-64b8-4aca-8c24-d07ba3dcfa2f", "comment": "Malware payload (IcedID)", "value": "95a9a1c848f001b4c25c35b46b07cd29a08e6a5d38e10b85ab6bb55b2d4e8afbfcc081804ec48dff1b2bc33e4f0115e6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203082, "uuid": "e45db7e3-7dd9-4bbb-a617-9cad84935159", "value": "A4B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203082, "uuid": "8938100f-18fc-403d-accf-aefb5546fa87", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203082, "uuid": "abbe47d8-5351-4e06-a14f-00acb92e36d0", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203082, "uuid": "94a069e8-25bb-4412-b6d6-08cdc81ff696", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203082, "uuid": "9b534c3a-71e2-491f-8800-cceef77fa2c1", "value": "document-163642378.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a19627-922e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617201294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201294, "uuid": "ae015793-7f74-4740-b69e-1c14f1d691b2", "comment": "Malware payload (Dridex)", "value": "a68980c620d276184f14e65d5c5eaea6", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201294, "uuid": "31b3c680-b233-4bda-bc76-45da896ea4e7", "comment": "Malware payload (Dridex)", "value": "0aedf995ba27ea387f28090ebda110ec4394b35e1aa33ea2ea6031af7c6d0949", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201294, "uuid": "3fc32c34-e61e-48a7-9c98-1acf15045e3a", "comment": "Malware payload (Dridex)", "value": "e0091293dff8aa819db9989e6c8a2a8ee3a7282c", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201294, "uuid": "ca7318cd-13d2-47d2-95f4-1b90190bd4a6", "comment": "Malware payload (Dridex)", "value": "8611bb35bc1d7dc5141cebd4114c4c8ca41fb8b9b791daa777843285932c5579ab8e12774a39d513082f74b93f9405d2", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201294, "uuid": "2e0cba5b-0150-4a46-853c-eca29f2a1b1f", "value": "4984DF42EAD54431EB726F3808738B514BEF79D18E308CABA29C205D1F676D0567CB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201294, "uuid": "d6772792-8ec8-46de-9268-7b3a475e3dda", "value": "f80d389dfa6eb310b9592775bddbb2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201294, "uuid": "3864aec8-a981-42fb-be3e-c01a6f0f4fdc", "value": "6144:FCyziuGu+B0VlPM+iHlDx7YVUggVSkMObhe+UqN2oCh5pGWN+zT:QYiu06/iHlDx7YG7RTIZQFi5p9uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617201294, "uuid": "9b903abb-035d-4218-acc6-097fff9ae3bc", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617201294, "uuid": "7a1e8360-bad5-4ffb-8529-20bbe9360e2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201294, "uuid": "7b320573-abd8-4b4d-a2dc-73a0f36a719a", "value": "0aedf995ba27ea387f28090ebda110ec4394b35e1aa33ea2ea6031af7c6d0949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326d04a9-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163471, "uuid": "a850bb81-d208-41a5-bfc2-a0fb943fd50c", "comment": "Malware payload (IcedID)", "value": "ef52777a4ac87da981a8e7d87d6cdc8d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163471, "uuid": "6ec42b29-bae2-438b-8ad7-38aa318f2dd9", "comment": "Malware payload (IcedID)", "value": "0af5f7de389b62ddaf32683eeb9dd892e72fe796b1056f922f33fd081b79df7a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163471, "uuid": "2d2ae3e9-ddd0-40e6-92a9-19e7d2d0513b", "comment": "Malware payload (IcedID)", "value": "858239235c80ae8eeaa719cc26f2285ec5a238b1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163471, "uuid": "ab57677e-24f6-4a4e-a078-4c2360066d7b", "comment": "Malware payload (IcedID)", "value": "d8b16ad0f0c1f23a804773fe90b7a49d3b14ff866cc292b5d3a1b4b883694a43745fc78a2d392a33b04e91e42e9bc2e9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163471, "uuid": "1786cd2b-1671-4c9a-a81a-8a0cf3aff907", "value": "72B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163471, "uuid": "298df4a1-9706-4735-8451-5edb69877c24", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163471, "uuid": "adb50293-1392-4ad1-98bf-6740eb383df0", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163471, "uuid": "e1773139-4ce8-4a41-a659-fd67f4177685", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163471, "uuid": "7095367f-22cf-4f4f-856e-0b4a3b88d2df", "value": "document-116305046.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdba001-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232504, "uuid": "8d0cc6c8-76ad-4ff8-8da5-7aba7d41de6a", "comment": "Malware payload", "value": "3f8510e27d140927e6894f0a7388c619", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232504, "uuid": "49605e0a-d843-4b47-8624-7e14be8c3ffc", "comment": "Malware payload", "value": "0b3c0870b3b720253b751094308cb9b7f1e35d9e042f2ab53236972be8ba0892", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232504, "uuid": "7d26804d-8111-43d8-9641-9436356d4360", "comment": "Malware payload", "value": "e6db57ff96a2ef0b7a345b45f4720b0ea1f80864", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232504, "uuid": "2ed9351e-5e17-499b-97b5-ba0e8a84e669", "comment": "Malware payload", "value": "cac972391cab17ba4c417c44c810b371e862671ed3153fbc948a4b52cbbcc4c5db158d14ede58f8faaa1acd3e55ada8e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232504, "uuid": "48fb6e03-3faf-4c01-9a26-99d7e5b2d241", "value": "1014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232504, "uuid": "e34788ac-b29c-4225-a083-592624807216", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232504, "uuid": "39de8c87-8c0a-4369-babe-db0c566c4fb6", "value": "3072:Bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:WpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232504, "uuid": "1b90c98f-0964-43c1-aba9-77d9c9725faa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232504, "uuid": "78eb1b89-3193-4153-b128-0c2e9e9bffc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232504, "uuid": "e050eec2-60e8-421b-8e3b-03b41539400a", "value": "0b3c0870b3b720253b751094308cb9b7f1e35d9e042f2ab53236972be8ba0892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6188d8e9-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212943, "uuid": "a07ca550-04d7-4e9b-a633-5f7c6ea9c511", "comment": "Malware payload (Dridex)", "value": "6fa866097afa366da0dc368686951914", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212943, "uuid": "b6c78c6e-340a-4592-9d1f-9c7339b399ee", "comment": "Malware payload (Dridex)", "value": "0b5b357a7bf53e8c503cd3ee509db054f2c6de351d58d7a80a101c8f41a13e93", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212943, "uuid": "5309d620-40bd-4342-adcc-d109a59b5f68", "comment": "Malware payload (Dridex)", "value": "f8c8038c4cd7b2a2a6b665e4a4b1ea2f818fa70e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212943, "uuid": "0b697b5a-3a98-4454-9d7d-e152f33ef3cb", "comment": "Malware payload (Dridex)", "value": "f5f09e5ca1cea335cfb6ad5a69aa128c497e509139b08fecb532d8ad1b6715cb1468ec674337633bb506d5302ced2156", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212943, "uuid": "2aa72a2e-df53-4679-9129-78176e176f27", "value": "C4248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212943, "uuid": "78b574de-1230-46c9-bb05-2e539b7b943b", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212943, "uuid": "f0302c36-3886-4ef1-a9e7-f7cb3ba22a5b", "value": "3072:66TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:6oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212943, "uuid": "916b909d-4189-4ed4-816a-1572ca6a539d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212943, "uuid": "9c03cea8-0a47-47d9-acbb-588eec933433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212943, "uuid": "f3fa6d19-b540-47bd-a0dc-9f3534f34dbc", "value": "0b5b357a7bf53e8c503cd3ee509db054f2c6de351d58d7a80a101c8f41a13e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35027245-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163476, "uuid": "71063ab9-eb7e-4a01-acae-cea9421925b9", "comment": "Malware payload (IcedID)", "value": "f29c11faf5de1bda47b23ae3de4d4cf1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163476, "uuid": "9e4fda9b-4021-407e-843a-92c699c06377", "comment": "Malware payload (IcedID)", "value": "0b8586e73348e68e88d6999dffd0c7ab6604fcfbfab69ca5caf2abbdd3661487", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163476, "uuid": "9dc05833-dcea-4826-ad74-009612e3ff66", "comment": "Malware payload (IcedID)", "value": "01ee0482168f1c2a5078cd4c5a46d02e9a85dc0f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163476, "uuid": "920ce49a-8bdd-4b0b-8d78-9a8ed797cf66", "comment": "Malware payload (IcedID)", "value": "726ca079f81a62f1903d30b79b5066887380980a49ef99aed14f651b8f4d31a47d6f0fe8f9616fae779d079f6ec5d802", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163476, "uuid": "6ecbfbf3-1683-4bd2-9610-7ac2fc2ba3cc", "value": "8BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163476, "uuid": "630d2137-a293-47db-9c0e-1e6d38c9ef8f", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163476, "uuid": "645a8c8a-98f4-480d-9a43-2140e22a9c82", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163476, "uuid": "93793bfa-b032-4e35-b8c6-2ac21dc58974", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163476, "uuid": "ef8ee456-ed77-4edd-8aa4-0120801f0159", "value": "document-385112319.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70db7abc-9269-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226712, "uuid": "768d5f51-cea9-4ae1-9c1c-53f9965923b3", "comment": "Malware payload", "value": "4898d8071e1811062291c6b36496520f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226712, "uuid": "2df0f586-2c24-4e87-a2a1-311121d80791", "comment": "Malware payload", "value": "0b8b5b937d1e05dfb6f9f094fe6a4dc96fcc8d22c9c483914e20a40cd78305fa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226712, "uuid": "308ffe54-3349-4c9c-ba43-d5ac92b192f5", "comment": "Malware payload", "value": "fa987c92b90d7bbb8528263f4ad79bcf1e278eed", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226712, "uuid": "6e41c1be-da69-451e-acb8-f88ca6b32a93", "comment": "Malware payload", "value": "92d19337436a958a6a0745c6c46b656c4f6bff089e3a2176aee845c18b6d226cac3fb9e63425fa4785ce3b47b6ad14bb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226712, "uuid": "1c99c612-c381-456e-b199-574d66cd8f7a", "value": "4C248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226712, "uuid": "ef8078e8-0433-427f-b4fa-cec28756ceea", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226712, "uuid": "4b9fa227-be0c-4932-b42b-5d2ed3044674", "value": "3072:G6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:GoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226712, "uuid": "d276dd8a-00ec-4436-b366-c24d30f7d35c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226712, "uuid": "d22997e6-8c4a-4d75-843d-ceb6a055b5a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226712, "uuid": "5f7b9d17-4599-4888-9497-49a57ce8bb06", "value": "0b8b5b937d1e05dfb6f9f094fe6a4dc96fcc8d22c9c483914e20a40cd78305fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857b14e4-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218157, "uuid": "321b7aa9-754a-40d9-b674-1d0cedffaba7", "comment": "Malware payload (Dridex)", "value": "ab95042584b17573daa92dc7ee865632", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218157, "uuid": "2eab42c8-3fd9-43de-b5a2-81198ec860d1", "comment": "Malware payload (Dridex)", "value": "0c61ff5abb630e2f38a6a95a4a6f665e7b6b2146b2da8a978b79ca9e38f575fe", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218157, "uuid": "a514a697-a279-4110-b3f8-a0a7a2826064", "comment": "Malware payload (Dridex)", "value": "373f613145f26f0159bf8ae9807997a66d133694", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218157, "uuid": "0fc4225c-76de-4d35-b061-1bb75ad4ac15", "comment": "Malware payload (Dridex)", "value": "8575caeb5746c9d05533fc0f1bd9a3016e2833093434871d52fc840923cffe54b6359cbf8b49bb1a0007a7b6f6b92cc5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218157, "uuid": "6b539dfa-c310-48c6-800d-a9d989fd4cc3", "value": "5414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218157, "uuid": "6a71cf36-3b98-4a3b-9a59-5d7bd409b2ed", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218157, "uuid": "f9fd85a3-2315-4575-9b11-d84fee7c62ba", "value": "3072:oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:fpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218157, "uuid": "bfa55c98-8db6-45b0-b59f-1a50fef3ccf7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218157, "uuid": "a15d597f-7232-4248-a7cc-3f02873af69d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218157, "uuid": "3b72904f-96d0-49ab-886f-40009d639bef", "value": "0c61ff5abb630e2f38a6a95a4a6f665e7b6b2146b2da8a978b79ca9e38f575fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94603dea-91d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617164065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164065, "uuid": "e0cd17bc-0d0b-49cf-9fea-c32095bb957a", "comment": "Malware payload (Dridex)", "value": "c05c769f48cdf5ed7b473893cccd4628", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164065, "uuid": "06af6c36-ba47-4b3c-bf67-9af98971bbae", "comment": "Malware payload (Dridex)", "value": "0c8c1b837c180f85bc0d34228ca4bc9ce756db8352165bc15ff10b0494630d40", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164065, "uuid": "5b46938b-15ae-41df-8693-603f6d6068dc", "comment": "Malware payload (Dridex)", "value": "28c8919032db8f89c0e05821e3517df410bf03bc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164065, "uuid": "0ab59475-d944-4bd2-892e-b9f73df0c8c8", "comment": "Malware payload (Dridex)", "value": "beb1e309b6d0c63c3fe2c7aa9d919c039ea20f14d1cbde7f902be1b6b86403a72de6d5167c002e1c140491c04cb9f83c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164065, "uuid": "840c1fe1-ba1a-417f-8488-7cddd9c91571", "value": "7114BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164065, "uuid": "c8bd7d9d-c69e-4e14-afec-3e9c16fe4079", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164065, "uuid": "61fcd7dc-082a-41dd-8d35-cb91ad128ee0", "value": "3072:C3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:mJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617164065, "uuid": "bd1b9940-2489-462c-889b-083a4c5f8563", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617164065, "uuid": "2388c937-26f6-4f06-a077-ba887a755366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164065, "uuid": "06a440fd-af17-46e3-a517-9daf58bb5896", "value": "0c8c1b837c180f85bc0d34228ca4bc9ce756db8352165bc15ff10b0494630d40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf9149b-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160749, "uuid": "7cd78dbc-aeca-4fc2-8ea1-eae0f9ea1f46", "comment": "Malware payload (IcedID)", "value": "8ec427f33d460c2e23c7de84c4f5d0da", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160749, "uuid": "e8b4f8e2-039b-4847-a840-98e0d6e3ef8e", "comment": "Malware payload (IcedID)", "value": "0ca422c9afbbba50e6f7b29d8f8931b6838e2b1f5262159f9ead0ec2300ced81", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160749, "uuid": "19d33e50-adde-43e5-b8cf-5ce5cad50f94", "comment": "Malware payload (IcedID)", "value": "85df7a2064569abd6f9c7f26eabff48e0faabad8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160749, "uuid": "2113a5c1-ac2a-48e1-adc4-1849ab2df08a", "comment": "Malware payload (IcedID)", "value": "5dd1d22d6cf2e80aef8875d2aa2d7f94a1b52a108d66ec09d1e5c0411dcdf39b0238a1c11a5d233c0c34d59c1cd46377", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160749, "uuid": "0d8b0884-288c-44de-b964-9f491bc8f78c", "value": "F5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160749, "uuid": "95cad1d3-c95d-4421-8957-06c7ca2767c4", "value": "3072:e2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ezxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160749, "uuid": "58817a79-6d9b-4b53-b4f0-e9b53a686a52", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160749, "uuid": "b91aa56c-abe3-4a3a-b505-d42800e42817", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160749, "uuid": "8a70c986-373f-428e-8d07-0130d3351f28", "value": "document-1411822550.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd23c78c-9269-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226894, "uuid": "3f244b0e-698f-480a-87e8-27daa1144678", "comment": "Malware payload", "value": "9af6ca80d7fcc02674ab9aa6f048d495", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226894, "uuid": "6fb84afd-85d3-4de9-a88a-2107aa276210", "comment": "Malware payload", "value": "0cf187b4e45b6826806995579f76b972b364ec1d4025bb68f52dd5b6eae6ee76", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226894, "uuid": "9a0dd96e-0baa-42c5-9e6e-19557a5697dd", "comment": "Malware payload", "value": "82d65ebf005ce93b01de297f2f0a8f6e159b10c7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226894, "uuid": "d88217f7-a4e2-4fe7-81e4-4c336ac7ca1e", "comment": "Malware payload", "value": "a96a78ceface710757680576768f18af2f16d8f0dc56e5b63597f752d273ec258f169023faaa93278fc0f84ad7e44fe5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226894, "uuid": "899545f3-5243-4ee2-baee-6dc86b76f6d4", "value": "B5248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226894, "uuid": "b0c973a8-8453-460d-ae99-adff352ab394", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226894, "uuid": "c5f0af80-d647-4cad-b4ab-918a6b887609", "value": "3072:I6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:IoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226894, "uuid": "25c9ca34-a889-40c7-8827-aaaf9dd2bc81", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226894, "uuid": "52100a26-e9ee-4ddc-8370-f5675b14b7e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226894, "uuid": "9d514def-a91a-4255-ad1d-5dd3b3fbc943", "value": "0cf187b4e45b6826806995579f76b972b364ec1d4025bb68f52dd5b6eae6ee76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a385b5c4-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199309, "uuid": "0466f521-6ba2-4e17-97fe-a7a11aaf46c2", "comment": "Malware payload (IcedID)", "value": "43f9d52279701f4809643255c919b4b5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199309, "uuid": "39675fd4-d0db-4dd2-af52-92be8c03262c", "comment": "Malware payload (IcedID)", "value": "0d2c8d4002b6c26b76f338ebd8573d2e0d0028cf788309b7b7a6b761455b248b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199309, "uuid": "1ede4f99-34cf-4c87-879e-e56cb5deca7f", "comment": "Malware payload (IcedID)", "value": "6ccc10674c770a9772c9f1638d0a88208cb1d0e1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199309, "uuid": "8e51b4a8-4e2f-47cd-a544-52ed5e8b0267", "comment": "Malware payload (IcedID)", "value": "230d81518895373a54a65a3e9a9b44868a22be7e15e86d53ed6115eb849edcddcf7526c9afceeaab2f6c4dbc307dc4be", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199309, "uuid": "bc2ad788-2669-4829-8b3c-0cab657a271b", "value": "69B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199309, "uuid": "2709e190-d889-4207-b4a7-c7f52eb1422f", "value": "3072:k2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:kqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199309, "uuid": "e44e1fb3-2468-49d6-8839-ae7daed32bbb", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199309, "uuid": "5ee359b6-dd04-4576-a314-641d39b9f6b4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199309, "uuid": "b85075da-4569-411d-8c5a-833c24740cac", "value": "document-306461174.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4861cc-91cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159789, "uuid": "6341f5b5-586f-4729-ba1b-4e13c9fcdca2", "comment": "Malware payload (IcedID)", "value": "6f44638d50efcd6f5a77a5a3dda83c19", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159789, "uuid": "5155c017-8713-4b66-8fe8-ab88b0753eef", "comment": "Malware payload (IcedID)", "value": "0d3d96401c337e160ee1ec9527c0ec6b7f348d0af760e50ea75314b727e8598f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159789, "uuid": "d8c68a80-ed29-4b82-a152-063f802c8fbe", "comment": "Malware payload (IcedID)", "value": "baea57f41e25cbe9feef4be2d7960a96cc5b7d28", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159789, "uuid": "ba90ea97-e975-4e60-9707-d5e9c7b1aba1", "comment": "Malware payload (IcedID)", "value": "0dac9a2b0c7476a932e1dc0b66b78462894a3fd87f9e73a9ca4dd67836fd7667de64d01bbf28a81d010797a514d55492", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159789, "uuid": "c3fd195b-359c-4307-a704-00c4db3177ba", "value": "43B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159789, "uuid": "8da5acea-334c-4eb1-9581-63ff0e28559b", "value": "3072:i2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:izxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159789, "uuid": "1218eaad-3763-4628-932e-d5ed48f7a470", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159789, "uuid": "1bb4e933-b6d4-4126-b43c-ffb8afb2faa7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159789, "uuid": "df013462-fc3e-4440-ae1c-0ec5350002b7", "value": "document-2143367791.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea1c4e1-9269-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226950, "uuid": "4c21e10c-faaf-427f-a899-4a545e7236a3", "comment": "Malware payload", "value": "fade6c4432f500005ba17013750ad448", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226950, "uuid": "e90164f3-464c-4abb-a135-c5099c11fb11", "comment": "Malware payload", "value": "0d6db1d01deff1e20828dd960b4a03f1a5453542ac93c875713385b5c78deabe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226950, "uuid": "e0a26c1b-89d9-43a1-909c-4d0081e0677c", "comment": "Malware payload", "value": "68d9a795cfcd84b2ce9e4480bd63defd1351e3e4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226950, "uuid": "f2cfdeb2-1396-4315-8933-6c90f9171a9d", "comment": "Malware payload", "value": "e84d8cdd3cfe45878f918d0015cfd5a1b33abbda0cddd735a6a49bb35a2ea6c981cb0f45f8c89e074f29f380434d1ae5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226950, "uuid": "ec842288-70f0-4680-bd85-b04825d8339f", "value": "65248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226950, "uuid": "772c2f98-86e9-42c2-8683-83774420e6af", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226950, "uuid": "a8cd9c20-9e8d-45b6-894c-f02711c01629", "value": "3072:86TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:8oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226950, "uuid": "0c8d67d4-0f4b-4198-a2b1-05e936821642", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226950, "uuid": "ef0ffa4c-c658-4464-b38a-1ce9239dc1b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226950, "uuid": "691875c5-ad69-409f-aa2a-1924670a6441", "value": "0d6db1d01deff1e20828dd960b4a03f1a5453542ac93c875713385b5c78deabe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4111a05-9231-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202773, "uuid": "a4e46821-23ec-4886-bb61-7e2afde73b26", "comment": "Malware payload (IcedID)", "value": "2188b443a7d35feeec0b97436789013d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202773, "uuid": "751291e9-cfbc-4a9c-9580-e7d0d3ec2053", "comment": "Malware payload (IcedID)", "value": "0d93e0e10db3c46300af54abe5437e7b366f3a682991260cad2813989a45024b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202773, "uuid": "861c0e84-1339-49d8-bafc-dbb99c3055cb", "comment": "Malware payload (IcedID)", "value": "13cc6bff4bdd1095357c3af8a50659f0d31524cd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202773, "uuid": "36f6f58e-177a-4abc-8c4d-18c7c0886f52", "comment": "Malware payload (IcedID)", "value": "d5ebb9f26e13d0a6673abb700631e2788b3b277b8d9e4741a2ee4cc996ca10d75e7f86290fd8dd8fba4ba0cf0cf093a5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202773, "uuid": "351ac463-3744-4618-b4f2-00becbb38546", "value": "D0B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202773, "uuid": "85b04d5a-62ed-473a-8477-e042f2476ecc", "value": "3072:Y2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:YqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202773, "uuid": "23a263f5-45c9-4627-93a7-4731f1989048", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202773, "uuid": "f240416f-d3a6-4481-bef0-bca3e9c4ef54", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202773, "uuid": "696fd5ff-7ffa-4b27-87ed-bf13f0956831", "value": "document-649562845.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0d812d-926e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228848, "uuid": "cd21dd4e-138a-4e09-9401-b74113604ee2", "comment": "Malware payload", "value": "e218eacd7dc4ca857d6bc6478f807b3f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228848, "uuid": "6dce1d77-f23f-4f1e-82f0-155fc1849ab2", "comment": "Malware payload", "value": "0daef9d055a67e6ccb0b94d5167709b8712ded9facf0309318cfbe4cd642b1a5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228848, "uuid": "5cb1fcfe-b7e1-4793-892b-8ce0903997e6", "comment": "Malware payload", "value": "463304b0a5d093b7431e2654233216898edd6efd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228848, "uuid": "15f4a504-ad88-467b-a770-d03eba5a3b8d", "comment": "Malware payload", "value": "45e4556b1f4cbbe18f12c2efd639adb97cdc356214d237900bc1eb9608e173c7ca919a1e3db40566c847ec9b941732fc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228848, "uuid": "f0ed9ffc-dded-4a33-85de-fd4983afd4e0", "value": "5B248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228848, "uuid": "a0dc81f3-13f9-4a7a-8731-8c709ca9f7df", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228848, "uuid": "140af8ec-7b87-49a7-b50f-714c2867286b", "value": "3072:76TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:7oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228848, "uuid": "1860b9f8-053c-4018-8ab2-f48d3ad35dc5", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228848, "uuid": "26a209d8-3ec5-40d7-a211-4652264d9a53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228848, "uuid": "d08fe3d1-064d-4202-84a2-c639e937f1de", "value": "0daef9d055a67e6ccb0b94d5167709b8712ded9facf0309318cfbe4cd642b1a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb18e03-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222786, "uuid": "3cfe92f7-2248-42ac-8f9f-8cd8980ad511", "comment": "Malware payload (Dridex)", "value": "cabd9327df44c37149d41f585f3e7448", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222786, "uuid": "08b19122-b2c9-4f15-b7a4-7cd0d2d495c3", "comment": "Malware payload (Dridex)", "value": "0db41e279e1c544e418ca7dd8bb6548a67f3a0c3e042a0a309b4a1f990ae17ef", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222786, "uuid": "b95eb688-acd8-444e-8276-068e0c504bc1", "comment": "Malware payload (Dridex)", "value": "9f9305ed42ce6b140b4be75250d28354a872e753", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222786, "uuid": "62d0e81d-010a-48df-a3f7-8d2402ee5529", "comment": "Malware payload (Dridex)", "value": "43a264f6b8f9f97ca02886e952c2da790133b02b2c7b3ae06c10854b066261e2fe987a5216d95bc307e4b006782b2ef7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222786, "uuid": "50d3a95d-4ea6-4bbc-8f1f-8ed3d7b403e8", "value": "9B248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222786, "uuid": "7f5e6734-5fbe-4848-aa76-4fd4700c43dd", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222786, "uuid": "12b6f534-bea8-4ccb-a9bd-db5f603b2a43", "value": "3072:q6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:qoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222786, "uuid": "d95f0cda-9d2c-4ad2-8497-fbf0dc99cb23", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222786, "uuid": "2d01ff40-faaf-4597-9713-e7f8c44d752a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222786, "uuid": "0e764766-8023-4396-981e-7a77c272f28f", "value": "0db41e279e1c544e418ca7dd8bb6548a67f3a0c3e042a0a309b4a1f990ae17ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c833c9b-91d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161341, "uuid": "f31c89b4-33f9-45bc-86bd-f55f8269b941", "comment": "Malware payload (IcedID)", "value": "a5e99858b84ad8d107a558dae0babf87", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161341, "uuid": "99258694-3857-45b3-8c35-01080f9b085b", "comment": "Malware payload (IcedID)", "value": "0dcab78ae3ca178dda7ae3d81808075e1dee32d93039144a33f7a716d9afaef1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161341, "uuid": "7b59a941-551e-4f8f-9287-61ac77a27b15", "comment": "Malware payload (IcedID)", "value": "e1ba1b16709ae7c7a48df1f4ad9309d94bbf24ca", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161341, "uuid": "66438a72-8e5d-4c7d-9aa7-995cb9893d6a", "comment": "Malware payload (IcedID)", "value": "6b53285114498602b53456c83d84045623138968cc0844508f3e7c15f8b84a4f24895936468706ad55029d7c3f5e4803", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161341, "uuid": "11f60b6b-0a46-4fa5-903a-bd3969ea93aa", "value": "FCB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161341, "uuid": "d7fc2980-9984-42d6-bd41-a235e917722a", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161341, "uuid": "fd6448be-1923-48dc-b391-5f92985c964a", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161341, "uuid": "8a90eeb2-98f8-4ebc-ac87-2e1e25587e47", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161341, "uuid": "b2158b6b-4135-4b31-b318-a63ecc68222f", "value": "document-891864908.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203a5a60-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160434, "uuid": "5eb3c95c-dcf4-48ab-9ebb-fb871a544fd4", "comment": "Malware payload (IcedID)", "value": "63461069113fa1f20913c15e588fb6a4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160434, "uuid": "8ec39611-b5f0-4804-a963-71abeb35f23d", "comment": "Malware payload (IcedID)", "value": "0e23c7f26a8c1b98204d6c886a925d5bfd204bf37ec7a1c19397f1df38928f7c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160434, "uuid": "b2cbc60f-5002-405a-8d93-10d130dd0e8e", "comment": "Malware payload (IcedID)", "value": "bf9299c0b111c4fdd16afd88c266a03d25e42283", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160434, "uuid": "cc2fdb5e-d732-4996-9b02-68a6090aaca3", "comment": "Malware payload (IcedID)", "value": "782fde23fcaa5de5289b1a9ae48c79c6df1a679c21e311596c5687c22c0f03e6a1d11cef702fea3da05cbd6eab417566", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160434, "uuid": "4f425cd7-2c50-4145-8077-68f8b4c0334b", "value": "D9B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160434, "uuid": "b3809959-21a9-4690-8f8a-b1b100731683", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160434, "uuid": "074580eb-6333-4a43-a3a3-efb52213999a", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160434, "uuid": "61481cb3-9416-46b7-9929-fc849ffe51af", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160434, "uuid": "bc11e5e0-6c6b-4f38-8cc6-a41e00956a98", "value": "document-866593537.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8d9b1c-91e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617171273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171273, "uuid": "b2dd9996-62e3-4e90-85bf-d89dd1241f15", "comment": "Malware payload", "value": "481c131f35e1dabc4448ac72e941d51e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171273, "uuid": "ff271c23-b92e-4729-b54c-fa9912e50e00", "comment": "Malware payload", "value": "0e459b3c453d79eb7f8a5278f8365e8c0e5dc0f7e57553ed7edf6b44212e768c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171273, "uuid": "0219da15-41e0-4a5b-b81f-fef0396ceda0", "comment": "Malware payload", "value": "5ccd740e5828c4af04b402ac063f85b2e7f73706", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171273, "uuid": "c069b77a-c903-4897-bc9b-c8f33b8f4692", "comment": "Malware payload", "value": "0baeef555b42882975ee6acac2f921aa3a2bd2f4d4e304ae748f46223eb0b55ab50b1034c113d7a2a4a58b509a1bed40", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171273, "uuid": "48f90a7d-60ad-467b-ba14-3bba7c663764", "value": "55225C69C641EC3AC216493EE05805F5FB1C1192A593787B614DB19E47A0293CB9F2FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171273, "uuid": "964ffb7d-985b-4979-bcb7-4dd3d68de171", "value": "192:ScIMmtPCmHqqG/bYx3+zgkD6/JgiuQ3Tgqp:SPXqmsSi5D8J79T/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171273, "uuid": "1cfd1b77-a9a5-4260-9af5-9289c2416491", "value": 10341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171273, "uuid": "4feb7e42-adc6-483f-ac9c-a230de893996", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171273, "uuid": "ca2a4e67-5e85-4b23-8467-028c358c6145", "value": "order1562.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d928a7e-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617218063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218063, "uuid": "35b99ef8-ea66-4e02-ad0e-3f4be1a1b48e", "comment": "Malware payload (IcedID)", "value": "949378220efeb4a2ffb96367e4fd9e98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218063, "uuid": "a7fb8c52-03ab-45c9-a2a7-3caa84eb64b9", "comment": "Malware payload (IcedID)", "value": "0e83c4eaf4cb50e296bab7738221164b6866ec623d7fee90382c0cc2587c4464", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218063, "uuid": "b24bb2af-5446-464f-93ee-3b5cbe1c78d6", "comment": "Malware payload (IcedID)", "value": "5b174df7f8e21bebc47da1594cb6524252226c84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218063, "uuid": "cb73afb1-f87d-494b-aa98-c44c95bfa0c3", "comment": "Malware payload (IcedID)", "value": "edee71c4cdf982b97667594aeb9c721148ecbb12db09d0be705c70b151dbdbb1fc580f4cc74a76683be379c006c81aa7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218063, "uuid": "c77b91a5-05fa-4b33-becb-375c196abfc4", "value": "E2437CCAC9B20663C536A971C2F12B18D122B760F393AAFBD1483365C1426D0DB737A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218063, "uuid": "473bac8d-3459-4157-9c9c-7f05b5d4d17a", "value": "1536:MhQeEn2s56EdRX096SioHkvr+LlXpFyrEU:MqRjH0Eptvr+FzxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218063, "uuid": "ea14e110-f424-4f24-85b3-29f49f36f33d", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218063, "uuid": "c9549bc1-f502-4220-8250-349fe42dcf6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218063, "uuid": "47059658-020b-43c9-9175-bedb74cf457e", "value": "949378220efeb4a2ffb96367e4fd9e98.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf49d1e3-9257-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219113, "uuid": "bddcece7-a354-427e-8e1a-e5e620b20b95", "comment": "Malware payload (Dridex)", "value": "b3dc91132a8e3509db6c843133f56758", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219113, "uuid": "94e458f0-9df3-46db-b4a3-7933cf170ba1", "comment": "Malware payload (Dridex)", "value": "0e97d5881d48b10d1dbc90b167d223feea49061164547b45a870f51e777eaa93", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219113, "uuid": "79da2dd7-5e4a-4598-9c07-07d1ae1b450a", "comment": "Malware payload (Dridex)", "value": "72073ee0d633fe10f4984ee3a6ec9e1c4d9da5f1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219113, "uuid": "b2076576-3c8f-4af0-91db-8c2d918d59c6", "comment": "Malware payload (Dridex)", "value": "80686b793cd11234c527a567a3ff733d42db718cecace9c196641d99961c5cad6f716865e8bf4d7b5c915d8118d7de20", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219113, "uuid": "91948188-fe64-443d-a3f7-8d8eb4b23590", "value": "3F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219113, "uuid": "5fa1fa19-aaf8-4d56-9f09-f714264fec46", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219113, "uuid": "9707ee7d-ca5e-48e3-a603-36857442d486", "value": "3072:9opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ypjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219113, "uuid": "d1da964f-9b9f-4009-b7f8-afb2101be514", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219113, "uuid": "dd7626d8-22ee-48b0-8357-5cefb55ca91e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219113, "uuid": "6fb1a7c7-a36c-4072-964b-75edc9a7d277", "value": "0e97d5881d48b10d1dbc90b167d223feea49061164547b45a870f51e777eaa93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27d446a-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617174048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174048, "uuid": "fe457743-3453-4a2e-8a0c-0c3a09e2a39f", "comment": "Malware payload (Formbook)", "value": "c539eed408e62abdae345bd297131c87", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174048, "uuid": "b4118f1e-34bb-443b-b2e3-1a7c1a25f144", "comment": "Malware payload (Formbook)", "value": "0e9c7f70f25b66f5644de584ef51d7ccf6d05fed399324208575bc9da4c3f486", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174048, "uuid": "a5024a50-cc2d-4694-99ff-fdc220453928", "comment": "Malware payload (Formbook)", "value": "f10a0fe21115eddf24c3a32f8990b8c7ef753a09", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174048, "uuid": "784cfba3-55f1-4cd2-bcb4-2a477f998424", "comment": "Malware payload (Formbook)", "value": "c76426f687a4c86f677c2ee361c0b89e31570fafef3bcf5f1438ebe7c519208cdd722d583ece5e073cf34a6204399ec6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174048, "uuid": "d01fe31f-491e-497c-8bf1-a1fb210d889e", "value": "8ED423854C758D33EC7DF585F8BC5ABA40E40BB44CAAEC955479EF62CA369D02CC6AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174048, "uuid": "400f7bd8-d7c6-4040-a6c2-5ce99685bce2", "value": "12288:DVl2Rfr+mB42HaLk64WoKBC4RFTNs3GlXZisgNnojn6Rw3:YfSmBC/EYCIFTHZH4oE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174048, "uuid": "2ec874dc-4706-4ed7-88a5-865a52808f6f", "value": 647899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174048, "uuid": "16018949-055f-42ca-bf4d-47bdeb1476e1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174048, "uuid": "df81f2c3-a9ab-45ba-84d9-14b900992a82", "value": "PO 2100020608-77003731.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c501a5b6-925f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222558, "uuid": "26cca5a5-5ba5-4099-9c7a-4d0092755e7f", "comment": "Malware payload (Dridex)", "value": "84ddbeca5329d54cef6769fafff15920", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222558, "uuid": "38316de7-d6d1-427b-b696-c8085be6bff2", "comment": "Malware payload (Dridex)", "value": "0ea4b8e92c4c8c818cef2ee47fc4078623fadb94194e14204f299b5a42389bb8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222558, "uuid": "12aee41b-1f1b-4e3a-b691-bbab59ee7fca", "comment": "Malware payload (Dridex)", "value": "639d39820312cb118190aeacdaeaa699bb1f0626", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222558, "uuid": "063b1ef0-bf12-410e-bb51-24cf723003fb", "comment": "Malware payload (Dridex)", "value": "9fc8c05c59f69b6a23e3bbd30093b1dfd483d90276b2a8e8838101c19f74b6857d6b42e200cbc04df5f5e97b5e1283e4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222558, "uuid": "d5c4fc53-74f0-4d9b-a9ee-63fded256afe", "value": "32248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222558, "uuid": "78966fad-5cf5-4cbf-a393-a4b3369df88c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222558, "uuid": "a42e83f4-6528-457e-91ae-458bec056ae3", "value": "3072:i6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ioMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222558, "uuid": "826e6987-19e5-49f3-a369-72ce4419c17f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222558, "uuid": "55bffd6f-f795-41b9-8a37-6ae98ae4a750", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222558, "uuid": "648517b8-fee0-48c4-b011-dfaf9e4bd347", "value": "0ea4b8e92c4c8c818cef2ee47fc4078623fadb94194e14204f299b5a42389bb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9afc919-926c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228203, "uuid": "cb46546e-d9bd-42ba-aeab-9bd3db7c69f4", "comment": "Malware payload", "value": "f4c89138b21e619276f7a17a4677637a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228203, "uuid": "2591f8de-7c1b-4fbc-a2e9-05c8e346865a", "comment": "Malware payload", "value": "0eae53a4d9732c5bc83e64074ab4cec43e20c337b8e89a57d7fe7fda9c25da2f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228203, "uuid": "7d417fb6-0af2-4c80-94de-4bd370ca222e", "comment": "Malware payload", "value": "c00f7dc5b8b772842829f76499c38f22326fef62", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228203, "uuid": "bef6ec3a-8c8a-40a7-8700-dc68b06cc79c", "comment": "Malware payload", "value": "b0558c7a9c32db3978d8aa7d963b6eb53a0c4bbe57e2931b429b26cd3db63c5111f020e43579220b7a1f1d8577142fb2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228203, "uuid": "67001efd-3581-421b-9f23-d907491f4ff1", "value": "53248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228203, "uuid": "d208b8ba-3471-48cd-9e69-2446e182f624", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228203, "uuid": "7acc04ba-0bb0-4dc2-b1d8-7f4c69afb6e8", "value": "3072:56TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:5oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228203, "uuid": "4624324f-cff3-47d5-b434-724d7f8a22d5", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228203, "uuid": "15417f47-27d6-428f-83d4-652091b22748", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228203, "uuid": "4161b077-d52e-440a-9842-1c00b0842f63", "value": "0eae53a4d9732c5bc83e64074ab4cec43e20c337b8e89a57d7fe7fda9c25da2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef36ee2-926e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228722, "uuid": "79acee16-1556-41dd-8c2f-f12c732a4a73", "comment": "Malware payload", "value": "7e374aa697824133d54534a397333129", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228722, "uuid": "41651aa8-1468-41c5-9c1b-10ea1b9d1569", "comment": "Malware payload", "value": "0f155803cbd92d2a73332b22797d165e76997184df1723f044d3cb988280612b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228722, "uuid": "b84c07f0-9877-4ff4-8f45-c274eff6c01e", "comment": "Malware payload", "value": "8ed81b227970258417e3e0ff555487c968e78270", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228722, "uuid": "de74428e-5120-4143-a9ff-86b2edf13d75", "comment": "Malware payload", "value": "df13dff69d20237634bfec6e5eed1c7ff3f1866c1aabb5ea4cc3ebdad42c8db90a3c3f4d4bf2794f3ea344df8b94ca19", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228722, "uuid": "a808e2f3-2277-4d6c-80da-f9ce2e09be6c", "value": "B014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228722, "uuid": "4a369ed0-9fe4-4914-a0a9-521b32eb169e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228722, "uuid": "666fcc51-75b5-4a46-b441-537e4b66d5c0", "value": "3072:2opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:JpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228722, "uuid": "656916db-f3bc-4714-acad-6c6728886c9f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228722, "uuid": "ceb5dd35-2449-4dd7-9f7d-0fb7ccf3824e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228722, "uuid": "655257ad-2345-4bec-9b2b-af8cdeac42a5", "value": "0f155803cbd92d2a73332b22797d165e76997184df1723f044d3cb988280612b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69000d4-91d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161948, "uuid": "081ca2da-75cf-46e3-b0fd-e1d283fcf20d", "comment": "Malware payload (IcedID)", "value": "9673b05d330e32c73d6807f18ca42712", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161948, "uuid": "8587bf50-232a-4e58-9130-f66f6e794864", "comment": "Malware payload (IcedID)", "value": "0f353dd9bb8738484ba0ddc24376fa29a8c8201f9e331dcd9c61b0498d97d5fb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161948, "uuid": "51ae459c-d187-491b-a374-7e065faa1975", "comment": "Malware payload (IcedID)", "value": "229ee9fe92a278b816813e3a0413cb897fa08599", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161948, "uuid": "7f3ef273-0e5f-4212-aae9-0c3e80f505b5", "comment": "Malware payload (IcedID)", "value": "51b722da3a5e25c5ae359fe5a9915d2a3635dcb6a0be8c6c99bcf8b9945c63fe4104b7474ed4571705c1fbb552ae3748", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161948, "uuid": "fd9975d6-0d98-4e4f-9385-cb144931b407", "value": "30B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161948, "uuid": "624f6687-c7ff-407b-9301-9136f3ff2a35", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161948, "uuid": "848edc2b-d302-4bfc-8e54-47b82f50a933", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161948, "uuid": "7a614755-1a73-49ba-a226-cdf722999f76", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161948, "uuid": "c4a81905-49a4-4e4a-a18c-52c7ffd09ce2", "value": "document-79846693.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a4801c-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216795, "uuid": "6afba144-b867-4809-bd38-ab32832d4e52", "comment": "Malware payload (Dridex)", "value": "3f2e6427b7621c19a4db097367d01472", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216795, "uuid": "f9345ec8-0de2-4683-9a51-8ece4e965dcc", "comment": "Malware payload (Dridex)", "value": "0f4cd0032ac0a62098cdc59bcfdb2bcca7b96796283d5dde5926305887c51591", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216795, "uuid": "8f66d261-63cd-46fd-a2ea-f3bc4e0f5a6f", "comment": "Malware payload (Dridex)", "value": "7cf90ed33440c9a10cbb3f61f567daa0fcf40afa", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216795, "uuid": "f46c14b8-122c-4dae-8b39-491ced257546", "comment": "Malware payload (Dridex)", "value": "718a41dcc4241418f425c0436ec46fd6e3008cecc05aa8cef305eefa1bf543d8c7dc8934b2f495a6f6ca8a278921c4ad", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216795, "uuid": "f103ae10-6416-4153-8c2b-eb1f010d0ebd", "value": "FF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216795, "uuid": "42bf5289-3841-4e36-af09-d101c9eae344", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216795, "uuid": "e0bf367c-87c5-40b9-9b09-79bb8a072f06", "value": "3072:wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:XpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216795, "uuid": "15f8a6f7-07b1-4f6d-9220-7728beb2b727", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216795, "uuid": "4a6572ae-80e6-446c-8e8e-2a710c00c53e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216795, "uuid": "885627b0-81af-47fd-82d1-1db9dfcc95eb", "value": "0f4cd0032ac0a62098cdc59bcfdb2bcca7b96796283d5dde5926305887c51591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aaa1f7d-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200127, "uuid": "8ffe7b2a-6848-46fd-9a2d-0a326b5c8af3", "comment": "Malware payload", "value": "c62bda7f0f17f63fa69e80ec2c088bbf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200127, "uuid": "821cbc33-3c05-4357-9b20-cad1108783c2", "comment": "Malware payload", "value": "0f83b4a0d8d376fcdbd932f313370b7b558902957e9810be72559760bc9979b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200127, "uuid": "15958b80-801b-4c22-bafd-1f4b8373f372", "comment": "Malware payload", "value": "bc63fc2744fddb0fc25c5c91c6fe8e4a603a681e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200127, "uuid": "581a636c-e5b3-4dc8-8755-3fae12179d5b", "comment": "Malware payload", "value": "4471542a8aff845f76ad387ec7e76502b159bea30cb18aa2e04aad85987da47c8f8cd743e4a85dc76e92bd2fe80cb7d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200127, "uuid": "ccc67020-2de2-4a41-9c8d-24d7b5c8b2d2", "value": "1EE2F9B29C471C3959B660ABF9520629DFB080C3E10170E47EBE459C5FFE84891FB69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200127, "uuid": "4d2c149e-6bac-4c31-87a1-eb07417ee9c4", "value": "768:P0gmajGE0x2M+9zZrS4mluoVYpP4fkAtAk3IGM:8gnL0x2McGrlkd4MAVbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200127, "uuid": "0e996477-2b36-4a8b-a198-10f37a95e651", "value": 31266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200127, "uuid": "4b45684f-d050-4b7a-882d-0a8e1aadce7a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200127, "uuid": "7ea58809-1020-4be5-a967-ac3dd3302ccf", "value": "0f83b4a0d8d376fcdbd932f313370b7b558902957e9810be72559760bc9979b8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43938993-9240-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209027, "uuid": "bf677265-ccf9-4a6b-bc54-da83602c9b66", "comment": "Malware payload (IcedID)", "value": "3d12a55adfd0f7e6eaec6b467dc91c3f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209027, "uuid": "ebde0639-7d11-4192-99b4-65a8b5c91662", "comment": "Malware payload (IcedID)", "value": "0f99b4bac6c435c04f8dd49b1ff39f6907c0c267a778f5f4ad356211f1b68037", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209027, "uuid": "f298b0bd-8590-426d-ab7f-136290c08e8b", "comment": "Malware payload (IcedID)", "value": "913155435a6fdedeb7a5898b4c94023307d2a244", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209027, "uuid": "5435c64c-9e55-4560-ae22-0b274a714866", "comment": "Malware payload (IcedID)", "value": "4bb294cf3174ec1dc7d7158633020341f316e26f15d3e5fc81ea74b2fcf24134f8807d62a2c2306b9001e075d750445a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209027, "uuid": "9ab5b694-1f02-4a8a-b13b-10e1d2d2b4ce", "value": "F5B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209027, "uuid": "8199cca5-723c-49d4-91e1-f3739e32cf64", "value": "3072:82S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:8qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209027, "uuid": "f5506219-2ce4-48f2-af80-525340929577", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209027, "uuid": "05bc0d44-fad8-4092-9067-d3a603501c40", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209027, "uuid": "85f876a6-e47b-40dd-8552-f24f2cfd70c3", "value": "document-1393216397.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cabf2c1-9271-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230168, "uuid": "6fd47d9e-96cf-472f-a9b4-cb5bfd1aa7d2", "comment": "Malware payload", "value": "db2a1470ac98a670c60c48196f51b03a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230168, "uuid": "0f2097ea-56cb-4853-a1a6-215986ae789b", "comment": "Malware payload", "value": "0fa6f4e1c802644e9fbed131eb6a4773a7df1bcb085aa6cbe7d81aeb69c94349", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230168, "uuid": "7d76e6f3-b320-48eb-89c6-7b49a23bb5ac", "comment": "Malware payload", "value": "a37d9ba8975d34f06f4735fced624f2abee0e75b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230168, "uuid": "3df0a11b-86c1-4085-a75f-fdc1a9347035", "comment": "Malware payload", "value": "353233401288deeafa491a847dfdcb85b7781999cb87705e99e3746983a235c1d4ac5924bfc383cbdfe3ebfdf202e62d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230168, "uuid": "d60acbd4-bbf3-4c87-9766-24ab312ef7b5", "value": "96248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230168, "uuid": "1932c07f-e0b8-48e3-8b79-3e30b0c586ab", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230168, "uuid": "6d0196c8-2f9c-4eb6-bf49-5d02b00b5d91", "value": "3072:g6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:goMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230168, "uuid": "7670aa7b-332b-4a42-9c0e-fa967831be15", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230168, "uuid": "7e3b2590-6b12-47a6-afc9-b9d69cc02dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230168, "uuid": "70cca99d-6f67-470e-b465-522503031a46", "value": "0fa6f4e1c802644e9fbed131eb6a4773a7df1bcb085aa6cbe7d81aeb69c94349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4e3425-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213046, "uuid": "892add60-7bdf-4876-b467-2a106b838669", "comment": "Malware payload (Dridex)", "value": "d3c96bbf108ad28ac924a45f446808f6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213046, "uuid": "09bbb495-694c-4141-a723-2bfb992d0169", "comment": "Malware payload (Dridex)", "value": "0fa988cd1afcc4c091fc7cdda1284922b483e6ef77a2176f38cd728be6537985", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213046, "uuid": "9dc6bf5e-22a0-4ea3-ada8-665f16f90126", "comment": "Malware payload (Dridex)", "value": "508d2a3c0c203f03e2f769b1d9092f50fa798fa7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213046, "uuid": "73590093-c210-4f8e-a45c-3bddb0e110f7", "comment": "Malware payload (Dridex)", "value": "1a7a66fcc8357192cce4d48dee03101ecf2926ae88984b869f74028763e955ed6f6807effdd6269a7b43228aa3746287", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213046, "uuid": "5a25d522-22a7-4bad-ad52-a0162a2f7ac4", "value": "13248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213046, "uuid": "04c1b599-517c-43c1-b606-aa3759b796c3", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213046, "uuid": "355a9db4-819a-4c0a-b969-dd1598ac435c", "value": "3072:x6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:xoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213046, "uuid": "d02ad06f-e08d-4883-8be5-df59c3818aee", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213046, "uuid": "51965b34-9ed1-4877-aced-9dd66dfe0b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213046, "uuid": "8ec80e09-f2f2-497c-b49c-af6177843c94", "value": "0fa988cd1afcc4c091fc7cdda1284922b483e6ef77a2176f38cd728be6537985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5b0b17-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204985, "uuid": "84c08698-377d-4ccb-9185-465bfa0f6f6e", "comment": "Malware payload (IcedID)", "value": "7edff253c85b9f0df4762651287bae93", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204985, "uuid": "4f53a2a9-47b8-436f-b4f8-72b5e7683db6", "comment": "Malware payload (IcedID)", "value": "0fac42500254375540630e547c364ed4ef62cee939392b61c5259669582f4648", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204985, "uuid": "8439cfb6-e007-4598-870c-033a88539c16", "comment": "Malware payload (IcedID)", "value": "794c76607f38750c2be768c850761c659b86025e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204985, "uuid": "dd8ce025-52c1-4d59-b079-3109be647b63", "comment": "Malware payload (IcedID)", "value": "30320c4225c66311f5e8ff993fdd71d4623d47062496017bd94961c46a6ea9787a6ddb2aebc65aac507e22354a804514", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204985, "uuid": "248d0694-fbad-41f2-9eb8-94d9e7d1154c", "value": "63B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204985, "uuid": "b2cf891e-4d08-4910-8a3e-7adac133e5c6", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204985, "uuid": "6eb6b2b2-a5f8-4e9c-bd0f-4a52b489a516", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204985, "uuid": "0ae87e1b-fd16-4058-b57e-4c71f62b8b61", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204985, "uuid": "7b55c3c7-d8a0-44f9-b804-f15299041812", "value": "document-1144576844.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be725a0a-9234-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204079, "uuid": "4cd78c2f-6db5-462a-80d9-d20cbcec65df", "comment": "Malware payload (IcedID)", "value": "cb78d71e4962a7eb1ca8faba09f4325b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204079, "uuid": "09a38bb9-4793-4cf4-81d4-99817b39b81e", "comment": "Malware payload (IcedID)", "value": "0fb554a0311f1c4dcc1ea441e841741c7ad1a36b0df998a5eda0a9c021bc897d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204079, "uuid": "e14d672a-ef79-48cc-9769-cb12a1e3bb80", "comment": "Malware payload (IcedID)", "value": "cf5e5cef854fc1a31eec95cd9c8bc877d57b858b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204079, "uuid": "4ca5f714-f129-45d7-b088-cb7e5661e29e", "comment": "Malware payload (IcedID)", "value": "cf4f869927c243807d2e6d24a0cbab3e241a809e2f71c39df26341575d93c400e3778415f9f5e6a2f549b105bd2434d5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204079, "uuid": "07939796-9003-4820-a448-d4f4a6ba3a4e", "value": "FAB3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204079, "uuid": "2d926779-34e0-484e-99ef-4e1d33de3386", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204079, "uuid": "3b59cdb2-ad87-4302-9533-155ef467bfc8", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204079, "uuid": "13b1e193-d272-4c74-b3bb-cb38a3bde765", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204079, "uuid": "1f04ef59-b885-4182-9606-52b00622601f", "value": "document-715805522.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad610a83-924b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617213929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213929, "uuid": "2fc515c3-af20-4b75-a8f3-47d90d2cd4b6", "comment": "Malware payload (IcedID)", "value": "13ca896cb3e3d956c17cdc2e74531d2b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213929, "uuid": "a9921477-a440-4079-991f-c7be3eb53fc6", "comment": "Malware payload (IcedID)", "value": "0fc7443d034f27e4319681c22b53f6c07d660bc261c7b5f0ba5a2cb1a45ce612", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213929, "uuid": "94778738-faec-4ea4-9fdc-d29ed87a3422", "comment": "Malware payload (IcedID)", "value": "2dd0b95c05a2d4c324ba6c0b674a14667d7f273e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213929, "uuid": "a42da562-907b-4fd9-a718-659703b65a80", "comment": "Malware payload (IcedID)", "value": "56763574bf8f4dc93af40ac838b1a82b45e0a4e395da8cf9b21e59f72df295eee912013b3750bc69fe65d2b97b45fb17", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213929, "uuid": "1bc80347-3af6-4b49-992c-fc7842aec625", "value": "05B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213929, "uuid": "d55f4eac-8c4f-4f32-84a6-f20885b2d006", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213929, "uuid": "12276306-ff12-450e-b47c-b9e1ee0dbc63", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213929, "uuid": "1e7c7fdb-5794-4936-8e47-2abbee75e2ff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213929, "uuid": "509eb52d-5bea-4bc9-9984-1f7faa87913a", "value": "document-619184592.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013d11d9-9259-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617219653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219653, "uuid": "8cc44692-22d0-4c52-8ae6-40ef54a94305", "comment": "Malware payload (IcedID)", "value": "c7fff50006b6bbf17e31a45bf017b511", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219653, "uuid": "679576e8-74f4-4f34-be76-aa74e59d8e34", "comment": "Malware payload (IcedID)", "value": "101bf3967a0ce47d8d1308a8d65bf430d5ba6fbf79603705523b7f4c5ac7fdfe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219653, "uuid": "11426617-9862-498a-a5a9-b344d97af1be", "comment": "Malware payload (IcedID)", "value": "eb9ed8e412edca3bbfb187b15cac6b5bca05982d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219653, "uuid": "75e5be81-48f4-47eb-b414-54a008c03b04", "comment": "Malware payload (IcedID)", "value": "1a9c196a66360b5b58213dc49058daaa2b228061ca52c161a922eaa64fb0234e5aa25d7caa065922c6d2bc860c9ad408", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219653, "uuid": "56466ab5-28a2-4543-9853-34d7b847bb03", "value": "9B438CCAC9B20663C536A971C2F12B18D122B760F393AAFBD14C3365C1526D0DB737A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219653, "uuid": "a647fd8f-ed68-4490-9181-5500df7c8cd8", "value": "1536:MhQeEn2s56EdRX096SioHkvr+LlXpFyrEU:MqRjH0Eptvr+FzxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219653, "uuid": "3e103a97-c4a5-4dbc-b79a-09d7ffb83bc3", "value": 55840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219653, "uuid": "d4cebb32-d920-4303-95dc-d3e9263b382e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219653, "uuid": "01d418ce-e3de-4e1a-824a-81c6a4942ae7", "value": "c7fff50006b6bbf17e31a45bf017b511.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc44974f-91e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617171863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171863, "uuid": "db333693-a811-4e67-8fde-6bdbb437c556", "comment": "Malware payload (AgentTesla)", "value": "c3be19b1d91c397020bc72584d48bde2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171863, "uuid": "57ddda9c-fc96-40f7-8bc7-045ed7022432", "comment": "Malware payload (AgentTesla)", "value": "103d38887db381761f853450b2e5c21287e25fcea87c313b7105ffb042cb225a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171863, "uuid": "b0b8f284-b022-40c5-8122-d65838b46fc3", "comment": "Malware payload (AgentTesla)", "value": "60c3256b431f1c9cd239e131967da56181f4e68f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171863, "uuid": "2d181932-0c53-4926-9b98-7e828d56fa6c", "comment": "Malware payload (AgentTesla)", "value": "167dd64e6356eb26bc376dac4d036abe4bc3248aecfab16426bf0211af56cd1b3097011740ffa3d7bf1d076b6554bdc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171863, "uuid": "c119a63e-dd2b-4a72-9612-dbe15fcfe61f", "value": "A4C423F76463A6639899A6B90FC074157DEEC4A32FA196CC03DBC5D162D2C0B30CB85B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171863, "uuid": "9cabfb2d-c2cc-460e-a639-ff323956c3f1", "value": "12288:upails1zuOrB55AyIyPz+9vWW7QrSeMtI17PoJqOT6ka4sM3jq8e4UziC:uIiqdRB5mZV7QbMtG7PoJqOT6kaFM3m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171863, "uuid": "eaf2e594-712f-4993-ae38-07315da8647f", "value": 593288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171863, "uuid": "b5e8bd85-e7be-4814-b4d6-10d7b0e1a879", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171863, "uuid": "552f9860-cdce-493e-b1c4-eda663be79a2", "value": "doc20192910887888001990.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802aac55-9232-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617203116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203116, "uuid": "f7ea8f73-33bd-4c13-8023-0745cbdadd6b", "comment": "Malware payload (Dridex)", "value": "e42484b31063c6afc0b9f4e8967f6e67", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203116, "uuid": "bbf7d348-b084-41d4-b367-d0074078912f", "comment": "Malware payload (Dridex)", "value": "103eb0783c80e3a5a3b4201cd5765fbc6caade533c3bc9a0682fa8d9412435c9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203116, "uuid": "f5902a48-ef36-4377-a58c-815ae4d464dc", "comment": "Malware payload (Dridex)", "value": "35d6ee6733f5d80f908f1ea4beff600104f60828", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203116, "uuid": "2a628ea6-443b-4fb7-94e8-7d8cc9ece51f", "comment": "Malware payload (Dridex)", "value": "093ca47f01bd12fbf5fc5ce278a70d6bbe8c90640d2e37edbcfdfdeb68a89454eb90feb9d3d80511b5ab31ca27b2e27a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203116, "uuid": "7379c124-661f-4bc6-8c28-c5b0e30b994e", "value": "4314AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203116, "uuid": "e8996e87-224c-4f93-af00-13c05f19c66b", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203116, "uuid": "915a764e-673c-4ca3-b5c7-1c948a58f2a9", "value": "3072:71i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:5i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203116, "uuid": "12644908-9dc7-4da1-b391-8f2d7ca91ce8", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203116, "uuid": "3eb2ad3f-0745-4edf-a728-5ae41f3c7c6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203116, "uuid": "f58b74b3-19a2-405a-9b88-4a0aea2773f4", "value": "103eb0783c80e3a5a3b4201cd5765fbc6caade533c3bc9a0682fa8d9412435c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea914d2-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202120, "uuid": "4b80174e-0d54-4528-8d71-bb42afa72953", "comment": "Malware payload (IcedID)", "value": "72992b1784c22bd4f6d75fb550b4c3d4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202120, "uuid": "9a97d96c-b9b6-4238-bf07-fe9e23426636", "comment": "Malware payload (IcedID)", "value": "1071bf1c879e325f15d6cf454c146c3966e68386edb464bf59ac86be06733963", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202120, "uuid": "1cc38814-5c43-4b20-9f9e-2a52f0119673", "comment": "Malware payload (IcedID)", "value": "a24039281f49eef4b5fefcd23f275fa9ad913236", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202120, "uuid": "6a389a52-6fd5-4475-9ae9-b7738ca8f2e0", "comment": "Malware payload (IcedID)", "value": "1bcab1ee683b44b693bcc00ed5b102d2e52473eddfbb43b060deabf7da355501ad24414ddc94d7db3b529d547e8c11f2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202120, "uuid": "105fb3d5-466b-45ac-8cf3-9ba7af1b1774", "value": "67B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202120, "uuid": "5e8251f3-4113-479d-96fd-325fa343cd39", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202120, "uuid": "18f1f0bb-b259-4322-bc96-2e02d39bb83b", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202120, "uuid": "d44b8bc8-2d18-4cfd-87fe-aba13a16e7e6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202120, "uuid": "ebb028ad-2599-4e0d-823f-7bdcc18835f1", "value": "document-1584750143.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953c5d97-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232786, "uuid": "19a620d4-b192-40e4-aa20-faa222a0c19f", "comment": "Malware payload", "value": "d5802d26344e87b4035d50d4b7e92613", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232786, "uuid": "872591b9-6d80-4e41-9fc1-ee8544ab0b8f", "comment": "Malware payload", "value": "107da7684dde1bb76121cf1c8a46085c44ef6b33bb629287ee9188edfec076c8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232786, "uuid": "b104dc9c-70db-4fd7-a44b-9e2457a9225e", "comment": "Malware payload", "value": "b33301cd6535454343e9ec5eb10dca1b275c2d99", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232786, "uuid": "a61735f7-0925-4541-8a50-b0673ed5eec5", "comment": "Malware payload", "value": "b7ce9d4a84b371fdc67c17ef2a75493463642a567f347d3f48ec6f6c2d193f26441a0d379cef74ad36e91d663f08bc93", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232786, "uuid": "8cf29829-f6cb-414e-938c-a8812b3217be", "value": "ED14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232786, "uuid": "8beeed35-5fae-4f05-9fe5-61862c811e5c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232786, "uuid": "bb835bbe-ea3d-47ec-b697-13fd180ead4a", "value": "3072:Iopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:/pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232786, "uuid": "20f76172-a558-4980-9de4-fcfc207873aa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232786, "uuid": "164d37cb-9852-48a9-b135-ba5b8d78119f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232786, "uuid": "53d850e2-73a1-48b3-9c78-130763dfeb26", "value": "107da7684dde1bb76121cf1c8a46085c44ef6b33bb629287ee9188edfec076c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26ef70e-91d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161941, "uuid": "cc75b746-fd66-4931-9676-284b1dd8b557", "comment": "Malware payload (IcedID)", "value": "b95cced3d52fb321d4ac129f07748e0a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161941, "uuid": "479d4641-8d80-44f0-bdb4-24a97134dd16", "comment": "Malware payload (IcedID)", "value": "109dba483803d41b9e9ca8d9af90c7ca9cb106ddccf4901ef174bae019d93cd3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161941, "uuid": "694147ed-f89a-4f3a-ba8e-d97c10fb877b", "comment": "Malware payload (IcedID)", "value": "ed2e24d22c6b03954c02f6422bb097d2e4b1973b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161941, "uuid": "c673b36f-57ea-4abf-908c-3a88bdd54413", "comment": "Malware payload (IcedID)", "value": "dec063ac22de2add9c8fb76c2cbd8a22ad7d045b87f2015326e044224d2f6b0e122bc6eaa38c70072bebf556bc16dcdb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161941, "uuid": "c3a4745c-114d-4149-9bbf-3ab2b5bc52ee", "value": "59B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161941, "uuid": "fc8fadf2-78bc-4726-89bf-de6f408e5bef", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161941, "uuid": "48fa14f1-819b-4fb0-92e9-705833489b0c", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161941, "uuid": "bf26e3b9-d6b7-4885-8b4f-6841c6d0f3e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161941, "uuid": "1b405e10-d64c-46fa-b51f-06df0e5c25a2", "value": "document-1369672464.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa8eec2-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160747, "uuid": "9c6814f6-4325-41b9-8e88-9e6287929925", "comment": "Malware payload (IcedID)", "value": "8dbe66f93abcb19d1c34c0400104c2c3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160747, "uuid": "689e4944-c0f5-4edd-8f1d-b8c6c0c3033a", "comment": "Malware payload (IcedID)", "value": "10c3028a464ea73eb408165d7061da4789dcaf06702901daeb68b6c1812be072", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160747, "uuid": "6eb562de-420f-47d2-8cf4-bbb6745e6f90", "comment": "Malware payload (IcedID)", "value": "30dea8c7169844ffec3d1161b869d6fd67cddbbd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160747, "uuid": "54a3d41b-c624-45ea-94c0-0a8d6906f365", "comment": "Malware payload (IcedID)", "value": "b3352ecc4f2f6eca0ef026e639d1fb0d3ffe50d3cf4d422847746682387531e087b85fc4a0c3a50f7a4b8e84184e8720", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160747, "uuid": "3b31711e-c19a-45ed-9d69-380970a10131", "value": "EBB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160747, "uuid": "c6197d59-d13b-4098-9bfa-087084479bc9", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160747, "uuid": "0b7640a8-24c3-4f2b-944a-4155143f98f9", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160747, "uuid": "61f96456-9021-4a8c-9695-f78aa623a272", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160747, "uuid": "7da0290e-d846-42cd-a79c-e5e50af9fb9d", "value": "document-2070588620.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3124f303-91fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617178931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178931, "uuid": "fff8448d-e490-42ba-83c1-738e717ab32f", "comment": "Malware payload (AgentTesla)", "value": "427c16886f363a09fe03c18e8467efb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178931, "uuid": "ff7da070-e854-4d46-87ab-4262cd24cde8", "comment": "Malware payload (AgentTesla)", "value": "10d5733c6a972f26330e2cfc87e1aae6a428922abab5357d656ef755938534ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178931, "uuid": "14f6402a-8277-4c4b-9b82-2e799a921323", "comment": "Malware payload (AgentTesla)", "value": "3064b502ae472c5d7681e369e828eda16e751295", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178931, "uuid": "8174e54e-958e-47b5-ba51-4ca8800bf17b", "comment": "Malware payload (AgentTesla)", "value": "b924d0dd69e7ee93e71906eb73bb30ec6d40986299c0155dcc4db9d0ae0cda013be34b074a89326f31d823b78dfca388", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178931, "uuid": "1984ce5f-7eb3-44d7-a26c-ab2ddb5574a8", "value": "8FE423C37EBC6D59AF7CA498FEDA3FA242E6ADC2B91CC14272ED0D84A1C719B544C504", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178931, "uuid": "fc8b9cc4-1ef5-4bb1-95fb-5af4838767c2", "value": "12288:Ce9xWQGeDTdOhcWj/EBP+A06qd3GZn1U2pwx+lJIVZ90F9FmZkZj23vacYEowq:QSTchWd0c1UcCCJIr9emZkZ6/aSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617178931, "uuid": "3e2fb386-c477-4196-9d82-c240b123f35a", "value": 688162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617178931, "uuid": "e8132cb9-7d3a-4f6b-a862-bb2e733cdd5c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178931, "uuid": "e7d56493-5e07-485c-8f8d-9e07250ff47f", "value": "WQE0909PO.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d509b89b-91fc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617180065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180065, "uuid": "64dba66d-c299-4df9-804f-bc5e915c4b1a", "comment": "Malware payload", "value": "c4b7b1ab8c7f20b2a26dc9bc2fa4f3a6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180065, "uuid": "46fbfde4-aafb-476c-a8e1-219e2f70f912", "comment": "Malware payload", "value": "111262e6c7c9df173d7ca7f2e6841e3abf3c2bd3da5d9b0158a5d89441f93e88", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180065, "uuid": "d5b26168-b44d-453f-b446-f9a9d9e5191c", "comment": "Malware payload", "value": "c1b3c2694e2fe8a3c39a54c5b69191d8d07db5c0", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180065, "uuid": "472b00c7-a1aa-45e1-a5cb-96f9503d2192", "comment": "Malware payload", "value": "7728cfd1a76f7451d547737a15275d7c53ba5eb8f918ab34339c3781594108214034db1e72b8450d09ca9b74a181d9b9", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180065, "uuid": "ea799797-2ecb-4293-b696-dcc031da7ce0", "value": "B9C0223A4034CACCC8298526804F7B30E3236938341492D0A2E60804AC019198D38D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180065, "uuid": "d1e24df8-dfeb-4ac5-adca-c70a740e3ece", "value": "3:I59eqNjMJJLNlBLE6JdWxdkc8tSXRKBJ9KLxKCQDO2YdIhDMVBiK+gcZM4:IXe2jInHj520zmKty2XhQBfcy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617180065, "uuid": "214ad074-7a38-4a87-8cb0-b92d8fed7488", "value": 187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617180065, "uuid": "08332781-d528-4a7c-a441-4d81ce6c163a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180065, "uuid": "12eaa3cb-7daa-462f-b056-adef4c4b76de", "value": "powershell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f55189-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216574, "uuid": "f6561c01-a5d4-445a-98a5-639719520612", "comment": "Malware payload (Dridex)", "value": "34465a69792fa1111e3bb5d41b74024d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216574, "uuid": "3c7555df-3df9-4e66-bf72-2bc71e576f73", "comment": "Malware payload (Dridex)", "value": "114a57057d0787414fe4b938973fdf3ed679d12470d672a978e4096f2daacc05", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216574, "uuid": "2ee4b33a-256a-46de-85ea-36acc79f4ad0", "comment": "Malware payload (Dridex)", "value": "20377b53cf8903e6f646c5677efbfc62df71d11c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216574, "uuid": "765637fe-4bf5-48be-9d5a-4905c2c2d825", "comment": "Malware payload (Dridex)", "value": "400b41d45267f4807b341bf8c30d2bc7e9e54e909458fd970ad679ed86bb298892a9c7c2bbe15d55a61b2a9f5711f75a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216574, "uuid": "77510282-375e-4760-958f-e2516aa008a8", "value": "B114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216574, "uuid": "e4c0e45a-3cd1-4845-8d38-1a3c6d22312c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216574, "uuid": "0725fd3a-ed05-488e-8204-9b46d207c2b6", "value": "3072:Uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:LpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216574, "uuid": "73382402-be69-4471-a39a-a3f90839edcc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216574, "uuid": "ee2a2eb1-abbc-4921-9dd6-e48dbf5f3009", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216574, "uuid": "f839ef90-9029-4563-9910-374071a9071a", "value": "114a57057d0787414fe4b938973fdf3ed679d12470d672a978e4096f2daacc05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc744c0-91ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617173179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173179, "uuid": "b63ded23-420b-4061-948b-abb8e3880304", "comment": "Malware payload (BitRAT)", "value": "fe94d8c9f1ad8147d8d0dce839b2eede", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173179, "uuid": "fcc14b1f-027e-407a-9f86-af3e6fd2b269", "comment": "Malware payload (BitRAT)", "value": "115a1563f3c71bfd9b3e863fb3f6ed2808e18d04d72f3083a72c31e579e46549", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173179, "uuid": "da61139a-3965-4a5b-b5f4-acf8784cca02", "comment": "Malware payload (BitRAT)", "value": "9048a6cef207eb7679679fc31ca4232b1ddee783", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173179, "uuid": "27ce6fe7-c0c1-4061-a41e-39e0bb1effad", "comment": "Malware payload (BitRAT)", "value": "fc5888784e6e0da07733d736524c62c5e8f4ed45dd8f597cc73ba216cbeff2260f081858077d90714714dafa2ecda2ce", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173179, "uuid": "796e4d9f-68d6-464c-a72f-7b69c8cdf55a", "value": "9185332400CF3080DE4A839EFB5EA62244FD5EDDB9909C7DB7960CDCD4C6A4D7649E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173179, "uuid": "36619780-b761-414c-9ce2-8daecd9224bd", "value": "49152:3Ktk289qouUBvmrYqrjviMkMUJm0RilwGe6v:atk2ZVUeHjviZMr+FGeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173179, "uuid": "40839408-502d-464a-941f-3ecb6a053296", "value": 1753449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173179, "uuid": "cd1df5a1-6f1b-410b-b6c0-4a08306fc93b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173179, "uuid": "00ad786f-717b-4055-9569-8af177523e2e", "value": "DHL Shipment Notification 0012151100.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c97e77-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217317, "uuid": "7d40dae3-297e-4787-972b-200df1ed7ea7", "comment": "Malware payload (Dridex)", "value": "94997c8fbcce1f3649496ac4163b254a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217317, "uuid": "ab1b19b4-a45b-4f92-8b06-43e2ac783d9c", "comment": "Malware payload (Dridex)", "value": "119effa76de99937acbf15ac27ec7722be7fae594f455ada1290fed8a073266e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217317, "uuid": "b6a0f5c7-6cc3-4aae-a098-df94d9033448", "comment": "Malware payload (Dridex)", "value": "5a115b4dc3608b404811d30b229109f4a45655c7", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217317, "uuid": "c3faff0b-08bf-4554-8db9-f9337da1c22f", "comment": "Malware payload (Dridex)", "value": "dfbe50b2a8b53b2e6973b839d73198ac48d817c7778e099bc0e4be11911c90dcfe877bc2ba2c6cf24cd5bf6f1a55423f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217317, "uuid": "99dc144d-82e6-43eb-80d5-e15939d64fa9", "value": "2D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217317, "uuid": "81665b75-2f7a-4728-8629-b814e3e977b1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217317, "uuid": "aa39081c-d20d-4864-8c24-be9748f681a4", "value": "3072:Qopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:3pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217317, "uuid": "f23635ca-2089-468c-ab89-2a7b94d8cdd8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217317, "uuid": "2ebaeb1d-1423-4126-8892-8669d0c4d498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217317, "uuid": "6f880ecb-40df-4dff-a2c3-1e7faf81fb9a", "value": "119effa76de99937acbf15ac27ec7722be7fae594f455ada1290fed8a073266e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28660ddf-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199962, "uuid": "a43fc49d-9b09-4a08-811b-289974c7d725", "comment": "Malware payload (IcedID)", "value": "fe4f61445f3517179a27f1bb369e04d7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199962, "uuid": "b4c1f0d7-169f-4f9f-b85a-065fce78f339", "comment": "Malware payload (IcedID)", "value": "11f36db3caabd7ceb31289d2564ed253ced60980c76d3db12510383327e2ea5f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199962, "uuid": "171cfd3a-76cf-48ca-a8ec-6c968ad48723", "comment": "Malware payload (IcedID)", "value": "cf4dbda6111bae42abd5389a7e34f0fe223283b2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199962, "uuid": "e90e14b2-3e0c-4bdb-b06c-e1b7ae4ede39", "comment": "Malware payload (IcedID)", "value": "2c38a1cf89e15cdb443407981184caad859edb22ceb36708d6077ad9b8962568cd77eed2936129124bdd5d4e5f8b3934", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199962, "uuid": "3e9e71f5-18ce-4cf4-a8d6-30a2054ddf39", "value": "97B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199962, "uuid": "88379f56-bcec-4cd6-a13b-2f37cd847804", "value": "3072:M2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:MqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199962, "uuid": "76f21dd0-fada-4d61-a834-ecd9e884541a", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199962, "uuid": "02d81cba-1748-4430-ab55-122eeb540972", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199962, "uuid": "92892eca-566a-4725-b8bf-f852369ed183", "value": "document-1179279993.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a97000-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230980, "uuid": "201fbee3-40f8-4243-b4bc-c167ad223542", "comment": "Malware payload", "value": "6d99f13b77a569d68d9ae5b95d72183c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230980, "uuid": "b63bf38c-226b-4d50-a389-cee5d40c36d9", "comment": "Malware payload", "value": "11fc930d73e49098491c06fcfb9d8d88a4864a0bbf236ba0323175b62834d063", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230980, "uuid": "09f98cef-600c-485c-9039-d803e8074ef9", "comment": "Malware payload", "value": "2c1eb539576e348ef6379eca0b3c5f0bce508948", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230980, "uuid": "2eefe065-1aec-46a4-afc9-749c9da9aaa5", "comment": "Malware payload", "value": "c16624737b784c44b4bb9c5dba8482235a2683141ee9db78874b1ead65c03375e2e04d30d173c808d9de1a3f9b9ee737", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230980, "uuid": "8b2c514e-8f21-46bf-9d6e-a310a0e152ee", "value": "7214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230980, "uuid": "a7af6340-a074-4173-a119-6f7932207b84", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230980, "uuid": "a397ebe2-e6d0-4893-a749-17f2a49d2c9f", "value": "3072:qopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:NpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230980, "uuid": "9f3b4c74-9e03-428b-9fb4-4a2f90a7e233", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230980, "uuid": "51a57aeb-6776-4563-8625-429dca5d57b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230980, "uuid": "ff1bef82-f82a-4d73-8e69-b2c5dd8e469a", "value": "11fc930d73e49098491c06fcfb9d8d88a4864a0bbf236ba0323175b62834d063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3543423c-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232196, "uuid": "c72e1c48-9648-40ce-a391-1ac3b77eed21", "comment": "Malware payload", "value": "aec91e83a8aa13afef6d26d2f0e5493c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232196, "uuid": "b1bf0fb2-4f89-4c45-85d0-2da004f265c4", "comment": "Malware payload", "value": "120f94ac816da8b61b778b2bb31157fe362cfd6bc6b1555e130cc40822928fff", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232196, "uuid": "50b29fe2-ce5a-4c06-bfa7-26af58fdc86b", "comment": "Malware payload", "value": "95fed61d84132ef7a8f063a17b3dd2d311afaa17", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232196, "uuid": "7ab32f74-84e2-4440-8f6e-f1a25536f88c", "comment": "Malware payload", "value": "80ec181f02e9ac9de6a20d005385a1cfd84e16a303fdecf6b1d659859db7b76035d3ab6e580b6f1dac737f1b4e07e4ff", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232196, "uuid": "7d215107-731e-49e9-8603-55def8e02b11", "value": "D014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232196, "uuid": "aa255e58-4ce8-420d-a354-4e644a2ee042", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232196, "uuid": "816a9acb-aaca-443e-be3a-ce3bcf0e6f8e", "value": "3072:Mopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:TpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232196, "uuid": "518eea2d-72e8-4be5-901d-7ea949db42ac", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232196, "uuid": "f6715976-f7c1-483d-9069-ed7329f8fce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232196, "uuid": "f9470fb7-1f09-48e9-86a7-451060e07dde", "value": "120f94ac816da8b61b778b2bb31157fe362cfd6bc6b1555e130cc40822928fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf18ad6f-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232427, "uuid": "967c2188-69a0-4615-a4a2-9eb0d5aebb98", "comment": "Malware payload", "value": "a7bae13e6deb9d44ffb1a33a656af641", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232427, "uuid": "c27fcdab-e4de-4c53-87f6-0243ecf92bea", "comment": "Malware payload", "value": "12180e263f47b6a103e4f376f23dc6e25641bf6ac3f9bb83fa6718b640f5a603", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232427, "uuid": "818a59f9-9b3f-415a-aec1-9a0edfb429bc", "comment": "Malware payload", "value": "decf3e749929e4649d2bcab4775fce898c247a7d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232427, "uuid": "df3283af-87bd-4c33-969c-52a74fc2ecfe", "comment": "Malware payload", "value": "9f3d9f89a746d90f671c6a6c5c959b39a07e6189bef14008255146088293b5d06318d555c3e3745a5e609cf18eccf7ce", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232427, "uuid": "a3bf377f-5699-4bf7-984d-9bfe2da3c288", "value": "E714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232427, "uuid": "4b64b442-2f95-421f-89dd-d5ae9d5277a2", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232427, "uuid": "38f91374-5ada-4a58-a46e-4c9dcebe613a", "value": "3072:9opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ypjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232427, "uuid": "5c165a2a-ea64-4bd0-9247-7175d40376dd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232427, "uuid": "cbf88876-1f0c-449a-84d4-c21e7f3a23a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232427, "uuid": "b4bf2e93-b072-4c4f-bbf1-2dd0812e9bbe", "value": "12180e263f47b6a103e4f376f23dc6e25641bf6ac3f9bb83fa6718b640f5a603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01926f0-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217906, "uuid": "580d607d-ad35-4a43-b668-be9d4942bfea", "comment": "Malware payload (Dridex)", "value": "242e0ba9c30d5d13a6c65157dc75e2ca", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217906, "uuid": "1a6552ed-acdd-4dd3-a730-2eba74a3c0e8", "comment": "Malware payload (Dridex)", "value": "126b720b9c42dac457cdfc012b39327c37617109b7c8566da3427d030044b346", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217906, "uuid": "f7d01ee9-2adf-4db6-a435-e0a58e0a0865", "comment": "Malware payload (Dridex)", "value": "24dc1d76ad6292fc9d7c04c8a4b352fecb8029ac", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217906, "uuid": "e2f45b16-af7c-473b-823f-71aad042f0c0", "comment": "Malware payload (Dridex)", "value": "75c6d5c7efec19514d753d1e10e63d36d8d4a50b95ea633da501fdec6e557c4ce261b870b6b05f7afe75c9db138aae92", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217906, "uuid": "72de7c4d-8cb3-422e-a85e-10e2d80d78f8", "value": "C414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217906, "uuid": "f96b73a4-5938-4ff6-9ec4-e54e1abeaca5", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217906, "uuid": "2f134f68-a5dd-43c0-a51f-066786cad869", "value": "3072:popj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:upjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217906, "uuid": "9ba0ad2e-2428-4e76-9dbe-ab9f7253958c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217906, "uuid": "221fbc6b-a114-4c72-be45-a3f46d4fa5cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217906, "uuid": "c7163a0e-984d-4cf8-82d5-4d676d7a800d", "value": "126b720b9c42dac457cdfc012b39327c37617109b7c8566da3427d030044b346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e9d7c2-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232603, "uuid": "d5fd2b72-8df0-4a1a-a19b-f973c6874411", "comment": "Malware payload", "value": "ae49d8ef3d533116b2ec8091108e98a4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232603, "uuid": "5b8916e2-af49-4e5b-9514-80f7afdb1976", "comment": "Malware payload", "value": "1290626815982f15dc7cc769a2b44feaae7a2988555baf83b8f0834bc8262233", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232603, "uuid": "a79d103a-7701-4709-87ff-8c8d9efec7b8", "comment": "Malware payload", "value": "410a3758b00a63b66aafc8e13d8d7a79ddf1ef93", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232603, "uuid": "8c11eb64-d892-411b-8e08-2c6eae46b40e", "comment": "Malware payload", "value": "ccfe3685ccc409f192f2848c18c65a573d46b06868899aaf1f7c4138f3455487ca29f3ef9fad26f4d7fb59ff7ee23249", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232603, "uuid": "114a7a6d-31a1-4de5-84ad-ddacf70b8d14", "value": "E414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232603, "uuid": "22f6da05-92b6-4573-bc9f-d30deaa57cd7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232603, "uuid": "ccdd704b-7769-48a1-856e-11645bead9e9", "value": "3072:Iopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:/pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232603, "uuid": "c972dbec-a150-4fe3-adae-17d2bdf4276d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232603, "uuid": "e9b77f23-b1e2-4c03-a256-38bfbfefbd8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232603, "uuid": "fdbac608-b245-4217-b29d-aa76d2930eac", "value": "1290626815982f15dc7cc769a2b44feaae7a2988555baf83b8f0834bc8262233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b94037-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163660, "uuid": "08cdbeab-541c-4910-aa26-f4f516fbfce2", "comment": "Malware payload (IcedID)", "value": "f8114f6b3e377cebff044c11ae808a5e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163660, "uuid": "d2918338-09cb-490d-9c95-f0fa1cfb1bde", "comment": "Malware payload (IcedID)", "value": "129498b26d732ccdfbbee6a645a3b66c2320da68505a51e1df82992070baa3fe", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163660, "uuid": "a86ff548-6bfc-4881-93f4-ae18752cd475", "comment": "Malware payload (IcedID)", "value": "f290752911d6b4cd3bc51677adc72d74ebf95576", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163660, "uuid": "6e15ab95-60e2-4a3f-8ab6-fde6c5bbdebe", "comment": "Malware payload (IcedID)", "value": "31ab6c7875d672dd83823a2e2dfa3917468ee360c49929f3f2eb5c6c43dd0a1e1430b2f447e5da8e29af2c3f5d24548b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163660, "uuid": "baecdbd2-c8a7-4af9-8044-777b968904c0", "value": "6DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163660, "uuid": "81e72ba4-e1b0-441a-870a-39edd0de27c7", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163660, "uuid": "02545c47-4c52-4f7e-b16b-e231f4afb811", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163660, "uuid": "4cfb0d69-f42b-4e24-aabe-78139c555bd9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163660, "uuid": "bbad97ab-c697-4e77-8fbc-78a42067c4d0", "value": "document-144938486.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b7980b-91d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617164302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164302, "uuid": "64b28566-6662-4f8f-8171-4dcc8f42cb31", "comment": "Malware payload (IcedID)", "value": "e2be840c21c509ffd95b97272acfaecc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164302, "uuid": "1a5fb18f-da28-4fb0-b74e-e2fdc59cef39", "comment": "Malware payload (IcedID)", "value": "131705b45ea56c2c971d895fae4aaf73a4ebc53c86c67e0853ca8371dd24be33", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164302, "uuid": "05da0556-315c-4661-bd86-fa616019615d", "comment": "Malware payload (IcedID)", "value": "8e42d8d2ab536fc164a58f4980365016308b78e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164302, "uuid": "93be9961-dda0-464f-8b21-c271003d629b", "comment": "Malware payload (IcedID)", "value": "ab78abc13e61eb772eb4f140f9b29a1a7c75b60d1c10d69aadc0db2f9d18468dfc4acd7020a0ac9e1f12582c1878b31d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164302, "uuid": "eb822f71-935a-4f8a-a66f-4e704a4f4ce3", "value": "3CB35DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164302, "uuid": "93296426-544d-453b-9a35-ad3248ec57ef", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617164302, "uuid": "da641b6a-23f1-40f7-9448-7e922cdf7772", "value": 111325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617164302, "uuid": "0bc00116-7085-4eac-8179-f2a7d53e090f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164302, "uuid": "ead110d2-89d7-40ce-b92c-2a026f1e120c", "value": "e2be840c21c509ffd95b97272acfaecc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3330f741-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617195685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195685, "uuid": "dcf1813d-500a-46c1-8595-f539b053e890", "comment": "Malware payload (AgentTesla)", "value": "18682f7c6c3abed0a5065788bb9a5038", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195685, "uuid": "a5176a9f-850a-4983-accb-f8fe3477d1c2", "comment": "Malware payload (AgentTesla)", "value": "132f6929c1947dc27721aadcc329fc7cb0a000adb27016cd841fea36a4291954", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195685, "uuid": "84f78bd5-aec5-4deb-b740-ca2bf665e6dd", "comment": "Malware payload (AgentTesla)", "value": "5332ada38a056147a8b79cbbfc737b7142681875", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195685, "uuid": "fa5a4cd9-058c-47f0-9db2-a36bcadec2e1", "comment": "Malware payload (AgentTesla)", "value": "a0e0007c718cea87878e2747a99a029e3820958be66ce2c69b11b61e299e11a2cb7bf5858c059246ef2f530995571a36", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195685, "uuid": "303e8c99-8493-46af-9d66-24e7cb6a7f53", "value": "BCC423DB64CA9917D830F46052C7704F80138E0E5552A7BB62A22DD39E4F976F8E33DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195685, "uuid": "48192e3b-4c24-465a-9074-10cf8e4b04cc", "value": "12288:DMEnbHtqFLTbQjirPWmxCYjKKhA4PHSSbQPEJwReBEF3ZYhvLQzlsH:YM20juWmxnmKPPtbQPmO32velsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195685, "uuid": "3710d111-f507-45da-a702-33f2bb94cd95", "value": 591091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195685, "uuid": "9977904d-a439-4243-9dc1-1f55016f431c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195685, "uuid": "85f19fad-ffb4-4058-b69c-68fdfb2f2baf", "value": "RFQ9088QTY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd1fec8-9271-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230277, "uuid": "52d6fe73-c35a-4e56-96fc-9d5650deab41", "comment": "Malware payload", "value": "64b4c4e73ebb5f91b94a33b21e3cdde7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230277, "uuid": "4ccbd61a-230b-42c3-bd49-b7e3fc821eba", "comment": "Malware payload", "value": "133ecd2464911b7e50b9610725226046bdd5610f6b9803941fd61b283d106d81", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230277, "uuid": "0f574530-e70d-491f-9f4f-83b594ebfd01", "comment": "Malware payload", "value": "4a7d3428e991b4b3986f0b7efb83345fb1770860", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230277, "uuid": "9288325f-7064-4187-9a6d-d3ecc0b4862f", "comment": "Malware payload", "value": "def7b9df6adcc8b5e6d081d5ef8b21dc985927060e6520249fbba28cdf09fc05174e9a4ac2cf763267684c89ebdddb7f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230277, "uuid": "cb4c31f5-e0a3-4728-95f9-f344cefa16b8", "value": "0C248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230277, "uuid": "0feaeb5d-dd5b-4fa9-9941-a7d102ab27fd", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230277, "uuid": "9ad59e79-fb1d-4de1-858e-291b8acaec77", "value": "3072:m6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:moMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230277, "uuid": "72511ffd-81af-4f54-9ac4-bb3f9d4dea3d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230277, "uuid": "450ca07c-0536-46fa-bb21-00860497ec96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230277, "uuid": "244a54f0-2aee-46a9-b961-823a9b0baacd", "value": "133ecd2464911b7e50b9610725226046bdd5610f6b9803941fd61b283d106d81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d493402-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222760, "uuid": "3c6e9862-1d76-47ce-aa61-c9d6aab4d25b", "comment": "Malware payload (Dridex)", "value": "93ec3a68e545fedd5827ad336a478018", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222760, "uuid": "36ea53dd-8323-40ae-8b84-f28e514c48fe", "comment": "Malware payload (Dridex)", "value": "13a2c3b03a596baebdc6473e798d11099ceb9f4e19441dc93a5c4d5e8de1c97f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222760, "uuid": "8ce3cc9e-3d7b-48b3-ac20-3edaedb8c6e4", "comment": "Malware payload (Dridex)", "value": "17101db7e5fcd617d58659d35979b1615e079b66", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222760, "uuid": "dc70a20b-7ec1-4191-b030-7ed0a6654cce", "comment": "Malware payload (Dridex)", "value": "ac0102124822412b286b2f9ec7204b292926fd4305066d095d655144fe60d33eab79fff056f1cedbeac93784670cae65", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222760, "uuid": "1c712f30-d0ed-4918-bdb8-f87cc2b7298d", "value": "AD248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222760, "uuid": "d992dbbd-a742-4798-9646-2d2d78ac5471", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222760, "uuid": "d691ff76-f29c-44b7-a137-8619bd93b7b9", "value": "3072:w6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:woMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222760, "uuid": "fd5bfab9-c0ba-4e3e-8a61-df0e85b5808a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222760, "uuid": "02ccd5ab-2670-4f66-8795-aec4f54bd670", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222760, "uuid": "26aa116a-f084-44d9-8e06-d1d1855a6d76", "value": "13a2c3b03a596baebdc6473e798d11099ceb9f4e19441dc93a5c4d5e8de1c97f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f6b87f-925c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617221193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221193, "uuid": "adbe15f4-5459-4b22-b4e4-cee2dc195481", "comment": "Malware payload (Dridex)", "value": "b79aa7e57396d2f83fbdb4d14deb8d74", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221193, "uuid": "21620cbf-baaa-470a-8100-da97d990614e", "comment": "Malware payload (Dridex)", "value": "144f1d4a12a0143d0c900725e8c83758d78b50b221253c60b602b9500720c49b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221193, "uuid": "e3764161-1b83-414f-9277-eb82c1fe00cb", "comment": "Malware payload (Dridex)", "value": "dba8d5526426040d426919498fc7a3e4b856472a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221193, "uuid": "c7428296-599e-459c-9ce9-d3bd65401fba", "comment": "Malware payload (Dridex)", "value": "ae35c9a0c6fc84d1da237f90970a36b3eb991ef9ec148aee7b8b658feb0e2b5ab817bb046f01071f9778aa24919bd431", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221193, "uuid": "71b8f4b8-e44c-4fc9-8845-34fb5ce99444", "value": "3014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221193, "uuid": "45850b2e-d1af-4705-9470-f19e918a24c1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221193, "uuid": "4f36c064-5e52-46e1-9540-625b18debbea", "value": "3072:Wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ppjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617221193, "uuid": "b95528b7-917d-4eb1-bc0b-d18d13aee188", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617221193, "uuid": "9ca2cc7d-a0ae-4e83-a067-4cee9f299cb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221193, "uuid": "384a012c-9692-41cb-b51b-dae486cdbfc4", "value": "144f1d4a12a0143d0c900725e8c83758d78b50b221253c60b602b9500720c49b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a369040-924b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213655, "uuid": "62ea08b3-2cfb-4c56-87c8-1cf89009a0f0", "comment": "Malware payload (Dridex)", "value": "988cf83ef00459d20013a6f29c911914", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213655, "uuid": "65f9684e-1e63-4e35-b56e-5df54f529003", "comment": "Malware payload (Dridex)", "value": "1485f7dec0e3bd5a67884599e4204be1de2f272a363e7208860967dda5fccb89", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213655, "uuid": "a25f7012-67c7-40ce-845e-0ebb9e83a768", "comment": "Malware payload (Dridex)", "value": "c2ea9dcb3e1d264324d215a3ab883674b79ba5f9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213655, "uuid": "328980e3-79ca-449b-9f7d-5ccf773a79e1", "comment": "Malware payload (Dridex)", "value": "4be2bdf3b532b42346e968aa30cdcb1575b631657286ce454889ecbf0f8d290a1046999cb16564e0970d0661c8bbddf0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213655, "uuid": "3f052c98-5713-490a-b2cd-4b5469b9f0e5", "value": "5B248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213655, "uuid": "58a2009f-ff1c-4e28-921f-ea2b30e363a3", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213655, "uuid": "33d0c622-6cec-41e2-9dfd-645af2760014", "value": "3072:J6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:JoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213655, "uuid": "e00748c5-428a-4136-bfe7-3a20414edbee", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213655, "uuid": "c7bec1a6-c002-4b4b-8505-85f222f905ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213655, "uuid": "0c86685f-60ff-4b7f-be89-fa4f5791a627", "value": "1485f7dec0e3bd5a67884599e4204be1de2f272a363e7208860967dda5fccb89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53c5ffe-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218344, "uuid": "0fffc6b3-e833-489c-a90c-832e38a89a5b", "comment": "Malware payload (Dridex)", "value": "01f9202b0086096ede3f51b4c15beac4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218344, "uuid": "49429e20-8101-4a87-b1b6-679ee5c590ef", "comment": "Malware payload (Dridex)", "value": "14d4ee641cb9695c20a1fbd7a7c0636f2a85abca1d2b6fa057e5c45dcbcee573", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218344, "uuid": "0d7dbd9d-3fa6-4f4b-9757-c63d47e5e83e", "comment": "Malware payload (Dridex)", "value": "8495d84da3868737fb3c4b6c9346e7b7a6d211a2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218344, "uuid": "2c0263aa-5f4f-4bb5-9e24-9db4707cb21f", "comment": "Malware payload (Dridex)", "value": "a6eab2b54e05a82881204b22f2ffe11453dac27f96abc5c4c767d97a096749501a8019d349eed21326cc5bb55f9849fb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218344, "uuid": "f027971b-d886-42f3-b0bb-45614095d803", "value": "9214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218344, "uuid": "d142711c-0844-4130-a025-25775af35f59", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218344, "uuid": "856d44a6-d184-492e-9445-bcfdce78cdaa", "value": "3072:Aopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:npjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218344, "uuid": "1ac33985-b8a1-4a4c-b1e1-22b386cc7cf7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218344, "uuid": "e7efa85a-1ecd-45f1-b468-ed83ad06e397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218344, "uuid": "830527a6-09f9-44ab-8eb1-4fceea22e296", "value": "14d4ee641cb9695c20a1fbd7a7c0636f2a85abca1d2b6fa057e5c45dcbcee573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78db5472-91b9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617151134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617151134, "uuid": "7f7e483e-3cb6-4282-9b96-818174a484fe", "comment": "Malware payload (Dridex)", "value": "07df7b8cce6a0ebe0d5a89d1576d06ca", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617151134, "uuid": "e13bec15-19f7-4a29-9350-f67dbe3a1d57", "comment": "Malware payload (Dridex)", "value": "15164484d2d0e8f519fecb221758a23d1bb254e7ba8d36e29cb744842fb7e029", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617151134, "uuid": "39c609b8-9a42-4d1a-9dc8-cdd3080b4be3", "comment": "Malware payload (Dridex)", "value": "48e2e6b79712313a3b83561b89583d0ec5dfa636", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617151134, "uuid": "beb4308a-b628-4bb6-8056-e0335d0b3e86", "comment": "Malware payload (Dridex)", "value": "5c78d6891d4e86d84268767cb05f4cb00ea42a421babf2aac04a024391cd057c4b2339a688d92da42aa65a61a109c262", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617151134, "uuid": "e4b6358b-08b8-446c-bd56-a17d45250187", "value": "8714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617151134, "uuid": "5c5fa3bc-ef6f-4028-ae44-ab014de8b497", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617151134, "uuid": "2807cf94-8fcb-4830-946a-1ce332c0ab8a", "value": "3072:g1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ci78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617151134, "uuid": "87be320b-ac6b-4264-9559-b17e1e192a4d", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617151134, "uuid": "6468125f-61cd-425a-a193-66fc1ec84ce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617151134, "uuid": "9ac024d4-2032-4bef-b7d4-8c6672db205f", "value": "15164484d2d0e8f519fecb221758a23d1bb254e7ba8d36e29cb744842fb7e029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c56a7c-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232733, "uuid": "922f3d05-66a1-43f9-a628-6328c9274c0c", "comment": "Malware payload", "value": "a89a6d1bb4e5e84d16220ea1ee12b1c2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232733, "uuid": "5f8e6ff4-1f5a-4746-b52e-98764104544b", "comment": "Malware payload", "value": "151e35363a82e37b9582b2e2f7bdfb07995d446843956f0f309631ca449cc50a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232733, "uuid": "00d40d1d-ae07-4799-a943-485476ae3af0", "comment": "Malware payload", "value": "a5798c70f5d0f169fb75604a81d00429a94404ed", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232733, "uuid": "0f27e9b6-a9bd-43d9-b884-ad47e0cff318", "comment": "Malware payload", "value": "dd51ab22abc2c2ecfb415403683a9482599b2734539edfabaf6046c53069fdeccc6b3533ca071855a01572598ad25fca", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232733, "uuid": "c0582711-36eb-433f-a2f2-0a99e43bfd05", "value": "5014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232733, "uuid": "6f6b7ff9-9140-4cdc-acee-c5eb2c4dddba", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232733, "uuid": "03448378-3a33-4204-9820-ad732c082ec4", "value": "3072:Hopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:IpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232733, "uuid": "30abdddb-ea97-4f6e-b4e2-851d126c1d05", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232733, "uuid": "8d52b280-65fe-44b9-be4a-a0c26119bba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232733, "uuid": "ba963b64-0c19-4b0a-95b9-477304489bfa", "value": "151e35363a82e37b9582b2e2f7bdfb07995d446843956f0f309631ca449cc50a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b5ea6b-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218323, "uuid": "176db0ad-c5ff-4b68-88c7-963f00db386c", "comment": "Malware payload (Dridex)", "value": "f152747ad36b1ca6ca713a3acc5dc797", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218323, "uuid": "df1e4b43-41cc-4433-bb03-46b5048d6249", "comment": "Malware payload (Dridex)", "value": "155ea18f7d4be69469d8f689eb0c568a784fdec8f05000e515c0c02a1eff11fa", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218323, "uuid": "60600d1e-0c42-4f87-bce0-4014edaae28e", "comment": "Malware payload (Dridex)", "value": "e9631c3e7726b1733764e89502b0beaffb2a9a8a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218323, "uuid": "a0bc175b-ff19-45bb-9602-b6d189399646", "comment": "Malware payload (Dridex)", "value": "61ac61449874f7c2ffaa622f621438210c7e76d682276327513791fad769bc16a33ef411c282ac66108fe241bfd03678", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218323, "uuid": "cdd925c7-2245-4805-8653-d59c1fbb2141", "value": "1D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218323, "uuid": "dfc23a0e-97f2-481e-9988-35741cc23187", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218323, "uuid": "9ddffb73-200e-473c-94b5-735672618d3d", "value": "3072:Uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:LpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218323, "uuid": "040d290e-a851-458c-a7f4-005af1ed7756", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218323, "uuid": "562009c3-ef8b-41e1-a6e6-a6a8f35584e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218323, "uuid": "00040b31-bb35-431c-871c-c23b1b30a97f", "value": "155ea18f7d4be69469d8f689eb0c568a784fdec8f05000e515c0c02a1eff11fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acfe707-924e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1617215186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215186, "uuid": "a3789658-055d-4c29-97f8-d6be40c7b931", "comment": "Malware payload (Smoke Loader)", "value": "4f8f2b50223bce19f4111887035db876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215186, "uuid": "a4bb14bd-9639-4fcb-b596-45dff4a6cae8", "comment": "Malware payload (Smoke Loader)", "value": "15a0720242e0e13d577776fefa74c511a2e055e2d8b1c8a26778ea2879d5b66f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215186, "uuid": "79ebd39e-4057-4bda-9611-d2e0e0fa661e", "comment": "Malware payload (Smoke Loader)", "value": "0c5b8b9e8948189da64882b2f80a633d5ec8d8e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215186, "uuid": "d3145b55-6f5f-415c-9023-6b7206e7b3c2", "comment": "Malware payload (Smoke Loader)", "value": "755012f59ff1dee2a491e350447f33df10d664dce6813a0487372910b61db666db43f69b9563a9f050ae56688f4b035a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215186, "uuid": "49943cd5-ec51-41cf-a881-3202abb6fd8f", "value": "AC049C10B6D5C473D1921A750820D3B55A36FCB25F34AACB7B942B7A5E353D28B3A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215186, "uuid": "4a74ec80-6d85-43f1-a0b7-36410e095c60", "value": "061a2e87f94cf9f8906a2def43fae40c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215186, "uuid": "10ffd2c8-ffee-4ceb-8f32-ca65e91e66eb", "value": "3072:an5htdq3FnurakgZfUkgQwRLdOs/yT5NeF4rITGM9kqaKdJ:arto3crF7rLgsjIIXkqaKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215186, "uuid": "47592b6b-0209-4072-99ca-8d5887e8de8d", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215186, "uuid": "db130406-496c-43b6-bc63-e1b7a721ff66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215186, "uuid": "7e23bf8f-6ff0-4c39-a75a-7d333a664b18", "value": "4f8f2b50223bce19f4111887035db876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9078c4-922c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617200507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200507, "uuid": "398c9a13-4f51-41c6-b621-f42cbe204270", "comment": "Malware payload (IcedID)", "value": "09033c26026921383b7c322bfaa1de1b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200507, "uuid": "e6b82ae4-10a7-44ca-96a7-591301b7e5e9", "comment": "Malware payload (IcedID)", "value": "15b11b564a9cd9ccd46d91b8d319a53e2f8111b5ab9c4cd951122895a5ae6b3e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200507, "uuid": "608690be-22b9-499f-b9b4-0ef2acf6c453", "comment": "Malware payload (IcedID)", "value": "0e4c72e9fe695c9b7bc50bc4bd8488f3a48bd6f5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200507, "uuid": "26bec16b-c819-4f5a-9576-f1f1ac6c6805", "comment": "Malware payload (IcedID)", "value": "1a2ae53a73dc2f4cae7cc25ce1399c327b563b84eb89d251a14ee40a18e956b97c391ba71a4bab314315cbff32bdfc7e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200507, "uuid": "53bd6d10-9e34-4f84-92e7-ee8ea2302e1e", "value": "C7B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200507, "uuid": "3861b355-3da3-4c9b-b9cb-689badff2d4e", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200507, "uuid": "8a7987d8-bdf1-4a42-a876-ac6be0e9e71b", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200507, "uuid": "042a5a15-d2a8-4dba-85df-b831adb33a6d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200507, "uuid": "b78ee1ae-3b9e-417c-a433-99d47081235a", "value": "document-1311202198.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7743ee69-9259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219851, "uuid": "2e09afa5-7f1a-4ddc-8b70-9c8b9e46d475", "comment": "Malware payload (Dridex)", "value": "d31bbbe0a8bbf46228e7ec24d35cc39d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219851, "uuid": "331d9c44-50ff-44bb-adb2-245fadebb827", "comment": "Malware payload (Dridex)", "value": "1658ceef2ebfbf7aa75c1c2b7ef0db4002a317313d3c407df158dbfafd5d4f4a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219851, "uuid": "73e044ed-9f6f-4ffc-ba1c-51bfbc922595", "comment": "Malware payload (Dridex)", "value": "2292497ae4684f83cf98bed2e115a93e6ad6c3ac", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219851, "uuid": "93dc1d07-6076-4be1-abc1-6c4048f6681b", "comment": "Malware payload (Dridex)", "value": "c53caa3d2ddfe97a9a213c0f4e0f6a553884dffa7fc6bde37644ade6a1c131353ef5a60d51ad04f1752d1b02cbc57c80", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219851, "uuid": "73ee2e6e-1ce9-4584-9db0-d01b87d75b45", "value": "A714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219851, "uuid": "d0a09df4-274a-4d10-b528-74e127bcfe73", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219851, "uuid": "c90d6167-c429-4a71-85e9-87ed44aae860", "value": "3072:5opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:+pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219851, "uuid": "2312b91c-a521-407d-8000-28e584609f30", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219851, "uuid": "e4fb5870-5e92-4906-8b12-78a9e4d83c3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219851, "uuid": "dd2e623b-49e4-45c7-b277-05351f9d7864", "value": "1658ceef2ebfbf7aa75c1c2b7ef0db4002a317313d3c407df158dbfafd5d4f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38421d16-926e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228765, "uuid": "854b6a83-c28d-4555-98e5-5a71ca16083a", "comment": "Malware payload", "value": "ad1cc51b701de055adbfa99b752713d4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228765, "uuid": "e7f7818c-310b-461a-a73f-2b873c848e9a", "comment": "Malware payload", "value": "165abe516a85d66cf46e690b772b833af6d75c04fc78bebf1888f89599e257e7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228765, "uuid": "84f77b7d-fa7b-4cec-a2af-0f63afdaae88", "comment": "Malware payload", "value": "999a110c30ad2fe70ef6b39a4bb5d0b61df7edfc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228765, "uuid": "5331a6b9-c092-488a-a59f-d4079fdd9eb2", "comment": "Malware payload", "value": "19165a58c1257c035a23a9d8e246a16c05149ffcec72ca09b9bb33c9a4e2b1be68245de21538cfd028cde363b85e2111", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228765, "uuid": "01548e89-3b95-4d9f-8c22-44fd91adaca0", "value": "7D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228765, "uuid": "80fa493c-f3b8-4df6-a6ba-3ffe10aa0a6e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228765, "uuid": "6d93196a-62fe-440d-b364-64dcae7784ef", "value": "3072:wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:XpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228765, "uuid": "4e71f12f-0afb-4ce9-8dd7-f620752a84c2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228765, "uuid": "27562cad-1d3c-4549-8b72-b432307f6522", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228765, "uuid": "dde94f2d-61d7-4fcc-86e7-404a4bfa46ac", "value": "165abe516a85d66cf46e690b772b833af6d75c04fc78bebf1888f89599e257e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff10e7b7-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218790, "uuid": "d9d02f2a-93e6-4fe7-9106-11fb6758b933", "comment": "Malware payload (Dridex)", "value": "79971c995d4741f245c7183449bdc1a9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218790, "uuid": "93a8604a-a90f-4e51-9252-d04d04227b09", "comment": "Malware payload (Dridex)", "value": "16be82a4cd4c4c3b42ce972ef50ee375d504df4d4d9694d0791d0e4d162d68b7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218790, "uuid": "9f05c149-a95e-46e4-9f6b-20e8b1e7617d", "comment": "Malware payload (Dridex)", "value": "c9080f158bb2cdc49993bf5ffc9c1dcfccfe4af7", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218790, "uuid": "124853a7-adcd-445e-8cd4-d33197cbd242", "comment": "Malware payload (Dridex)", "value": "e2bb2fe1eaae56548145fb2b233815dcefe76dc415c4417161e3c15194d74744726cf9352f6453e3d98219555cd674b5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218790, "uuid": "9b2c637d-0381-439a-8fd6-d58b121bf06c", "value": "FB14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218790, "uuid": "b9e1755a-7734-4a55-9d21-4c5efdcb486e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218790, "uuid": "73456c72-7394-406a-870e-1b2263fccd47", "value": "3072:7opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:MpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218790, "uuid": "666f7220-c311-4bff-9513-93f74791da98", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218790, "uuid": "a6f89874-172e-4939-bd4d-cae99839d38f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218790, "uuid": "43cad887-c260-49c8-acf8-0a591d7bf2ae", "value": "16be82a4cd4c4c3b42ce972ef50ee375d504df4d4d9694d0791d0e4d162d68b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b176cd-91d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161350, "uuid": "a17a528a-61d6-4e28-a333-cbe07340458a", "comment": "Malware payload (IcedID)", "value": "a8306a0631c306438c7c0c1c249e317e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161350, "uuid": "1668109f-9e22-4e49-b286-fddcca86b05c", "comment": "Malware payload (IcedID)", "value": "16f1a0307b803a9ee8ca10d419e28e49798f1324c41343605585b652aef5f4ca", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161350, "uuid": "f9ea57e7-7092-4214-80c7-c79c7174dba1", "comment": "Malware payload (IcedID)", "value": "72d20e3710635c3f3a2bfe7225bab06172923b80", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161350, "uuid": "d5534d59-96e7-47a7-aa13-1524231c8f84", "comment": "Malware payload (IcedID)", "value": "62c567e4e8856693a8183716be18c0dc322840932270e256aa2058b2052a542210886fc3e2dd9a70a02e4b7e216cce34", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161350, "uuid": "9ca7e3ae-f00d-47eb-83ba-8e12b8433ea4", "value": "22B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161350, "uuid": "e97444be-8a7e-4b24-82ae-3088905e60e3", "value": "3072:e2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ezxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161350, "uuid": "cb892b5c-2a89-4196-8fd8-96131c31eea2", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161350, "uuid": "af1bdf35-a6a6-4771-a6a4-b110c2f60abe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161350, "uuid": "91dfd59d-e4ec-48c5-b82b-26db333caad0", "value": "document-968581210.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd08fa93-9257-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219163, "uuid": "8d0539b0-f39a-4c27-b29c-07a69bf8aab3", "comment": "Malware payload (Dridex)", "value": "2f52d0ffc758eb6b9db463ac61945aad", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219163, "uuid": "7f5f6bdc-1a2f-4003-a38f-4c35ea0d4600", "comment": "Malware payload (Dridex)", "value": "17382805bc10d20e05e7e4781caee2dd42e5e770ee5631d6a6ea8771b56ea950", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219163, "uuid": "8844dc8d-fe05-4480-8cf5-d5674dd99fb1", "comment": "Malware payload (Dridex)", "value": "a34ef1e56c250aa55d83822cb690e0b5c0fc63d2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219163, "uuid": "2ef72de4-29da-4102-974f-de673482a92b", "comment": "Malware payload (Dridex)", "value": "70158e27482048d68dc8c089cabf0e96b2a506c6b01a82c65ad875fde0f38c5c18232d722eafacf2370dd61f7603c332", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219163, "uuid": "30bd0321-16fc-4610-844a-4dcfe1672c4d", "value": "A614BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219163, "uuid": "4ef2560a-cdc3-4354-b55d-d1abaee16ac7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219163, "uuid": "96821acc-be23-4272-bca1-2900b64858ef", "value": "3072:vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ApjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219163, "uuid": "f7d976b3-0c22-4745-9bde-a92311ae62c7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219163, "uuid": "4730f1e4-e080-4b44-b149-012658ff1f6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219163, "uuid": "95e17de4-1c18-441e-8e6c-01365a7ed112", "value": "17382805bc10d20e05e7e4781caee2dd42e5e770ee5631d6a6ea8771b56ea950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65c6e0e-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199314, "uuid": "8e5a2550-c10a-424f-9250-876f38f238c0", "comment": "Malware payload (IcedID)", "value": "83c74f86214c72d275ff89ae6cea2bcd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199314, "uuid": "cd9c1735-d575-4069-a3b2-c6ab0f6d8c8a", "comment": "Malware payload (IcedID)", "value": "173fde5a9f56f0480a772b1a8121711cb0de5fc0b19bd7701d8eaf0f9186d338", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199314, "uuid": "a9eae7bf-90ac-47b8-b0d5-b070268f7512", "comment": "Malware payload (IcedID)", "value": "75537c8bdd0dd473a0f2c5a184cc5360390971a6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199314, "uuid": "52e27e0d-a174-4d0c-9db4-35a1f62ff4c8", "comment": "Malware payload (IcedID)", "value": "7ef45d311b52a7e2e8de748df57481ccbcad15fe45895c212a87ef34c702546c032504d6e7c0aadc4642730687e073f1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199314, "uuid": "0c8677b5-0863-4205-ba4f-e4e17d4dd755", "value": "7AB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199314, "uuid": "f8d0f834-0f3b-4302-9500-65bca97cb02b", "value": "3072:Q2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:QqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199314, "uuid": "a2422926-023e-4864-969e-3120b0e51fa1", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199314, "uuid": "b7ed83d7-50cd-47fa-892d-95e7cd58f52f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199314, "uuid": "deced8d3-7dfd-4837-8f6c-655c36ca6635", "value": "document-1940899817.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f54a126-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199974, "uuid": "cbc5ab60-bc58-4757-a6f4-0e96008662a6", "comment": "Malware payload (IcedID)", "value": "a0a988f56e7d2a9694a74b1c801d8478", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199974, "uuid": "eae41da2-8ba2-4d27-b9b7-eeee5ba9ddce", "comment": "Malware payload (IcedID)", "value": "1746135a92bb6d9e2c0cf153f834fc95a09eb723a720c9e9e5939890bd842bc9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199974, "uuid": "6b5f74cb-cfbb-4f94-9c3d-b24af206e734", "comment": "Malware payload (IcedID)", "value": "327536612fa3d58c6cdc55922f65cefcdd74fefa", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199974, "uuid": "ea922a20-f8cf-4733-aea9-654c51c90095", "comment": "Malware payload (IcedID)", "value": "b3a68d1c56c9ddc43ca3b68f05b3f0f53f0941b8dcad20baab603e954c24a8e0da9c04d3f491eeb9b1fac508ec296dec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199974, "uuid": "7be682e3-ff16-4053-b4bf-dbfc69040103", "value": "17B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199974, "uuid": "02ea0686-3fed-4e66-8600-8d65b247f7f1", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199974, "uuid": "62b12298-b3a3-4caa-bf51-27e00346c02b", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199974, "uuid": "8ee75935-5464-4917-9e9b-e11ca8932de9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199974, "uuid": "d4ba3adc-1db2-42bd-bb62-59dc9c4cd3a4", "value": "document-888960598.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3177062-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205000, "uuid": "0ee14607-febe-44ac-b0b8-bd4f80f33c0b", "comment": "Malware payload (IcedID)", "value": "3c8c437cbe07639b232443fa04206a49", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205000, "uuid": "b593c0b2-e34f-48bc-8c7c-697fdfd71978", "comment": "Malware payload (IcedID)", "value": "175253e3dcfacfeb7a7bb6ab7e7e609f33797d10162ae518a062d2e9f214e0c1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205000, "uuid": "972ca6ae-d279-444f-9565-7c1df806ade6", "comment": "Malware payload (IcedID)", "value": "20eca8676b9344fc3d7083da8d6efeaaddcda821", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205000, "uuid": "12ed86a8-9fdc-4218-b0d3-370612d113a0", "comment": "Malware payload (IcedID)", "value": "4438f4fe3aef3b30bfcffff105c8e9260565d97fea9a9d7c8e7aaab8acc9a942f11cafab175ddf95bed7b0d0e1f63d72", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205000, "uuid": "7a78c2db-df57-4dc0-afc4-38d974a4f0fe", "value": "99B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205000, "uuid": "106ff305-660d-4a7b-893f-15ffa81e39f1", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205000, "uuid": "0a34b4c4-d56e-475a-b9e2-560f29d763d2", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205000, "uuid": "65f236b7-8768-4bb5-86cf-5401c2505631", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205000, "uuid": "40faedc8-f5ad-4bfa-b986-573ec773338d", "value": "document-2056113685.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e795a952-924c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617214456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214456, "uuid": "aed05641-b3b1-4eba-8793-7afe2a724441", "comment": "Malware payload (IcedID)", "value": "5ec10eb5d9919973ef66145e9a54e44f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214456, "uuid": "0e517d08-7561-4c03-8b0f-88e260099c28", "comment": "Malware payload (IcedID)", "value": "1768f700782051f2a73acded86ef380f500247ff2a154a4b9756f5ef9488b8e2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214456, "uuid": "0cd08cce-0110-48b6-bfb9-b0fb19636966", "comment": "Malware payload (IcedID)", "value": "3626cc4c22ff15228d6a072b5184d8ce10c4c918", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214456, "uuid": "9683ffdb-9666-4fc4-aafc-43fee64ee218", "comment": "Malware payload (IcedID)", "value": "b521ec465a592fd67135eba7c347c97520df256100d561755f2d7b5910069fad0529617b58554a33e5200d2ba4e8f927", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214456, "uuid": "012c3541-357d-4b04-a5a7-35fb0ab43b90", "value": "A9B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214456, "uuid": "2c80cb65-c9ed-4097-91ea-6c7150995df6", "value": "3072:u2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:uqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617214456, "uuid": "ff3e4fcd-f2da-477c-a10e-de138363841d", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617214456, "uuid": "058ce5bb-2fc9-44f9-93e1-81ff2857f784", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214456, "uuid": "1f1e4384-8aad-4f28-9d60-575b25d898af", "value": "document-586537513.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5613c5b-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217835, "uuid": "3ff7e3db-078a-4522-8823-9e8547759165", "comment": "Malware payload (Dridex)", "value": "403aa3c33c952fc146593f009a4a28fc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217835, "uuid": "4623eb14-f8e2-4e70-9c3a-4710c3449062", "comment": "Malware payload (Dridex)", "value": "178c94048f09a48e9e1b03661d0fe08edf4fec945260e66a14d3321d7929b86e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217835, "uuid": "c5470eb7-2ef0-4539-b033-bcd479583be4", "comment": "Malware payload (Dridex)", "value": "8eb6a6060c9a7eefa3760b8cc69d0fd36bdb6463", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217835, "uuid": "25e10621-bc07-4800-9777-60522c199a00", "comment": "Malware payload (Dridex)", "value": "d5c149cde77488dd6b68d869e28a899def88b183edef95e5a5ee86ad8c829f2100ea374be40011294725355bafccb68c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217835, "uuid": "d39a86f2-67b1-4b6e-8aec-5797d6a50c21", "value": "4714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217835, "uuid": "2d8a3ef0-8d91-4afe-8287-dc1bb01bf07c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217835, "uuid": "4e7ee546-986b-43e4-9890-d1313678c4ef", "value": "3072:uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:RpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217835, "uuid": "3283053a-d4df-4e81-b24e-026adb15d68c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217835, "uuid": "c9c3c07e-072f-46fa-991c-d60ee9308bb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217835, "uuid": "e2e77633-ff21-4249-8648-d21cb1d357d8", "value": "178c94048f09a48e9e1b03661d0fe08edf4fec945260e66a14d3321d7929b86e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b174f28-9216-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617191054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191054, "uuid": "9d657834-ec7a-4c08-8420-969315635582", "comment": "Malware payload (AgentTesla)", "value": "26be1be0b91d39f0d34d57a186e050f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191054, "uuid": "2d72970c-e6b7-421e-b2a2-b1d0170d0906", "comment": "Malware payload (AgentTesla)", "value": "17a08f17e69c29763d0e6e6758da98d34c724c5918cbf3e3fa4539b4a4876bc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191054, "uuid": "a6ad8303-ec09-414f-aeab-77a9150f35e9", "comment": "Malware payload (AgentTesla)", "value": "abef9f16c9a80e1ada2e8fec590e1b8f84a08523", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191054, "uuid": "e2374760-d7c0-4293-9735-a76a4ecfb6eb", "comment": "Malware payload (AgentTesla)", "value": "6fdceb05585dcc19d486376c7d7e18e7cca0a08eeaaca8d86dc34ccc3f23e1d8dafd9437749691e66588ca3fa181e32c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191054, "uuid": "1e0ca509-bc5a-4f34-9ff2-536d04ab5334", "value": "3EF4D015320ABD86E07E8BF100ED4741B3F357C48719E97DBC94D1989AE22C3BADA6C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191054, "uuid": "4c50b602-5d43-48eb-ad95-795eb4020fbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191054, "uuid": "7aa3ee37-b49c-41f6-a81e-2d170c604a69", "value": "24576:gwufxBhEStCFJpw1AT3rsqk0/5x2uEhRl:2pA3Yt0//6Pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617191054, "uuid": "9fbda70b-2c06-4ed9-a36b-70731c3916b6", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617191054, "uuid": "ccb2c94d-b81a-4394-ac2b-6ffe3811b6da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191054, "uuid": "2f9f8ccd-dfd7-4f17-8118-05fccae53e22", "value": "SecuriteInfo.com.Trojan.PackedNET.576.12750.21331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7760d6b5-9269-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226723, "uuid": "2e04cfdc-3bd4-4456-b13b-a768860bb9d9", "comment": "Malware payload", "value": "1f5bfe1a8b13f589a7765acd055bcd5d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226723, "uuid": "a21aee71-c94f-4ff1-823a-dc56fabda867", "comment": "Malware payload", "value": "17ab7eec0a074dc3011e7c6732da6aa13a9ad646c51ecb260ec8b3d119955dfb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226723, "uuid": "c2037c11-e52e-46ac-80e3-8fe5d5a66781", "comment": "Malware payload", "value": "e3382af470382e1f95243d406581da2288aa821e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226723, "uuid": "f7b96e15-34c0-44e0-b5d0-1881d1d85226", "comment": "Malware payload", "value": "94871929196ca15cee407a1a4c76f3ed667d1e8a0cea463aba3065a8c0145410bbdcbec9c80b2f70a49acdaaeaa390d8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226723, "uuid": "75e4554a-c4c5-4653-972d-9258050ab129", "value": "30248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226723, "uuid": "e78e1b21-b4e8-4e9e-a1b4-eaa999e37153", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226723, "uuid": "f1d65900-54ea-47f3-a5e8-d180adb94b72", "value": "3072:F6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:FoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226723, "uuid": "8cc5544f-cb3c-4b4c-acc4-4a3c2607646b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226723, "uuid": "b962916d-d9cd-4f73-882a-79b38673192d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226723, "uuid": "204b54fe-6980-4031-b667-6a729a5011ef", "value": "17ab7eec0a074dc3011e7c6732da6aa13a9ad646c51ecb260ec8b3d119955dfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa95057-9270-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617229681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229681, "uuid": "71b9f6ec-3224-4bd4-bf0d-c40798cb1287", "comment": "Malware payload", "value": "330ceef18995247ef5628bf593be9178", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229681, "uuid": "0db1a583-a386-4185-90b8-5731bb0117c6", "comment": "Malware payload", "value": "17fdb4af96d2a885eef2ef1e421e245d57676d8b8720cf2dd3eef86ffe086f55", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229681, "uuid": "a5c651d6-d8d9-42ab-b609-ad4df71e28f8", "comment": "Malware payload", "value": "5d72dd021408145534311fc26d52e11fc7254942", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229681, "uuid": "9065c3c0-4c87-4cf1-b918-b3ea89866870", "comment": "Malware payload", "value": "d2b9478a5849fe35854065a6fda88a453207474fa99f2e6dfb1dbdd3e0f93b2dbb63e330c11484c1c641eb5fd8a435cc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229681, "uuid": "eb129be5-c20c-4d7d-a68e-02ed7141aa3a", "value": "62248C5FE339E486FEE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229681, "uuid": "54bb579d-affb-4387-9c01-e8418d55f420", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229681, "uuid": "61311dca-e978-49f3-b617-6d3cbeaec544", "value": "3072:R6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:RoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229681, "uuid": "7f0c4f84-e7db-452a-925e-e04f9ab31f75", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229681, "uuid": "5109a5f0-a0a9-4e90-85df-5dbeeff5b8e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229681, "uuid": "c5b623b0-8f15-4d78-910d-05fffb828d64", "value": "17fdb4af96d2a885eef2ef1e421e245d57676d8b8720cf2dd3eef86ffe086f55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9811122-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222996, "uuid": "0cd93cca-4b7b-48c4-953b-fbaad8ff9682", "comment": "Malware payload (Dridex)", "value": "384272c4d0ff2511867e85b71afc4b95", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222996, "uuid": "1e2ad03e-c6dc-4be6-b479-f9380c2e3ac0", "comment": "Malware payload (Dridex)", "value": "1842c77e1bbf2de11da0a64724a8804866e6cb74d38c7ebef011a23c42072e19", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222996, "uuid": "0f956a02-9f2e-498e-b86c-f34c010623d2", "comment": "Malware payload (Dridex)", "value": "1de6afa622f9edf2ec1d4f1d9c6477a29dc68ae1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222996, "uuid": "7c982b7c-1fc7-44dc-9f86-ffa9f1d5ac55", "comment": "Malware payload (Dridex)", "value": "3f00749b7aec2f38b80db91d9faece31a666b0b41b33dcffa18541aca8d0935da1cd264d4efc35272606b9ce0b490ac2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222996, "uuid": "d29d1537-2b9a-432b-a292-05a9547b5fa1", "value": "98248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222996, "uuid": "fd34b4a9-02c2-4a81-8968-5d1a18acfbb4", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222996, "uuid": "dff8e51b-db02-4cf6-88b1-383ac9370298", "value": "3072:v6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:voMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222996, "uuid": "ec947bd6-fbf3-4d53-97dd-5502227ad065", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222996, "uuid": "fd789a86-b6ac-4653-8d67-f5c9ca691a58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222996, "uuid": "b5f7a411-da3f-4973-807c-0549fedf8256", "value": "1842c77e1bbf2de11da0a64724a8804866e6cb74d38c7ebef011a23c42072e19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f0841a-9258-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219466, "uuid": "ad136fa8-df62-4795-81c0-84d551e55765", "comment": "Malware payload (Dridex)", "value": "49ad42249007de694b6fe201aa7f6a49", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219466, "uuid": "074c4964-ad09-4e41-8652-cd271fad62d0", "comment": "Malware payload (Dridex)", "value": "186482d2a1b9b5761a7c27f5a6df5b3e4ac6df7f9dcb51bdee02362d6a144af0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219466, "uuid": "350c0dfd-7cba-4580-aaa0-fa7bd2bf48ef", "comment": "Malware payload (Dridex)", "value": "9638052b0800b68d7ca92fd9f7fdcbf9d43a2ed9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219466, "uuid": "1c23cfb1-0e2f-458f-af84-6886b480c163", "comment": "Malware payload (Dridex)", "value": "acf8ae7bdb5b2e191efb82a94ba44447191ee991e2f9df2febf420d1b0bc33a369a0868aacce9be7f61cea0a5eda3086", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219466, "uuid": "160d851c-8141-49e4-b8b1-fe409fbd3f34", "value": "8314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219466, "uuid": "c73cdd2f-c3e9-41e0-80b7-1d880e2d59c0", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219466, "uuid": "268c4c3e-8c4b-4916-879b-9152dfc5da05", "value": "3072:Aopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:npjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219466, "uuid": "36a1e628-6c4c-40ca-a677-c29e3f893155", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219466, "uuid": "0caed432-3566-4645-ae3a-42ad892cb1c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219466, "uuid": "97ce409d-267b-48b7-aa15-45d6f7e5dac8", "value": "186482d2a1b9b5761a7c27f5a6df5b3e4ac6df7f9dcb51bdee02362d6a144af0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17fb0e3-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213184, "uuid": "11ab34b7-4def-41e6-a38a-27a32088aefd", "comment": "Malware payload (Dridex)", "value": "3883f8428bc37d215e6509f305baf94b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213184, "uuid": "4f3d4503-0c44-4649-9e0d-94c6b5becf46", "comment": "Malware payload (Dridex)", "value": "18ae85d1a7627039ccf8c7d28db1c43b41c593faf3342359497810e75f9d0f05", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213184, "uuid": "f13a8aef-94d9-4630-8c63-d811d4f86b35", "comment": "Malware payload (Dridex)", "value": "5f6004f38130a18e99ba22affba719559f7443eb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213184, "uuid": "506c27bd-bce5-4b95-b2cd-4e6073c18bd5", "comment": "Malware payload (Dridex)", "value": "d1ce229f3f9f5b5d48a8744a17ec641aaf792beda9bd3ccdef96d2fdcc329a9529e3e2c73ea978529337c34e1d80b5a4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213184, "uuid": "edb27b01-bbb7-4734-9bf2-e3a26552e519", "value": "5A248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213184, "uuid": "3e0806d4-fc0e-4d2c-b08f-0aaba55a53e5", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213184, "uuid": "04af719d-6ccf-4071-a03b-2d123003542c", "value": "3072:p6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:poMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213184, "uuid": "78f743ca-de5b-401c-a800-71bf97e8ad0b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213184, "uuid": "081eb897-1170-48bc-8f3d-b66a3c1e2642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213184, "uuid": "d41359d2-8c36-466f-be45-878f5f908a89", "value": "18ae85d1a7627039ccf8c7d28db1c43b41c593faf3342359497810e75f9d0f05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5538eb63-91f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617176415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176415, "uuid": "66b65d24-325d-46fc-acae-ddf556d24b41", "comment": "Malware payload (ArkeiStealer)", "value": "d192602559ba8dd614714978e0fdbf2b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176415, "uuid": "9c815bf1-5faa-4551-9bb5-87327364ae5c", "comment": "Malware payload (ArkeiStealer)", "value": "18d8d0fe50b484ffb499c851cc2964239a5693b36940879e856b970f29e22765", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176415, "uuid": "b92d14fc-57d2-48bd-8dbc-6e916b34d8ef", "comment": "Malware payload (ArkeiStealer)", "value": "37889d691b1ee17ac2ef4af39e8d136cfa6b923d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176415, "uuid": "c990be6f-7cf5-4173-9555-c6c659b2660f", "comment": "Malware payload (ArkeiStealer)", "value": "ae889592ca8bac8a28d0fc71fbfe0e5807055936ba4c7c09e1d4e03c33db716775c8adbcf0cbf8eea5a70579504f6ce7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176415, "uuid": "89b087d8-435f-4301-b772-fa8ddf64169d", "value": "78F5332130C3E889C1556F71587BDA2C46200FA544DDBE207B727A7B7E7FE069C2A19D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176415, "uuid": "8c4ba357-8854-465f-845d-c567803d2438", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176415, "uuid": "9afaa96c-60c2-496e-9fa6-09bea029ac9d", "value": "98304:jh5eXlcj3RIrVjICQLfV3XeHTOUlqblbJuKDQnn:HycEjhEV3uHSUlqbqKDQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617176415, "uuid": "df5b4697-dc7d-4114-bec7-343d1205817d", "value": 3646897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617176415, "uuid": "92384813-6dc5-4880-a89b-3b78bbfa06cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176415, "uuid": "5c373432-e00b-4ef5-8963-66e9b6b46820", "value": "d192602559ba8dd614714978e0fdbf2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350243f3-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199983, "uuid": "6e29b146-7d64-426f-8b75-ba3c7233b988", "comment": "Malware payload (IcedID)", "value": "b68ec867a15ec3a9c9b17cab0535ce8a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199983, "uuid": "2d2b16fa-7b98-448d-a4d5-c6ff6bf31eee", "comment": "Malware payload (IcedID)", "value": "19037aae2f93f3e19be7cbdf0743811afbaaded104d7ceffdc526778ec4dfe68", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199983, "uuid": "0bb0c421-8619-4391-a558-1aa22dadd929", "comment": "Malware payload (IcedID)", "value": "3f76bbc403691ed74eb8c2142cea9b716a75fc6c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199983, "uuid": "7e6648d9-4918-4a5c-bf3c-889e9d82c0a8", "comment": "Malware payload (IcedID)", "value": "038afa0513a7daad3f9877add682ebcc238a3d20fbf6a68c57c37dca1eb3c2bb812caedc15541f70e6ed802468d6e30c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199983, "uuid": "c792dd1c-e401-4b82-b539-6831f021bcd3", "value": "50B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199983, "uuid": "9bf6cc4e-ee95-4991-a71d-93bdd96f6d1a", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199983, "uuid": "8427acd8-3170-41df-b89a-20a8e56db4c1", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199983, "uuid": "ed3cfd65-6880-41a9-9399-8494bb429ea7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199983, "uuid": "24ec7f93-0ec2-49f7-bdfc-96b9bf026027", "value": "document-1963742566.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6652d15-924c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617214454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214454, "uuid": "824f2274-7ae9-4f23-ace5-081c48fa1eb5", "comment": "Malware payload (IcedID)", "value": "ae42ad0c6f4b024dbef5f3244677d46a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214454, "uuid": "e8c32972-2768-43aa-8ec8-8110f7cb8d0c", "comment": "Malware payload (IcedID)", "value": "1909af5aa71c9eb92525f387337386c5bcad6c33db8bbcf96d444eea3cca88b2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214454, "uuid": "c92dff3b-9225-4e0d-b184-a91ec5c411c8", "comment": "Malware payload (IcedID)", "value": "756243f8aee71e8d772204bfffad2c74fa451f69", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214454, "uuid": "434dcb52-145e-4be2-bf68-c8f28f8884f1", "comment": "Malware payload (IcedID)", "value": "4302f63b5941d78cd77f2017516a1ae0b6030fc2f9b345c4ba7a419730ec9d93b540feb0501457217387cb30bb478828", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214454, "uuid": "295db638-aaa6-4d6b-b493-3ee35449f9aa", "value": "04B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214454, "uuid": "2c8408bf-442a-416f-a2ad-e10c4d5061a6", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617214454, "uuid": "d5473862-f240-42ff-bf32-c38821f59641", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617214454, "uuid": "7cc2e099-fa7d-4a80-a88c-d0d4bebaabb5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214454, "uuid": "51e1af36-e1e5-46c0-8445-fc4e1aeeee51", "value": "document-1811269384.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc370d4-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232770, "uuid": "8761b2a9-31eb-4305-adc9-ed2c5e1675e2", "comment": "Malware payload", "value": "3560b583bb78594a28dfc7c7356fe7cf", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232770, "uuid": "fbaeaf7b-20f3-4889-9e2f-9ce6fefa0351", "comment": "Malware payload", "value": "1916baf93362b475dcacbe975639500b26aea8e9c07a8195803d90563dcb814f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232770, "uuid": "69e0881d-270b-4cab-a229-9c4ca6b927fe", "comment": "Malware payload", "value": "e7524b3622d5caa17996d03f9980a5499b46feab", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232770, "uuid": "e978de27-fa16-40f8-89d5-6ff962c582ee", "comment": "Malware payload", "value": "1ee2647f9a6bc5b774e12e96f43b132c17546d45e932bd3e00ea35d9fa6c1c4c78271fb64178d76dfa7f5b05df87220f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232770, "uuid": "6d31fbfa-9371-4a27-9edc-91b708d73418", "value": "D314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232770, "uuid": "56c48233-ea51-47c3-a2f4-abd612acc069", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232770, "uuid": "1e2311cd-c951-4280-ba85-4b3222eed651", "value": "3072:zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:0pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232770, "uuid": "c109b013-536c-410b-95a4-6e641e04245e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232770, "uuid": "53b53151-ccb4-42a4-b836-4cccd680e622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232770, "uuid": "b34faf0e-7817-47f4-a85d-85d41b575a7b", "value": "1916baf93362b475dcacbe975639500b26aea8e9c07a8195803d90563dcb814f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba4a6c3-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213282, "uuid": "35ef28a4-a88e-4c62-be8f-e16818c9fce8", "comment": "Malware payload (Dridex)", "value": "db95f12df27031312aeedf4d4212597b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213282, "uuid": "aa807ef2-e1d7-481e-918f-44ecb8045865", "comment": "Malware payload (Dridex)", "value": "192a0ed1c9faac9a4d9c1bf8a2f580caba7c1fc54273888662cd7c6eee65f445", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213282, "uuid": "9080ef0e-fdcb-488f-8db9-2c6018498149", "comment": "Malware payload (Dridex)", "value": "c000e4f89bafdab9e656f9017c9cd07b7535b145", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213282, "uuid": "22694a79-9750-4a02-be12-2e6421018ddc", "comment": "Malware payload (Dridex)", "value": "2db0cc982c2ab2bb8a0f4d5cb76a3e2fb4a4a55e6918cc9c0ce693eced14bc6fd74fde1e0d6011d0e5e3e3f43452ba17", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213282, "uuid": "5356bda6-9e4f-46d7-a207-1e890a795649", "value": "5F248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213282, "uuid": "e71b6f33-31fa-4c7f-a0b8-2680199297b6", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213282, "uuid": "085d4b66-d5d6-4798-b190-053caaec45b7", "value": "3072:26TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:2oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213282, "uuid": "6f699bba-4287-44c8-bca5-928ea73496b7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213282, "uuid": "a2a1f186-311e-4220-86e8-635a8f0b55d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213282, "uuid": "20883f79-b658-44bd-966c-a9a88d5305fe", "value": "192a0ed1c9faac9a4d9c1bf8a2f580caba7c1fc54273888662cd7c6eee65f445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a725ff-9231-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202501, "uuid": "78355b41-7336-438c-acac-2e9ce2d180a7", "comment": "Malware payload (IcedID)", "value": "d6632bcb5024e871faf0106bd7391382", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202501, "uuid": "13b63a8c-6b6e-4c2d-85e1-bb82a3dccb3f", "comment": "Malware payload (IcedID)", "value": "192ca8abdb8d70c2c7c366145ec1dfc7b06fa56c0ff74f40d60191d067b3242a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202501, "uuid": "8133206a-82d9-4506-b4ab-0a08b01aa6f2", "comment": "Malware payload (IcedID)", "value": "d61e9b8e3e4db1faffa75348bf1658a57add07f7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202501, "uuid": "a6085983-658a-49b8-8d0e-f0eb6b773b1c", "comment": "Malware payload (IcedID)", "value": "f9cd56c54ea1b87eb6cceef9553f77a6146fe58df2809bf6f50ff84bbb6790e10fe8e92db8173d0771d492596981cb12", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202501, "uuid": "a95072f5-d4f4-47c1-a7fc-9d6b503f30d9", "value": "6DB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202501, "uuid": "40969b97-eeec-4792-befe-6a48d2c2acb0", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202501, "uuid": "836efde9-ed5c-406a-a30d-cfed33df4f08", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202501, "uuid": "4f3b12de-a673-43c2-abad-9c6f191ad31a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202501, "uuid": "6bafcb91-4d57-46e6-9b30-5d2df5fb28c7", "value": "document-280422081.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f563113-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159145, "uuid": "0a9224a9-a865-42b7-90de-74437287b630", "comment": "Malware payload (IcedID)", "value": "602a2b62a48fa32311a3e5f9648afb85", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159145, "uuid": "b07c77c6-0a59-4052-b5fa-82e1c88c217d", "comment": "Malware payload (IcedID)", "value": "1971c2ba397ec57ff29278827b1c169701d21063b13e2a71af52ade088a9bdb8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159145, "uuid": "d68f4bf1-f25f-43fb-be6e-0412bf2ab2b3", "comment": "Malware payload (IcedID)", "value": "4bfce316af32565df0f4254c863062a86e4c00e9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159145, "uuid": "b77fd3ae-5757-4ebf-90a3-7d0f6880c7ff", "comment": "Malware payload (IcedID)", "value": "7493583427bdcadb03e64e136b690755bcc4d61137ee2290251626520cdaf5abe6c1d48ca154a666ccf8b71d04d8154d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159145, "uuid": "91866c44-19c8-4ace-b661-f832f33351d7", "value": "0BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159145, "uuid": "0b56c8b1-c0aa-49de-9e4e-f78ef5857ed9", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159145, "uuid": "2a234d2b-1500-445f-8556-a65a9bc9dc42", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159145, "uuid": "ef796282-88a0-401b-a085-73828c709500", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159145, "uuid": "0219dbcd-9117-4559-b5d8-57627ab4af0d", "value": "document-1859889083.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f75e1b-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159151, "uuid": "6fe5bd91-129d-4e2c-a12b-b8a66795bcf7", "comment": "Malware payload (IcedID)", "value": "5ef34fde23b7b806f0611aa8f59208d4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159151, "uuid": "65474613-c425-40f0-a1fd-be2540996ebc", "comment": "Malware payload (IcedID)", "value": "198b951635b0ee81c0bf2cbb4c9cd9f77bac023a1645975cf2802cdbc91ec5ef", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159151, "uuid": "2bcac4c2-4508-465d-aad3-8676a241d66e", "comment": "Malware payload (IcedID)", "value": "fe0c2de659a3283f2ee46bbc2a3849db6898365a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159151, "uuid": "87d2fc13-746a-4219-ac87-512106d3fb71", "comment": "Malware payload (IcedID)", "value": "cb941cb070d0f34a9260e6aaaa95911ce211ab6ec6686458b406c07a64e11c2a67363a667036ebfbe4357d07592b9400", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159151, "uuid": "0df415dc-612b-45e5-93f2-49ecdea12475", "value": "E5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159151, "uuid": "6726ce8d-49c8-4b7c-a021-2d8932e0a587", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159151, "uuid": "b6dfea2b-a1d9-41f1-b805-1c6d6f9a65fe", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159151, "uuid": "3ddd0147-7c9a-4b8d-8a19-6ac6de493652", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159151, "uuid": "d411117a-2110-45ed-9e78-d1b4e5a69eb0", "value": "document-1780576595.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb35bf52-924e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617215241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215241, "uuid": "4b6d6693-dea9-40f8-b187-575ffea391ca", "comment": "Malware payload (AgentTesla)", "value": "2c3ae6171cfab22a907669f26619288d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215241, "uuid": "3c4d316c-5563-4726-b018-be093a3c17ee", "comment": "Malware payload (AgentTesla)", "value": "19949d4abee41c81c343543fc5e71de14f297440940bceb3a8f2451c7edb7d9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215241, "uuid": "2e36e14c-8bde-4ac5-919d-03cc309158f8", "comment": "Malware payload (AgentTesla)", "value": "6611bc3ae9797c06a2292f18a3e2c1a3654ba715", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215241, "uuid": "5b240d6b-d4cc-492c-a6ce-b99d9e968109", "comment": "Malware payload (AgentTesla)", "value": "83b613cfb0310a5103bb6811caecce778a2a8e99a1202a45c7810561901f90cef2820e7c6bb8b1888a1b5e0e633ee49a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215241, "uuid": "da916ad8-18fa-4aa7-9a7c-e2df5ae98b4a", "value": "E523FCEC495905F7E56CFA769381104EA630ED3B29044A2B51E742E3C6F6B936ED00FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215241, "uuid": "684754bd-11f7-4629-bb4a-381f938fb868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215241, "uuid": "ca023129-77da-4249-a3a5-3768cf8feed7", "value": "768:MfRtp7C1/rDD3EzEDwY3ZS/RtSpdeTUoJGx59MYKJoBHUGfloGflvx/FIwJGun5g:MfRtp7CnS/Lz41ayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215241, "uuid": "671cf6a2-d5bb-4fab-b88e-e86c4b36dd8c", "value": 46792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215241, "uuid": "4f41db7a-7a04-409c-9e9b-5c76e6c50915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215241, "uuid": "6427dbac-8a70-4c00-b6b8-8981629cba5c", "value": "2c3ae6171cfab22a907669f26619288d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def4602c-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200268, "uuid": "4d45dd8e-206c-41ca-be6f-0b32edfbbf7c", "comment": "Malware payload", "value": "026c3b6893a218c8f9761805126cd2de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200268, "uuid": "cd8efda1-d13a-4a34-a933-a1ba9e3b5d01", "comment": "Malware payload", "value": "199f887508db1971155a8aaa294d7a2d40f265636b3d803379136067a6a66a77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200268, "uuid": "860ae16a-4c7d-4766-9554-3de08a07ac95", "comment": "Malware payload", "value": "1c6ddc95805bb9eb28dad8a8de35de49411e3679", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200268, "uuid": "164bbff0-2e3c-4f7d-87d6-ff90fd33aa6b", "comment": "Malware payload", "value": "7ca4e03c0a5385d618e62ca860b9d8069445a01768803e07868cb520237c61b3e0dfdc561184e5576b08fc3e81d9ae45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200268, "uuid": "176b4261-2018-4186-909c-e52049d7f1a6", "value": "0EC2D730AC562D224477C26A7A421557E9B840335F40A074BEEE416C2F7BA8D53FBA6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200268, "uuid": "f7026d6a-9984-4272-8c06-ef72ca56df58", "value": "384:vUIKz6EfBCiPqJcQQhBGhshBgO/QkwtnU7l9dh61ucRsCBiacR:vUIAhBCgBhBGqh2cH7rdh6ocRsCI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200268, "uuid": "645abd9f-30ae-4407-9193-fdc9c0da0457", "value": 27013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200268, "uuid": "4af7b9be-1862-4fdf-b9ab-af91391d696f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200268, "uuid": "4b9f375e-9a27-4822-a92e-a720593d3ec8", "value": "199f887508db1971155a8aaa294d7a2d40f265636b3d803379136067a6a66a77.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029d177a-9269-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226527, "uuid": "fda4a55e-08ff-4003-b872-eee89da99a6e", "comment": "Malware payload", "value": "4bf479d0fcb081c8ab68c41d848d593d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226527, "uuid": "38f4f3af-44f6-4190-b04e-a935a82d8769", "comment": "Malware payload", "value": "19be41bf3f9577db880b196816a2f1f7b5cb07beb2c1ee80ff813d30d0881617", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226527, "uuid": "e33b001f-441c-4492-8213-53882b28f4cc", "comment": "Malware payload", "value": "0b1a1b7a5a309a350d7b0b9093ff8977d9eb7ca7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226527, "uuid": "a4545ec6-9712-4d04-8e66-2babc661a08a", "comment": "Malware payload", "value": "6ac700f7fc35b63a830dff8e631d6a9619482c192440e62cb21addb5e58f81a479fe9cb4b358ce06eed8a4f740f442d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226527, "uuid": "04e581d7-74e8-4c3a-b2b3-69b1daef0283", "value": "B054E049E2B00DE4EEB74A3CC8B81659E5353811A760DE4F632422560F676E1ED3DFB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226527, "uuid": "c91f3d25-d589-418d-833e-dff0771c5ce3", "value": "41191cafd0feffb1714fd31f94d3bb0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226527, "uuid": "c0a3de4f-a259-4eed-a43e-3e68ed5cff73", "value": "6144:rYJXV3YFVBEZ4Th/A4ijWnT+oc1kawEyHdsOyiQDUkpAL2vU7:gXmQ4ThVT+F7wNyj9AL2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226527, "uuid": "baff4885-08e3-4874-806a-8f0681e36d97", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226527, "uuid": "6a2d85c4-d7e7-46c0-a29d-b2e0bbe95f69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226527, "uuid": "afdd4959-a2f0-407f-bebc-c25f1f121d8b", "value": "SecuriteInfo.com.RiskTool.Win32.BitCoinMiner.vho.31244.24728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e8a12e-9270-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617229934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229934, "uuid": "0e1fce8f-25c8-45a6-aa1d-655e01560bf7", "comment": "Malware payload", "value": "afe51a66c86d51f26fa6a2a5c23c4250", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229934, "uuid": "d4b3d4f0-6cad-4aad-97a8-fe65d9b136cc", "comment": "Malware payload", "value": "1aa24b5b04167706c0f70517267af74e145db7c951d3226ff3b067303b92a932", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229934, "uuid": "761e6b0c-b9db-4dfb-a9fd-c6547eb7dc1e", "comment": "Malware payload", "value": "38ed5e33178ac3360a05fd7c19dab35972f8a185", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229934, "uuid": "fb3dae05-649f-4376-a076-28ee539628f3", "comment": "Malware payload", "value": "e83ed5c73e9c1a9e5748684f949f670d3e733ff4d9ade083e3cc8533907d7dfba83ae1113419c62986184209d83ae5d9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229934, "uuid": "fab4cab9-7e6a-4f2f-93c7-0f4cca01ba9d", "value": "3B248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229934, "uuid": "6f5e7ae4-14ea-4648-8c34-b50f682ba5d5", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229934, "uuid": "6bfcc165-537e-4fee-98a2-d4ca5fe9b2a5", "value": "3072:16TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:1oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229934, "uuid": "b1586cf8-e22f-4a97-ba55-6e927f842982", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229934, "uuid": "ab340a07-cb25-48b0-af1e-61ba39d07539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229934, "uuid": "9b048873-5e26-41c3-a437-4d5d2ab0111a", "value": "1aa24b5b04167706c0f70517267af74e145db7c951d3226ff3b067303b92a932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff3c99a-9257-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219087, "uuid": "84e5c0d2-6f07-4843-bf18-9e97fdf1c315", "comment": "Malware payload (Dridex)", "value": "f37426121be22d05c6e92f2082b3f60b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219087, "uuid": "e85cded1-5402-45f6-9e5c-b60f0d14906c", "comment": "Malware payload (Dridex)", "value": "1aaba61b8bf9f81a03f0f134cad54bff968b0c4980d10544313a812f1177af61", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219087, "uuid": "2d75deab-c90f-4ecd-949d-5ad77afa08fd", "comment": "Malware payload (Dridex)", "value": "cf425208679608f94066e07cb7e28746dc9c4a2a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219087, "uuid": "7617ebee-4c4d-4a6f-8a8b-dc3eaf7da854", "comment": "Malware payload (Dridex)", "value": "c9daae441a9757d5828714c9853f21d0c2eee6cb8e6b23538f8a160fed3e78e4106c8a1002015b73f976cf97e8f25aa7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219087, "uuid": "72a180d2-fc2f-41df-929c-e2314372d09c", "value": "7D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219087, "uuid": "2c336edc-93fd-4c4e-a006-eb4000333b11", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219087, "uuid": "7049a736-d4fc-494b-b6b7-db660b4c6dc7", "value": "3072:Oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:xpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219087, "uuid": "c898286f-d7d0-4379-8406-87b465812b90", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219087, "uuid": "072d5b48-40de-4174-a06e-d5fe6c1a1d59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219087, "uuid": "c28d6da7-c898-4ffd-aec2-939a8059d2b3", "value": "1aaba61b8bf9f81a03f0f134cad54bff968b0c4980d10544313a812f1177af61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78556432-91de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617167025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167025, "uuid": "3c99f3fa-f25f-4a0b-8bb6-f83980dc97ce", "comment": "Malware payload (Gozi)", "value": "114344b10fcf51c14d79e5441e8fa86a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167025, "uuid": "90a10b16-2b72-4ef8-9b8e-ec75f68ff3de", "comment": "Malware payload (Gozi)", "value": "1abd2ae7b4600681751fcd1d401a6ad35fbdd3e231790be49ef7b61333358802", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167025, "uuid": "93210399-f33e-4b5f-9fcb-58f2d360bb4e", "comment": "Malware payload (Gozi)", "value": "1d52817634967190aa11a5c1eee9917839f4f384", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167025, "uuid": "9aa2509a-3785-47c0-871b-e8fdfb4e6965", "comment": "Malware payload (Gozi)", "value": "7d0f54d7b72747012e1c58b3574eb8b149e0ca0830173b61b933922a7d33fb1944c3ee9ccc4375e0b6dfcdea209240cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167025, "uuid": "15fce505-764b-4528-ae35-80260237735a", "value": "8644BE13A3D14031F7B31B3508BB99414BEF7CE18A34C9ABA688310D6F676D05A797A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167025, "uuid": "8d3a2cd9-7d17-4fe4-a64a-f89f0fa1c48f", "value": "b7358069c066a5063a8c53c6adf66bd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167025, "uuid": "61c6bd3c-ddab-4a7f-8c5b-b8e82c87caa0", "value": "6144:mdnnLzN2slolUkNkGPz2Q3kEv6/xdBBybvN:Gn3RP4kGPz2QpC5PeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617167025, "uuid": "7dfd7eb2-036f-4b04-b66f-0feba1d0dfd3", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617167025, "uuid": "c9149fef-6a9e-4d4b-833b-914707ac99fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167025, "uuid": "33362002-1e43-4713-b6ca-b06a01735863", "value": "6064024521dc9.png.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b32bcd-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617173919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173919, "uuid": "f765a2ef-f14d-47dc-8aa3-6869271dea5f", "comment": "Malware payload (Formbook)", "value": "b3a992e5e3d68a4d737e04836555cb69", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173919, "uuid": "5c39c55e-cc98-44a1-be51-acb7f56b02da", "comment": "Malware payload (Formbook)", "value": "1b472f10e007ff12dd477da58de8b555a4bbb5c758d7e98361328ca48cb2a208", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173919, "uuid": "9b7e5b0f-2014-461a-8cd6-bb77852b9001", "comment": "Malware payload (Formbook)", "value": "d6bb0efe846ed657ecf8861b84e257f05822f7c6", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173919, "uuid": "4fa2b873-9894-4ecd-9686-5af98bb91765", "comment": "Malware payload (Formbook)", "value": "616dc0bf597bdb080c601b4ccda4ac58b35785a319e001959c8eac388c7e73d4d915fc2ff1b112d9ec3a2ca632e43a00", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173919, "uuid": "0692ed80-0ce6-4cc0-9d05-5e5a478252b4", "value": "521423C8E5BDC87819F634B136C0801CEEB5513BB6986A986EBD471C319CBBDB02C6D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173919, "uuid": "e1146ff7-cf60-4ae8-ab4a-36505c54f501", "value": "6144:p+vB44o4QqRfqp/ERh3KZMJvwYieVexbvIXj:p+5447QEfqtqe4V2bvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173919, "uuid": "4f09736b-b43a-47f1-9c44-cc095cdb2b01", "value": 209341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173919, "uuid": "bdf376bd-ea23-400b-a473-ef2a88358246", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173919, "uuid": "1fc9b02e-0c81-451f-a2df-e86c8fddb701", "value": "DA-PROFORMA-BCC-211370-1-1289009-doc.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff0b49f-91c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157025, "uuid": "62190828-8fc9-4abb-b15e-a35d02058ac3", "comment": "Malware payload (IcedID)", "value": "13b0ee96cf62cf45ff4ce01077372d35", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157025, "uuid": "9382ba05-7717-4ae4-b4e7-b35c6ef19753", "comment": "Malware payload (IcedID)", "value": "1b4eaa02d2b229629b3bbb03c48a669ab25fa5b2e9a0943a47a0f03ad196b897", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157025, "uuid": "fc2bd616-5a52-4106-a51f-a8a714c05208", "comment": "Malware payload (IcedID)", "value": "fb189e2a0f794deb7af2fd2d0b2a839d9d1450b2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157025, "uuid": "d64d4a46-9199-4f1d-875a-9a351e512c1c", "comment": "Malware payload (IcedID)", "value": "2e1248dd3102f5b006eca91b9469578680d267354f62f8ba02e85505ea31c5b62f2283e22ba1fa9f73af3be5dce6ebf9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157025, "uuid": "303a7377-6b70-4f1a-9594-d992ba0bccd7", "value": "8CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157025, "uuid": "649c09cf-270f-49c8-b37e-c62976aeb5b5", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157025, "uuid": "75060fae-307d-464f-940a-99b0b4119ef9", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157025, "uuid": "24933f46-b0e2-40e2-9c89-882c6b3835e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157025, "uuid": "9eb4bd42-a565-4f1e-a0eb-dc921fb4aaaf", "value": "document-121199092.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f7ab12-91e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617171213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171213, "uuid": "a757a62a-aba5-40f1-a74b-08e7355c3820", "comment": "Malware payload (AsyncRAT)", "value": "12a84a5672e0d3de7e8f4d9d5e6a18c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171213, "uuid": "ac6f9e3c-dd93-419c-89c6-c74eaaf59e2e", "comment": "Malware payload (AsyncRAT)", "value": "1b7afa2a07f65c2cb04454ba72f066bdc4daf640ad3b75cfac5fe82eed6c2c76", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171213, "uuid": "1c264ee1-dcc2-4200-9552-6451242e1021", "comment": "Malware payload (AsyncRAT)", "value": "82c77922fcb35f1f09b5b608d1b99e864ea1e490", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171213, "uuid": "b5311db6-c599-4bb6-9f69-b6a0073a9468", "comment": "Malware payload (AsyncRAT)", "value": "e9ecf078f5ca97d06a11f939ced065ee93120125142cbb1a3bb4c8070c46e782ebb7f6d6bedc03d61e9bdec1ec8a8e6e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171213, "uuid": "4767bf63-9388-4274-b66d-23528d71d3e2", "value": "8194E311E99C5809FC061F3928E17AB902525C9188E2E6EDB78D33ADE1753F3D47F928", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171213, "uuid": "42483947-aa07-4f95-94be-a3c28aa22f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171213, "uuid": "9828374b-82d7-4215-a229-e0e9a05037d3", "value": "768:anG/3vM02ZZgBEXzZwAkCcfPzuZwJniNeSg7FpIfSrWwmiuXbhdAB5r:ldyXzqAkCcfPzuu9p8YWw2ddAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171213, "uuid": "b095df71-3e32-4873-ab4b-1455758c9738", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171213, "uuid": "6bf1ef06-d4fa-49e5-b16b-47f95991e099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171213, "uuid": "2e4043af-a551-4471-a2ab-b0b3cb4e0ae0", "value": "ORDER-331.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebd612f-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223756, "uuid": "d048905b-342f-42d3-81a5-c2f58a7b5460", "comment": "Malware payload (Dridex)", "value": "4d3ea6c096b051127a78cd418effe239", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223756, "uuid": "92402a22-b324-482b-a1bb-026da72cf121", "comment": "Malware payload (Dridex)", "value": "1b9cd72742f965b4a76ed23ece87c55a7cf1f61b1462752877cdfb1193d01082", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223756, "uuid": "a4877366-641e-4c94-bdf3-eaed0c7520e4", "comment": "Malware payload (Dridex)", "value": "51bf3f74c9194e2e76c40f3c0081c44f036b9fd7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223756, "uuid": "f8f813e9-c751-46f7-be14-61ca41e68000", "comment": "Malware payload (Dridex)", "value": "6ddbac011c405b3c37aeeffba7db889b45c0e6f76bbf6a2bf045ed464139d65b019a7914d47914df3a7bd0d04f24de1a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223756, "uuid": "f71b49d2-d5d6-434d-b128-f24e97d42b4f", "value": "04248C5FE339F486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223756, "uuid": "ce538985-ffdd-4dc6-b57b-861e7045fb9b", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223756, "uuid": "70f609c2-3b00-4aeb-b876-cdb7c040663d", "value": "3072:86TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:8oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223756, "uuid": "056abfef-aebe-47bf-a80f-2921e9064ae4", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223756, "uuid": "067637cd-4cbf-4805-a98f-1a5c602bbee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223756, "uuid": "097daedf-52b7-4719-b133-839400fe0db0", "value": "1b9cd72742f965b4a76ed23ece87c55a7cf1f61b1462752877cdfb1193d01082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23fda5d-91c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157646, "uuid": "feaf6def-935f-4016-b791-3baec8ed12b9", "comment": "Malware payload (IcedID)", "value": "2a74b32f623d42f254bcab4874fef1f7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157646, "uuid": "c3a8699e-a588-47da-b8b4-b6b8fb1e3a35", "comment": "Malware payload (IcedID)", "value": "1bbf1b80398d4c147e4dee007f93bcc1b0d0bbeb61073a00a5a43f931c970f90", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157646, "uuid": "dbcbf4ba-9444-4217-99e8-762365999f14", "comment": "Malware payload (IcedID)", "value": "5f18f7f61988bb711030efdb19df4c28893a2827", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157646, "uuid": "c9028858-6fbb-4c45-a779-6f36ebdc7c34", "comment": "Malware payload (IcedID)", "value": "0fb70f1059d1fbd098a1ecc1876cd4cbd8bcbb00c4ff7a1409bcb5fa8703a9ba6e8c8ba6cba0ee18e79ff599506bc3df", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157646, "uuid": "5dfebcd4-cf27-4a8a-88b0-b24d9a434de0", "value": "DAB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157646, "uuid": "64370d4b-b2ea-4060-9bfc-9023bd0cfa06", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157646, "uuid": "e434f193-06c8-4ce1-af06-ba3ed4f35541", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157646, "uuid": "91efecea-1548-4592-b018-e382ef6646c6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157646, "uuid": "b6f25a50-b606-4cd9-a694-0f7196c00de0", "value": "document-1611284089.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94f20e9-91e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617170113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170113, "uuid": "28ae0958-e714-44e0-bc6c-27014ca28d85", "comment": "Malware payload (AgentTesla)", "value": "e8f7486e21533cc37eba827b47ab06ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170113, "uuid": "229eac5d-64ca-42cd-8444-21eeb3c39d61", "comment": "Malware payload (AgentTesla)", "value": "1c4b4441e3216049a7c0a8807bdaa0304a2162e0ae6d38b2c1bdb76003fe20f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170113, "uuid": "54e25229-8114-4dfc-8262-64021650e986", "comment": "Malware payload (AgentTesla)", "value": "bb21cf2e390906f06e4279f8a583431246135982", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170113, "uuid": "70d90868-d4f2-450c-9c78-a7feef3631a7", "comment": "Malware payload (AgentTesla)", "value": "b7d37996980e9a7ccd7f75e656179f94f321c3d25531db2aff83167b11bff4115374d98ea8421ce66bea1a8ebabd1ac6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170113, "uuid": "636671c4-6eba-4025-a083-49162ac5f7c2", "value": "8A05E014321ABD91E43A87F240DD1B4263F39BC58315D93DBC90D1849EE3AC7BADAAC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170113, "uuid": "05abc333-6e6e-4df5-85fa-0243a104eb22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170113, "uuid": "dfd0a59f-0926-4523-9030-f57835c1ec68", "value": "24576:SW1JBTMQhCFJpu1AQU4McFdMaKrTqJGTbK:Dn/TUlSX+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617170113, "uuid": "b7553855-227d-454f-9ea3-194398687be9", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617170113, "uuid": "be557397-a372-4a09-92a6-52e6271b6aab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170113, "uuid": "26759853-6668-4da8-a44a-8e0dfa1e8835", "value": "OS3USGL7.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f8d218-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160765, "uuid": "0d4593bb-aa11-4a6c-ac4b-af99316c2f79", "comment": "Malware payload (IcedID)", "value": "9a98adef20aa145ff022fdfea9a7e4bb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160765, "uuid": "8df79254-95c7-4f8e-a821-0ce90ac40dd6", "comment": "Malware payload (IcedID)", "value": "1c4fc519750c642890e1e23588c20a5c7886e2854e38c5c974f6e6da07042d73", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160765, "uuid": "4f89e7f2-90b9-4300-8795-5ef527a32a49", "comment": "Malware payload (IcedID)", "value": "c99074794db5fa74f4a58eebd57a56fa72b4a45b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160765, "uuid": "3b9cf4f3-0a49-4286-95f2-c323db15e72e", "comment": "Malware payload (IcedID)", "value": "e3275447eea26b4770247e8e5a96256ced9b0a62dd588733c5ff5b8dfb39ba09cb55582c2ac8396fec43bc033040b127", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160765, "uuid": "46708b55-dc45-4277-9a4b-0e1a38e1aa8f", "value": "80B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160765, "uuid": "56687a1a-8bc0-47b6-9a52-914704014ea5", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160765, "uuid": "a5920bf8-dfa1-444f-a90f-967a0f3dfd3b", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160765, "uuid": "143e5c61-6bca-4636-8ee2-fe1d2c0dbb2b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160765, "uuid": "e491a950-0a16-4272-8ed1-43f6d7ee555a", "value": "document-926501440.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362c6b9b-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617195690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195690, "uuid": "748ed282-bb80-4800-b4f1-d70b3d42ae26", "comment": "Malware payload", "value": "fd65a784c067ca627c5628e288d6b5bb", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195690, "uuid": "d5ee5af8-d992-471c-9246-66480295aff6", "comment": "Malware payload", "value": "1c8595ef733ed09f73de78f6f25475714b9db981642d41c9044ce4ca9f1efdae", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195690, "uuid": "46da507c-9134-4e36-8002-492010a1be43", "comment": "Malware payload", "value": "1eaa71a8e4156e00c90745fb13517f3d03965c4d", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195690, "uuid": "47045f8a-4213-47c1-8eaf-6ab17a6996c6", "comment": "Malware payload", "value": "172b46d4c186262c205da4dc341cfe60e9237240aaa135d7fb24e9006985d895926e3552096854560b0dfe042e37fb1e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195690, "uuid": "d9df2e67-1c02-4bc1-99d3-580c9b2c4707", "value": "1B45E114B6DACA37D71A393064407EB44BF10A48C0049B8275CCE6F66AB6DCE975DE3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195690, "uuid": "2e583d31-1be5-4b2d-bf57-ee9df42ba63a", "value": "768:zT3k4XOU6E1a10+tzH5LupihxHt0fk/Fk6s7tvOciW2BYQV9uYIL5qjec+:xb6E1a1rtz7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195690, "uuid": "e5c97fe6-8647-47e6-893e-f440170c6d9f", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195690, "uuid": "0a54b54e-7ce5-48bc-bd4d-289fa380f92a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195690, "uuid": "e525f0e8-7d15-4251-8716-e67cd2328dd9", "value": "IMG_710__36_7801.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c038b808-9234-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204082, "uuid": "5665933f-e5aa-4965-bc8b-6159146fd7b5", "comment": "Malware payload (IcedID)", "value": "a526584cc638d72d193709723108b491", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204082, "uuid": "d6461e99-11f3-4387-b23c-59fbdc01e5ef", "comment": "Malware payload (IcedID)", "value": "1c918e423a5860e55d247614f58b8a5bde30eb790b429b2ff86a4e9e2ae400c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204082, "uuid": "7a59b85d-0de6-4db5-9d64-9e15463d2db9", "comment": "Malware payload (IcedID)", "value": "354425426a812bf4dd1fd4fc3ac0b33535fcc7d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204082, "uuid": "fc505645-a392-4be8-a0ed-a94ec36d214d", "comment": "Malware payload (IcedID)", "value": "6c094d084cfd4b9b89c462372d700170ebb9407f710daa5f031e4ed50edec0de7bb9884338f41821da6b55cc9af74922", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204082, "uuid": "03629789-458a-4283-a00f-7f404b9c3c94", "value": "DC435CC6C5E10663C53A6972C2F12F25D227FB21F3A395FBC04877268192690D773BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204082, "uuid": "5e8b5ebc-7bbf-47a0-a56d-2bb1386d889c", "value": "1536:unIIcUiAuY40CWtvwG9pRk7ksUK/+IPko+M:kZHuYRxwa4t9Pko+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204082, "uuid": "c52307ed-a46f-4b1a-b89c-5b31b346821a", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204082, "uuid": "6ab5531d-dd04-42ce-a4d1-0377857be311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204082, "uuid": "b327579c-b7f1-4665-8335-46367d3c2b9e", "value": "1c918e423a5860e55d247614f58b8a5bde30eb790b429.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7e2ec8-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200081, "uuid": "fe975fd1-2972-4705-a1f8-3664a4c79128", "comment": "Malware payload", "value": "a808e3128ea9594412503373f7c82e75", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200081, "uuid": "689acbc2-19b1-4be2-a8f0-9bb0b41996cd", "comment": "Malware payload", "value": "1c9c0a7ed72eb7d42141458dc5c6e270284cdd615310ad30c3400b395000b7c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200081, "uuid": "ee20f3e8-1f04-4b20-81ce-9dff778ef8c1", "comment": "Malware payload", "value": "02f59a94dd3678483efad93c8000d9569653e97c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200081, "uuid": "12e98729-98c1-4965-bed6-75f79882a5ea", "comment": "Malware payload", "value": "c3a7983c31431dba5342fdbe04de33431d82dca51cbd0cfe3fb6f9fc1d84d7a07abb53dbe6b522546bf8a45538921f84", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200081, "uuid": "f007ddec-ddb0-4891-a8c5-2033f025a65b", "value": "E3928461F8072D33397269766A5307EAAE6C40322F5070F8FD4D4066AF78969B0B763D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200081, "uuid": "2197173f-e02d-4e4e-afa6-d09805655c10", "value": "384:icuipe4UL/JWUWnDXpyuQmJZQ/Tj1+WcHV/dFQWENj:hpUL/4UWn7FzmXsNdWWEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200081, "uuid": "ace8b13c-2a09-419a-9ec3-ce2d7de84b78", "value": 20904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200081, "uuid": "dabe049a-b393-4bf6-8b76-628e113081ed", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200081, "uuid": "80c4a063-5fab-4ee7-b388-fe2a98558680", "value": "1c9c0a7ed72eb7d42141458dc5c6e270284cdd615310ad30c3400b395000b7c1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ca10bc-91c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157026, "uuid": "d57b1e71-ab13-4888-9178-78d2eaed169e", "comment": "Malware payload (IcedID)", "value": "17bdc267a6726b32a6fca7e385917221", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157026, "uuid": "078e79d9-158e-40a8-9427-3de241479072", "comment": "Malware payload (IcedID)", "value": "1c9e1807c9a1b6c46cf5d4a3747a005cdf39b5373ccf093723831ed1d6ca1950", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157026, "uuid": "99f82428-467d-48fd-b326-1d88d3e25513", "comment": "Malware payload (IcedID)", "value": "a51291381ac2696a3a2587691b5871b989bc84c9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157026, "uuid": "a092a6d0-8d17-42c9-80bf-e033e7982a86", "comment": "Malware payload (IcedID)", "value": "9fd5d461dccbdb2091bff1ab86eaa6588c4cb9cbfbe7d1cbc1dcd2cee4606f5cfb07a15b9c8b5f10889c983acc33c358", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157026, "uuid": "f39e3137-065d-4819-a1b9-1603885bff3b", "value": "5AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157026, "uuid": "0eda810c-4e41-4384-9d74-77b94a658fd0", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157026, "uuid": "c6f95860-dfae-496f-84a0-4b35c1414153", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157026, "uuid": "124537ad-60b2-406e-9b79-c7418c6aba97", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157026, "uuid": "99038fc6-a54f-4a92-afb6-234d03addfab", "value": "document-945314558.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702cf04e-9203-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617182902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617182902, "uuid": "acc6f365-5d05-4bd5-ad49-0393207bca3d", "comment": "Malware payload (STRRAT)", "value": "efff05f2e8302a3801b7b4cedbcf2cba", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617182902, "uuid": "9c94376e-3727-4e3a-b52e-53fec97bbdd5", "comment": "Malware payload (STRRAT)", "value": "1cfba0ba32dbe3bb0b14a95da032d6cda94eaa5c65135973eea16d12e07e5b58", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617182902, "uuid": "311dc349-749f-46b3-b108-1a3f7085086a", "comment": "Malware payload (STRRAT)", "value": "234c8984e545d77ac64c30898ca3d6bf227f24fa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617182902, "uuid": "82c3cf06-3930-47b4-8b58-22768acf74f0", "comment": "Malware payload (STRRAT)", "value": "2af999538a75a4d62bc2bb6dea2681f923c3611533ea1f7cf1c54cfad956b3cf5bbdf1c240f05dde279028f9e9493953", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617182902, "uuid": "e0ca1154-62de-42e7-b459-996a618d10ae", "value": "9FA3D05BBEDF80E0D00B4076198C41B2D71C5558D41891BF2AFDBB4E0DB2E698B26ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617182902, "uuid": "2325147b-b176-4bb0-9a96-f271689ed384", "value": "1536:h4cvusDlVXzIL6pP8Msd5ehlP5o7CLaIBgOWvx57MK6+GrNC3bBByixK0:KsuuHXI6p0Hehx+7CJBCu5CL/yy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617182902, "uuid": "140b494e-aba2-46bc-8738-2332130ccf78", "value": 102534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617182902, "uuid": "463af188-fe56-436a-ae66-427c4cfc46bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617182902, "uuid": "cb6f2919-fcc4-4f22-a151-fae889d65636", "value": "Pago 31 Mar 2021 at 2.15PP3343PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49441d7a-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617195722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195722, "uuid": "002eed88-d439-4ff4-a574-fccb3111d96f", "comment": "Malware payload (Formbook)", "value": "78b638ad61109b9327e9a3a304bf1fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195722, "uuid": "3c5e7f16-b84b-4cdf-ace0-85276dc295d3", "comment": "Malware payload (Formbook)", "value": "1cfec89b2bfbcdd400f0cd58741a2d7a218bb2bbf2399b55833c6f4a64829883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195722, "uuid": "e24470ea-ef6b-42ad-b3d1-70437ef38d23", "comment": "Malware payload (Formbook)", "value": "d4abee4c7936c2a797c44d4cd579f62de172b216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195722, "uuid": "17ff98fc-a076-422e-b343-173f3e196dc8", "comment": "Malware payload (Formbook)", "value": "1cc05f22745da40cd096dbf5cdc1433575f32d1c6775450ec012326a9e2a557e58aa81729fd8449f95fd054fb0e864cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195722, "uuid": "8162cc15-6354-42da-aa05-694d6eb133d1", "value": "35059E22B2C05437D53326798C4B93A5AA39BE203E289D873BF43D5C5F3969178392D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195722, "uuid": "911b6769-5a9a-4305-9ddd-5caec7c5f1aa", "value": "85e119cf823c9c09d6a77972761f4a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195722, "uuid": "3acb31ad-4955-497a-83df-2f4f43620d91", "value": "12288:0aV4EjZ1EdeSFDHkaK+/NcAheZ5/3jsVMStRBJLO6DssM5vstzYmJ:0erjAdemLnK+/NcAhej34VMSfMvsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195722, "uuid": "07255393-7482-43ab-bc78-4727e949568d", "value": 845288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195722, "uuid": "75c78e42-85ab-4208-a77d-2914fb7c7135", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195722, "uuid": "c7763b74-5cf2-47b2-8d87-8ecdaea413a0", "value": "products order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d927882-922e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617201340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201340, "uuid": "7eb0d88b-8d1e-45c2-b393-d61a6601f016", "comment": "Malware payload (IcedID)", "value": "467fe3ff1a5c293f93b590217f75e57c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201340, "uuid": "4fcc58fb-24f9-401c-be2a-0e319edb2471", "comment": "Malware payload (IcedID)", "value": "1d458d54689495c7db109df2bd844dafe2bf7b6dd8b4e03ce8589f783530b2aa", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201340, "uuid": "8154ad4b-32d3-4e70-b397-21f7a3a68c20", "comment": "Malware payload (IcedID)", "value": "af74367d4c739a95f6edcbe69752c151847c06e9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201340, "uuid": "dd91d45e-a1bb-44f5-844d-477aa744f7de", "comment": "Malware payload (IcedID)", "value": "0d6d0c0d7618a6a68460b5f695b114bce968a66d2ad16e8474cc8808823cacec159040df8294ec3a9365d81130245de7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201340, "uuid": "e1c84f31-1096-4eab-bb48-ac637f567ba1", "value": "E8B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201340, "uuid": "f2ec458b-e906-4622-ac2d-3e393ba9faf9", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617201340, "uuid": "d083e823-5c12-41f9-978e-cdb22318de0f", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617201340, "uuid": "b93236a6-6652-46a3-8ff2-02e1d739986f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201340, "uuid": "027051aa-8b5b-4bab-afb6-0fc2d8310408", "value": "document-942514474.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744fa891-9241-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209538, "uuid": "fbfdecbb-7865-4660-849e-6dae6498a960", "comment": "Malware payload (IcedID)", "value": "e6f0cb14290872d0f144d7679f66a0b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209538, "uuid": "c345aa38-cce7-43ed-a068-17e494930bb4", "comment": "Malware payload (IcedID)", "value": "1d54327a90ae7dc32c5e18ebe7d27671dd562e22803e5ba15778b1515f5eb20c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209538, "uuid": "a10b116b-5ef7-4c35-a363-b2082b6554df", "comment": "Malware payload (IcedID)", "value": "87db634e2a2a919adf93fba02c8468278aa3dfb4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209538, "uuid": "10ab106d-3d56-4ecd-a1cc-746c6a5a9775", "comment": "Malware payload (IcedID)", "value": "eaded23a65324dcbb503285e3dbf852554253ae54ce0edd7f09fa2d8107ad9c737d8fd153e2b95a888bc87ac062d3ce7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209538, "uuid": "5f47e8c9-7587-47be-ba69-1c4add0e4831", "value": "88937BCAC9710643D4379933C1F26B28E526FB60B3A395FBC0487266C593690EB72776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209538, "uuid": "9e02a2f2-5011-496f-817e-fc63744ef274", "value": "768:YcaM04GKf146QXQRno2wI6PudG9Sktdxp9AOCs+Apj0mjJbBRgYc/WVI2C0v:mxKf0A+2R6QG9txpSd2iErR13I2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209538, "uuid": "d2664a01-5439-4834-bdb6-fb172f76b196", "value": 94581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209538, "uuid": "c58c268b-84b3-4ac9-8440-19aaa7b128de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209538, "uuid": "0f3a4d96-d461-4549-adcd-1855280a1510", "value": "e6f0cb14290872d0f144d7679f66a0b3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6dbba7-91d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161955, "uuid": "5285f6d5-339b-462b-ad3c-b731fe16425c", "comment": "Malware payload (IcedID)", "value": "b7f279f88a478f20edfdd7b924117e18", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161955, "uuid": "c9090d33-694e-4023-abe7-52a533b78fbd", "comment": "Malware payload (IcedID)", "value": "1d5a9814b1a9e4bd8a93d35abc6dddebfdf1ff4f71a6598fb56d93b4088c6f48", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161955, "uuid": "02925d19-be0b-4bd1-bfbe-a4eb2b6f5ebe", "comment": "Malware payload (IcedID)", "value": "9d304472f5b263fadef1930259f4487ae36e9614", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161955, "uuid": "a5a0bdaf-7e60-4f35-8727-b2cdb4c8f8de", "comment": "Malware payload (IcedID)", "value": "4fc97c045b82a3f3f00ed3a6742b082d17a3539adefb13dcc9f6ab91e1d89ae6379a4a70220e4a69813b8632ca5e41f0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161955, "uuid": "82bc9fd9-5000-4ba0-8b7b-664365d9f7ef", "value": "29B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161955, "uuid": "94a0903d-087d-4dc4-af8a-975f6ebb31de", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161955, "uuid": "8d6deb8d-d172-47fa-a056-cf57b0826070", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161955, "uuid": "da6a9799-20ca-4dcd-af26-9110da433582", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161955, "uuid": "397ca8ac-13ce-402d-84e0-38663cc8c316", "value": "document-484198840.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395a97d6-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218459, "uuid": "5115b7b5-e795-4aaf-aacc-f2855a1e720c", "comment": "Malware payload (Dridex)", "value": "25787c38748508f077ca86790fb64ee4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218459, "uuid": "147fc77a-30c8-4b1c-ba01-b6b6f05dccd2", "comment": "Malware payload (Dridex)", "value": "1d768a13368cc933afa2bbfab4535159b6d5f9dddd1c60cfbc5f74680494fc3a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218459, "uuid": "0e7b344c-bdfd-4c78-bb2a-68314e04c447", "comment": "Malware payload (Dridex)", "value": "fdd396d7243e9e2ed5b20b23a9f6ec97a150525c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218459, "uuid": "5c5b3005-a149-4b5c-93e9-ade59c63f4e7", "comment": "Malware payload (Dridex)", "value": "9895176fac5801364f481a20c4893412e7637eaceeeca4e90991f2befe5df8054863bad06764b111fa5023b475f27965", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218459, "uuid": "3afecde9-35ba-4099-bad6-e55b02eecb68", "value": "A014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218459, "uuid": "012d4c33-1bdd-42c5-84e0-47bb04aa01f5", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218459, "uuid": "cad832b3-d8b7-48dd-a16d-6f9de6930b66", "value": "3072:Sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:lpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218459, "uuid": "85256d83-bfcc-4cb5-9357-410439a8ed72", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218459, "uuid": "86fcb223-5cc1-455c-8ea3-8ed9db066fb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218459, "uuid": "56c25662-0764-4cb1-92b8-4dd6260dc1c9", "value": "1d768a13368cc933afa2bbfab4535159b6d5f9dddd1c60cfbc5f74680494fc3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c1b992-91ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617174261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174261, "uuid": "d08b685f-1959-4ae6-94a4-646cac40ecfc", "comment": "Malware payload (AgentTesla)", "value": "1f21a322f41a58e8a480391efb5479f4", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174261, "uuid": "7061204d-f301-4249-89e3-b6ccfdbfdb90", "comment": "Malware payload (AgentTesla)", "value": "1d8734eadb79b63e52c29c8f9a0730758fc3e0347d25ded852ce5a98744e674a", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174261, "uuid": "ca488f53-adda-49e0-b3d8-92367ca86b07", "comment": "Malware payload (AgentTesla)", "value": "db55e9694ceee5af3c5aa7352067416cfba0cd32", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174261, "uuid": "a49cd02b-7e4a-4459-a833-1699e2db8882", "comment": "Malware payload (AgentTesla)", "value": "8e4dad95f4611b6fc10e92663d65c769b4f277b7b8d67e16d4245b1008c384cda438b49a488cc0fc12a5db87be1fa5a2", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174261, "uuid": "892333c2-3203-491b-b6c2-c92924747d34", "value": "11C423F4E674CCB8DE85BA3C2F51E4A12B8E5AD23A5ECD2417147A0A74DCFC94CA0078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174261, "uuid": "7c2ac081-cd6e-43a0-b245-b9cfcc22100e", "value": "12288:PSiIEuqk5I2/zj/EGsxrrnwvQkPyAqZXgNX3W1MRrgMBItp:KiIEgrkG4TwvQk5XxRrgMBItp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174261, "uuid": "8977ea32-bb07-4b11-905b-d60c1ad527e9", "value": 573144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174261, "uuid": "b0213116-fd79-49ff-a75f-40666cd4466f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174261, "uuid": "d52e48ce-ba16-4be7-bf59-39610573aa7c", "value": "DHL Docs.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202925d7-923f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617208538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208538, "uuid": "42e70e0c-0e2f-4e2e-b339-208e5e156944", "comment": "Malware payload (IcedID)", "value": "5fc81fbf62f666d3ee9142519b594e6c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208538, "uuid": "8ac1769d-1d56-4b4c-990b-724e08caf932", "comment": "Malware payload (IcedID)", "value": "1d931723290ae28eff4e5882332b09b3f9d302dd5aae1cbffecc01ed531e1f06", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208538, "uuid": "aa01ac53-10aa-477e-bbeb-6d0b9470129d", "comment": "Malware payload (IcedID)", "value": "74a2a79bbbe24b3a142a24764c140b5c13c77863", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208538, "uuid": "5ddfca74-8130-4f1e-a4d8-5ea148349dbe", "comment": "Malware payload (IcedID)", "value": "f6d6626d1963f91ce0b73d2c9a65ce29a3a5770f96fe50c4c28de1b07558d17bb3ff77927fde101058d522672a3582cc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208538, "uuid": "67951817-64b9-4cd3-9ad5-eae7e4dd7e68", "value": "D5B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208538, "uuid": "f52353f4-e76a-46e4-8087-5a5639b69aa8", "value": "3072:g2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:gqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617208538, "uuid": "2ea35b34-4af3-458d-8e47-0e323d9698ab", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617208538, "uuid": "103b066b-f893-4bad-9c5c-78d9b47c5cff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208538, "uuid": "6aed268f-e762-4ee9-b081-25154ea367ce", "value": "document-786000954.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ffa096-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "68d8e2ad-9fa4-49b7-9c55-6523e4fa60fa", "comment": "Malware payload", "value": "189fcaf63416e35119c946ea53d3d3f7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "773ccf37-f1c0-41aa-93be-db12be611962", "comment": "Malware payload", "value": "1d98064e4b050c5c287d4b78afa153b55261ed2a925199f14b7ed49fcfe55552", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "b73d1e0c-0e73-4de3-bee1-f10c2d3320ad", "comment": "Malware payload", "value": "9753b0e2ac3036410e67cac54c1525c6009f8eb8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "d8ec1bc0-beb8-43e8-96f1-dd3d41493475", "comment": "Malware payload", "value": "1cf9d8501765af16d65a75d20c4ec4ea1ea99b2a7eb50245215461c22d329aa6e5795bbfe445ae8b315ac540de47a253", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "1e9e9137-1680-497d-8d91-3c969277e0cc", "value": "C714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "68e30173-9718-4863-9878-8e7b81476cfc", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "a56b5089-6651-46ac-95b7-acd87e17c203", "value": "3072:jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:kpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230991, "uuid": "b8036af2-9272-4b8b-bf1e-74b09dea9d18", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230991, "uuid": "c41dadf7-9795-46f1-bb64-d34722dff528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "f350da31-b1b3-4b16-a914-5fdf1e220b18", "value": "1d98064e4b050c5c287d4b78afa153b55261ed2a925199f14b7ed49fcfe55552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ff79a0-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617213319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213319, "uuid": "f7512428-5fd1-45ef-9f69-b4be74201120", "comment": "Malware payload (IcedID)", "value": "481164cf9761c6e94d1dca0a51dcf6c6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213319, "uuid": "bf806dba-ae46-42f9-85d1-7fa27297d67f", "comment": "Malware payload (IcedID)", "value": "1dafe2aaa50789ac70c140e8a8869ce5e0b336c2153833fd627d3587ba43f780", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213319, "uuid": "a1fba261-a75e-4c7c-8581-62e4feab8f83", "comment": "Malware payload (IcedID)", "value": "d81180c42deeb4551ee4675fb6477e1c5f2ab015", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213319, "uuid": "3cf45e75-a7de-4e00-a76c-c6a2d5a4d977", "comment": "Malware payload (IcedID)", "value": "e7071310e23839be45d1dd2dc71979e7fc8124ddbc616bce7a011bd48d752b1b43d94ce6798272d0e716725b3aacb392", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213319, "uuid": "c6bb4be0-9c30-4115-9680-ca8b81ba2e07", "value": "68B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213319, "uuid": "70842e3f-6027-4f3d-93a8-d0ca35be0096", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213319, "uuid": "eab91185-ae84-41f6-8264-d28941dbbfed", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213319, "uuid": "7c60197d-e264-4092-871b-566f3fb4df97", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213319, "uuid": "48c9da4f-4c0a-450e-8982-d872f13a62f4", "value": "document-1305942336.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f29e34-9231-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202503, "uuid": "f1f15c46-adbd-4ad5-ab14-9fe3d78792cf", "comment": "Malware payload (IcedID)", "value": "177af0af9e6c3a3580b5a77c4d644e69", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202503, "uuid": "9681b4ea-66e3-405a-96b6-c5f6ad83f7e0", "comment": "Malware payload (IcedID)", "value": "1dcc8c329f6d550b63e2dadffacd151218f5b1657f44efb0795327b96b688720", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202503, "uuid": "3e448684-7c87-4a0b-9086-f8c299819c5a", "comment": "Malware payload (IcedID)", "value": "32b466a7767015aa41b229ced510d6942f37e07b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202503, "uuid": "f0e565ac-ace5-4a9d-9286-9013ba70088f", "comment": "Malware payload (IcedID)", "value": "93d7bba1808b31bf48b3cbd614634c7066d9ac0b0c5646e8e769c7ed23e7298217ab3e52448c13d88a4181b5e5947813", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202503, "uuid": "5dbbf24f-1096-45f4-bfe1-11aed87c0cb6", "value": "23B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202503, "uuid": "03e3fd47-e392-4cc6-8ac5-6b127213e9cd", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202503, "uuid": "2a784e57-4b22-436c-b6ee-fd8a4a2b5cdb", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202503, "uuid": "8f75a070-c5b8-4671-bf33-a577326073db", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202503, "uuid": "7038d513-59f0-42be-9be0-ed2f634ce321", "value": "document-461719345.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23bb659-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204998, "uuid": "4c4e85a9-b3dc-419b-8c0b-824403c93a4a", "comment": "Malware payload (IcedID)", "value": "3cc178bae44929fd087a45b7ea165f60", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204998, "uuid": "83c42328-3202-431f-9f35-01fc3007bf02", "comment": "Malware payload (IcedID)", "value": "1de056af7db508d0e6bf4e91fabff14fd0a55cf93feed35a3ae48546f3c01002", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204998, "uuid": "3d8eee32-9d11-4d11-82c9-d7886d63524d", "comment": "Malware payload (IcedID)", "value": "a47b63f3c6594242340004401e477a0a4d1c8931", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204998, "uuid": "342b5764-adad-4659-99b2-b506b582745f", "comment": "Malware payload (IcedID)", "value": "a69bc986a225b9a3afcbb96b9529e506cfe1a63d6288fb0d34cf1ab29f7c1240b7f783dce4c7841ff68c55abd0f56f54", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204998, "uuid": "4086043d-d3b5-4da1-a1f5-aecc3288780c", "value": "12B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204998, "uuid": "df91e200-0e4c-4e8c-9c13-b60757f01ecd", "value": "3072:E2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:EqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204998, "uuid": "89fd0324-feec-422b-bcad-5374af16f49c", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204998, "uuid": "94d46907-b260-426f-9400-46c86d7692c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204998, "uuid": "a24fdf53-8b01-48bb-9add-40067ff67f3f", "value": "document-2070556.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872e74f8-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617173922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173922, "uuid": "8e6d3660-4109-4aa8-88c0-e3051d3f3f9d", "comment": "Malware payload (Formbook)", "value": "5a701f7f34d8198f49fdfb7dc7e88c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173922, "uuid": "0489ef3b-abb7-48b8-b923-0f150acd61d5", "comment": "Malware payload (Formbook)", "value": "1de5c6b986a6401ba0490ccce78e8bf125d9604d07c4ad87a856a588f0aba6cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173922, "uuid": "7f90051b-1ba8-4fab-bb53-b8be26e78f0d", "comment": "Malware payload (Formbook)", "value": "f9829d21aaa77699e343c5d3663e91a3f193ef2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173922, "uuid": "379918ec-3dcb-4177-b29e-d7fcb90a6ebb", "comment": "Malware payload (Formbook)", "value": "cc393cce215207ac7d35450122efb7ee92d178a0709d0d500cfc977478d486cd98228f9812ddd09a380b115b2bc6f454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173922, "uuid": "8e64e93e-258d-436d-b95b-e48b6342b5a0", "value": "D724124CA2F4C4B7E5A5147035F18338FBB6E31732506B5B6B785F1C75182EAD82928E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173922, "uuid": "11462317-b27e-41d1-8bca-67eb9190776b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173922, "uuid": "99a49b96-3d77-43a3-9f8a-c562f97e38e3", "value": "6144:PAPICphQqR3qpfERh3KZgJvwYieVkxbvIX5:uphQE3qxqc4VIbvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173922, "uuid": "9cf8b6fb-28a7-4ca1-bf35-b8b014302e38", "value": 222049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173922, "uuid": "7dd11e53-a6f8-40f5-b588-3b814f627c6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173922, "uuid": "9c5ce749-578a-42b0-9e59-a4fff7a1d825", "value": "DA-PROFORMA-BCC-211370-1-1289009-doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ba00ff-9258-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219494, "uuid": "f170950d-0f75-43a9-9c37-984bafb3325b", "comment": "Malware payload (Dridex)", "value": "14cefd10afe94ca243a2e66166394dda", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219494, "uuid": "0f6ff004-97ad-411f-976c-8d19885d2c5c", "comment": "Malware payload (Dridex)", "value": "1e0902d9ef83c93f1ce6cebf85ef1c1a4beb4d7a50b0c6aba818ce2a7d9eb91a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219494, "uuid": "f4d53d14-1f05-469e-bfe0-54ac6240c794", "comment": "Malware payload (Dridex)", "value": "3fc40f918b77aefcd7dc73a158609735d6f9108f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219494, "uuid": "e086af7e-7b62-4f36-9a86-54f187dc41f7", "comment": "Malware payload (Dridex)", "value": "0bd59ddb0569f84044bc939d3aa5949bd8dd64961b98495790705d3b994672691cb24a807371826413dc9db5225f9bc5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219494, "uuid": "e6104e01-562b-4c28-8c11-a871e1e30461", "value": "6C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219494, "uuid": "c042d388-61dc-4163-bde0-35f2d824dc48", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219494, "uuid": "75adaaa8-7a5a-4ea0-923f-b0503896208b", "value": "3072:K1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219494, "uuid": "2898406c-25aa-40a7-86b2-4cee112e7ac4", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219494, "uuid": "320bd2af-2922-4f72-ad84-56ba08fa603f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219494, "uuid": "7a508040-8ccb-4765-832c-8a9edfa24a65", "value": "1e0902d9ef83c93f1ce6cebf85ef1c1a4beb4d7a50b0c6aba818ce2a7d9eb91a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7416602-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216630, "uuid": "d2c8efab-673b-46f9-af99-83315f09b26a", "comment": "Malware payload (Dridex)", "value": "aa632742ae61b1925f3e4423b2bb07c0", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216630, "uuid": "02f714d3-e7e3-423c-ab9d-c401c898abcd", "comment": "Malware payload (Dridex)", "value": "1e376a608a35e24ec4a480b524ef62e48b91e2a65ee646c9fed1facd6cac5456", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216630, "uuid": "9fbda397-736b-4536-9e65-dd57a01d7d38", "comment": "Malware payload (Dridex)", "value": "5493e31402412a4f8a157d43cc211ed6667bc5dc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216630, "uuid": "67140bb1-5457-47ea-ad6d-9abacea24bef", "comment": "Malware payload (Dridex)", "value": "9f9edd52a749be655d9654360dea1d06ea9a1e7dd1d07d8d72d85afc3acecef8170f2620df3808f430c12e77fbe74412", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216630, "uuid": "d1ddd433-10e1-4271-9f8d-034436385fd3", "value": "0714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216630, "uuid": "2526455f-cd87-49c0-8501-6b92dbad39a8", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216630, "uuid": "5ce5a003-f917-40d6-9f9b-e23a815a6493", "value": "3072:jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:kpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216630, "uuid": "c601a668-e320-49df-a644-fa5029967a33", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216630, "uuid": "79166d9d-0659-478f-9df2-aebe1b9762c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216630, "uuid": "24b8bdb3-7a0d-4b72-a6ce-737b708d33ec", "value": "1e376a608a35e24ec4a480b524ef62e48b91e2a65ee646c9fed1facd6cac5456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a271c46f-9224-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617197160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197160, "uuid": "d8edfc2c-2303-44e3-9c06-e98f6ae4ce43", "comment": "Malware payload", "value": "f8976f1c57731b621f43a1c1578f20b6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "MobileSpy", "colour": "#9BB28A", "exportable": true, "hide_tag": false }, { "name": "SMSstealer", "colour": "#0C290A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197160, "uuid": "ecfeb3d9-0254-4e5b-9a60-b79fec350eb4", "comment": "Malware payload", "value": "1e4ac37ed8c7b704ae0ac57e1a8b29728fecddb360e84b8e8353e2876202d3ef", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "MobileSpy", "colour": "#9BB28A", "exportable": true, "hide_tag": false }, { "name": "SMSstealer", "colour": "#0C290A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197160, "uuid": "7733f814-3b69-41d6-9817-841c9e095108", "comment": "Malware payload", "value": "41836122beae80ea8993df0fea449efdc32fb329", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "MobileSpy", "colour": "#9BB28A", "exportable": true, "hide_tag": false }, { "name": "SMSstealer", "colour": "#0C290A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197160, "uuid": "77065130-46c6-4fec-9ad2-17b54fedb938", "comment": "Malware payload", "value": "a90c71de9d6e0a832b2bc40e84e57b494aa955428fd8f25b4d3d26e94a06482cb9a493563764f3da1a8a731b96eb5db8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "MobileSpy", "colour": "#9BB28A", "exportable": true, "hide_tag": false }, { "name": "SMSstealer", "colour": "#0C290A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197160, "uuid": "ac81ba8f-9599-4bcb-bdf8-062f4c82e36e", "value": "E155DF81F3C9BC2FCDB7C0324BB60A6B95968C468A46D7574561B12C8DFB9C09E85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197160, "uuid": "c70ffd92-46fa-4114-b031-fdea7dbdff94", "value": "24576:A5dyu/KIQB4HK7E3nbT3eYcXWpsgwaR5btwv4nXePOGOidcGlxigk3mlGb:myu/KnqKAnuWpb5R5JcHxqGugkcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617197160, "uuid": "5bd270dd-d0a7-47c7-8efd-c1d2c701dd49", "value": 1347549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617197160, "uuid": "316ad0df-f3b1-4ac0-bd63-e7c889142b4b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197160, "uuid": "daeec36d-985b-45d9-9226-fa225d8a9c42", "value": "\ud63c\uc790\ub9cc\ubd10.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290493f8-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160449, "uuid": "b2dea456-363c-4799-8145-c4463540670c", "comment": "Malware payload (IcedID)", "value": "89e6a613ca81e8e949289638f8e44cef", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160449, "uuid": "719c26b3-5e50-4660-ab4c-405437e8f55d", "comment": "Malware payload (IcedID)", "value": "1e4ed9495f0920c443bb9e634c43e2c35a852c99beb44d8a0970b88d3233e386", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160449, "uuid": "ab93bf48-78f5-485a-af7e-fa21491c2286", "comment": "Malware payload (IcedID)", "value": "78629b8e1c51a5e86a287a930f2de4b46a6fed5d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160449, "uuid": "31ba98ae-5ae6-47bd-90b5-4092ec7a2a3d", "comment": "Malware payload (IcedID)", "value": "e6d3c5a1640e42e3bf461760aa2fa24ad1f9d04a44546f738f54f033f6b68277262569e897d3e789de02e564589d8d39", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160449, "uuid": "76f9a01d-903f-40f0-b623-c4f149a47919", "value": "02B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160449, "uuid": "04173826-1d68-4288-824b-856c2ac8cac4", "value": "3072:M2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:MzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160449, "uuid": "3715c332-b964-4571-b844-2447fc425795", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160449, "uuid": "8fd327c9-808d-489e-98d5-02d5c50bc731", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160449, "uuid": "3504f377-bf37-4b28-9b64-bde1238d7951", "value": "document-681179659.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81251459-924e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617215143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215143, "uuid": "d83f18c6-ae22-4cdd-ad35-cc45f98ca239", "comment": "Malware payload (RedLineStealer)", "value": "2b2b022ec06038e0e9a4d2dec1361d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215143, "uuid": "e49f6ee9-d28e-4a26-bac1-e56e163251ad", "comment": "Malware payload (RedLineStealer)", "value": "1e93fd2be4ac69ce3d235aae5cb9099fa404376bfa76ade998efd42dd190f735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215143, "uuid": "b3f32fb7-60ac-4ea4-a12b-67f1dd2480d7", "comment": "Malware payload (RedLineStealer)", "value": "12bddeb2345772d5c58e2ab720a2de350babbc55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215143, "uuid": "dce9159c-0ee4-41d8-986c-28f79f322d43", "comment": "Malware payload (RedLineStealer)", "value": "fe18ec361a9c8bae90266a83fc51207c4dea1eaf8d96a683cc03b2ab6db84b86d44f36ea3b671981d6d308d15cae4078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215143, "uuid": "5c6684a5-01db-4613-b255-9bca53adfc19", "value": "9964D000B5D0C433E1121A360825D7A69936FCB16F74A6CB3B943FBA5E752E14A37793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215143, "uuid": "cbc8a4b5-c608-4ef9-be80-921035a160dc", "value": "061a2e87f94cf9f8906a2def43fae40c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215143, "uuid": "00b42e5c-44ff-43a4-8cc8-a081d58ee257", "value": "6144:k7ty0/fGMoLi5SHm+gXPy0L7vgfSBDO9SbhJK:kc0/etu5wBgfdL2SA0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215143, "uuid": "b96c620a-c1ba-49af-bc2e-71fc20294deb", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215143, "uuid": "5dba7dd2-404c-4654-8c0b-da50d3c384cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215143, "uuid": "9f1f2433-b900-45c3-ade6-b78e748f99dc", "value": "2b2b022ec06038e0e9a4d2dec1361d69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0866daa9-920c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617186594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186594, "uuid": "f39209cf-34cb-48cf-924e-7c4bd55833ea", "comment": "Malware payload (Loki)", "value": "934f752a51ee892650a0df55cf24be5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186594, "uuid": "6dc2028d-e3b1-4070-94d3-d2d0dda96651", "comment": "Malware payload (Loki)", "value": "1e9501f581627047a9028e1e0e6ae5a2fef199520b557bfad8caea8a8a28cb00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186594, "uuid": "d9c9b8de-182b-43d7-9767-23a01ac7e57f", "comment": "Malware payload (Loki)", "value": "c777f7dfae12990ec6886d6693648ea9b9bd27ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186594, "uuid": "c3a2c18f-c8a7-4e2e-bf1b-da7548939407", "comment": "Malware payload (Loki)", "value": "c4ed996e1a7037ae209b0390ac2976da216495ec124fa686292661ee3619a45a69f9666d518a8cf72fbea48bc6754c46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186594, "uuid": "37330590-f474-4781-b0be-8d16944df93a", "value": "A8F39C9D726072DFC86BC4B29E981CA4FA6034BB871F9613A41719EDDE0D997CF140B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186594, "uuid": "44b80446-a6f1-44dc-a780-976a3ed2c383", "value": "3072:NNl0gnprwNIjulvvMGukJKXiuNdfy/A7smg9ukHxqn1rLEylLgCKz8mnejG:FXrqSXZdQssmuLxrThImnej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617186594, "uuid": "5d5dfbd1-8091-4c13-9990-da3cd62201fb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617186594, "uuid": "ce88eaa7-9c51-49a4-b675-591e2a89a04b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186594, "uuid": "a99445d8-2c19-4211-b4b7-71d9b7856d89", "value": "Tarak Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd89b0b8-9234-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204078, "uuid": "a9102dc2-b824-4b9c-ad6c-117d181c5e34", "comment": "Malware payload (IcedID)", "value": "0521de3bb82c3ab2f62167b3de072590", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204078, "uuid": "88e2f97d-ee68-4ed3-9883-403983f120f3", "comment": "Malware payload (IcedID)", "value": "1e9da636e05320a32253658f0bd7de9387071fc7eeb632db567cf19d3d6330f9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204078, "uuid": "1a602d77-0b44-44ae-9237-c08f7f1555e9", "comment": "Malware payload (IcedID)", "value": "d001e483c0c87696ed1c99674cc0816e6a57acfb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204078, "uuid": "f7923d11-98bd-4ba8-9f97-31bde1d3da8c", "comment": "Malware payload (IcedID)", "value": "421f08b1612d580ca548045c2edafe6038c3a5bf600ab2ab9d13fe1bc67ba22ba695d5f9d786aae96dfa7ab779728382", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204078, "uuid": "f8e03ca6-3953-41f3-a24a-f1676606433c", "value": "2DB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204078, "uuid": "3f7a2396-4303-4202-bf79-761b858e4fbb", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204078, "uuid": "f84f4498-c9ab-43b9-ae63-bdcbffc4b444", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204078, "uuid": "c0965277-25b2-420c-a061-6eef3369f3d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204078, "uuid": "0ff80bb0-0699-4c10-be9b-95636dc10ffe", "value": "document-1594963250.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca651124-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1617213119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213119, "uuid": "2845a545-68aa-45cf-97f0-61ae8531872e", "comment": "Malware payload (Smoke Loader)", "value": "ef521e9151d2d5f33ba6eae24bd6cbf7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213119, "uuid": "0bd53bbd-422a-47c5-a59c-ff78654779b7", "comment": "Malware payload (Smoke Loader)", "value": "1ec171eceaa41c096ef1b91eee79d32b4d3e509ae4670ec272f1f20ec799f7c3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213119, "uuid": "ee2df648-d01c-41ba-a16c-a47aa1979e41", "comment": "Malware payload (Smoke Loader)", "value": "6b5bc535071a0d10eba18554619fab9638435ea4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213119, "uuid": "b815d1d1-b767-4a23-9e71-681eb11a67ee", "comment": "Malware payload (Smoke Loader)", "value": "7209df51121eff2ea75db7c48eaa96afccfcf63a2820950fd3444020ab1589e5cb8f4af2d17de7552abbefa88e2eeeb4", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213119, "uuid": "f4a94a3a-daf0-4785-9982-9b789e239817", "value": "0C049C00B2D5C473D1960A750821C6B55936FCB69F34A6CB7B943F6A5E363E18B3A383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213119, "uuid": "8301e7df-777b-4365-b0d7-2747dbd766bb", "value": "52daee09330e1d9ebf497442d16920ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213119, "uuid": "6e37d5f6-7faa-408f-bd47-afe76febb748", "value": "3072:l4udVql0CnFacoqOLQzand0hOtO9eSOd08VWgQApVal:fdovnCqOLQKd0hmR1Qjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213119, "uuid": "f0251368-4905-487b-b541-6e46a67e0b75", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213119, "uuid": "6e4be102-6028-44f1-a2e9-b178cbde5667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213119, "uuid": "57e26628-9294-470e-9e19-1964f11778e0", "value": "ef521e9151d2d5f33ba6eae24bd6cbf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cedbe95-922e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617201285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201285, "uuid": "3f131e66-e4c1-4ffd-a85f-30c9ab9c915b", "comment": "Malware payload (IcedID)", "value": "f911e245e74c75d0d57966825c3bd66b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201285, "uuid": "f4d8bfdb-1e10-4333-b031-8638322fea93", "comment": "Malware payload (IcedID)", "value": "1ee737fbf66d1fb4705be0769cc3d4e5c8f8802e06d70b49538208713e41ad25", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201285, "uuid": "d50caaca-3197-487b-9045-2a97dd2189b3", "comment": "Malware payload (IcedID)", "value": "6022d2598fdbf1b9daf65d180cfd267b4c9750f9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201285, "uuid": "0307850c-5777-4cf4-9d0c-debd439964de", "comment": "Malware payload (IcedID)", "value": "34746df644508c0f5479b05fc27802321fdc6d702f9f4cc0178d64eb0ef42b70df17ca20ee579caa20c00dd2b7667006", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201285, "uuid": "e1aaa97d-159f-408d-9f3e-f7c92c593fbd", "value": "E2B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201285, "uuid": "0d12ec95-2c08-416b-8328-66f42337314c", "value": "3072:A2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:AqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617201285, "uuid": "1aaf2d6e-49cb-4021-aa45-a44d0ae4230d", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617201285, "uuid": "bd95e8b6-15e9-45ac-9d29-af71be4274fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201285, "uuid": "d600dc45-ebc6-48a9-96d7-e08136773dc1", "value": "document-29195277.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ed9a52-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "62cdbd34-9550-4bff-8c6d-d181028f65cf", "comment": "Malware payload", "value": "00f8267d98c94e8dd957d6e2a7b37660", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "fea5b156-b8cf-4fe0-a093-53a86a832f43", "comment": "Malware payload", "value": "1f1a4c1720b3c86ee1dbbf317235688b34b214214d33c37d6bcd4e05b4e95cab", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "c8c24c5d-8771-4ee8-96e1-0668bcef73e0", "comment": "Malware payload", "value": "246421cf262db449fe44046b596619d47877bd74", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "35b366ae-1a4b-496f-94d6-407ddb59e3ff", "comment": "Malware payload", "value": "5c74116c535c26be01ca65e7d204b7f137e156f5113950cc121940568ac4abba0f1e19b6928079953171d7ed3b6273a4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "8c588478-9e92-4f8c-9fe8-32e722cba5ca", "value": "E814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "f6d84ef6-f16c-410b-a95f-7cd1a249dba5", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "e0cc2daa-53da-4bd3-8e9b-c4bc7a461315", "value": "3072:gopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:HpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230991, "uuid": "d5ecd6d1-3845-4cfc-8dff-34e3f2500369", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230991, "uuid": "81e9ac92-52a8-406c-89f2-eec3df9a20e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "fdb5dc10-43dc-4606-bafc-5644359e5046", "value": "1f1a4c1720b3c86ee1dbbf317235688b34b214214d33c37d6bcd4e05b4e95cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6152c8f3-91d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162262, "uuid": "dc61e72c-d2a3-47ad-b8a3-c0ff9fd83182", "comment": "Malware payload (IcedID)", "value": "9df98aa4def5e1f68fdf216484a1e169", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162262, "uuid": "02896bf3-b7c8-4505-901e-691445aa9060", "comment": "Malware payload (IcedID)", "value": "1fc0a02ea0a1cd892c80674fc85ef6c203d9af1b40d2b9df382200998bf693f1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162262, "uuid": "ae5a2c6f-9202-4489-966f-0cdd1a14d1ae", "comment": "Malware payload (IcedID)", "value": "3e7da78ff28a146c679013b68ec08971e6f3795d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162262, "uuid": "6a732573-e5c3-425b-ac1e-52354dc2f9d8", "comment": "Malware payload (IcedID)", "value": "b3a3da59060908634572a15152188669ef97c47a34ee4b5e83ac67f82849a92b8358a19167c39aee1e150d2cbb2333a0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162262, "uuid": "6c26ce90-1af9-4ba9-87b2-e06be17e63f2", "value": "4AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162262, "uuid": "667e1c43-b0a6-42d6-8fc1-49b95870fb70", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162262, "uuid": "fbaf0941-1f34-45d0-a927-85ee0d93f3f2", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162262, "uuid": "2d9fad56-434e-4f17-b664-381795caa60e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162262, "uuid": "3342d4e8-dbf6-4cfc-b97c-2d31590fa311", "value": "document-73565592.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb39da6-925f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222545, "uuid": "05be014e-373b-4640-b1f1-f3495cbd9a7d", "comment": "Malware payload (Dridex)", "value": "28c733869f3d5128ae5167b2def0bed2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222545, "uuid": "26a661cd-f1b1-4f93-9bca-4cae3f3a262f", "comment": "Malware payload (Dridex)", "value": "1fd507600d601bf11097e32eb1e451c97d3ac73058906726f7e0cffdc3901553", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222545, "uuid": "6b76a657-d57d-4d2b-a9ce-d5c64423ece6", "comment": "Malware payload (Dridex)", "value": "510648d673a0299d676f35977280fd3473c8c26d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222545, "uuid": "346670ff-e5ae-40a3-8553-7f8d1a36aa18", "comment": "Malware payload (Dridex)", "value": "337f763a81c54f1dc91b2a12d1121fdd7467120105ee7912a410bb6ec22fb4502dc79869e5d93fa18f1182988804b306", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222545, "uuid": "8ad43f01-af71-4216-97f0-074145893e72", "value": "0A248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222545, "uuid": "8bf00aad-6847-4fab-8f9a-c7504414b22a", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222545, "uuid": "08e2701a-d83b-4bbc-9293-62f37b5daa41", "value": "3072:06TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:0oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222545, "uuid": "149b8b84-be80-463d-9361-0b04e84f25df", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222545, "uuid": "b21f9df7-80da-4830-8514-9f5ab04c5a72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222545, "uuid": "e9498e1f-63c3-4181-915a-06d92d2bd2fd", "value": "1fd507600d601bf11097e32eb1e451c97d3ac73058906726f7e0cffdc3901553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c552d2b9-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217405, "uuid": "4a22afdc-be47-498a-852c-e7ff6810f705", "comment": "Malware payload (Dridex)", "value": "c2cd2e6b57511fe86d27d17cbc8cec42", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217405, "uuid": "278b08a1-56a1-4e13-b186-04c86f291994", "comment": "Malware payload (Dridex)", "value": "201b1f5eb491b4e9577c630523a74bb7e0a7d2b3a7892f883d7655b400e5cbff", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217405, "uuid": "cec9a8e7-3aa9-4490-a685-1fec4894f8e8", "comment": "Malware payload (Dridex)", "value": "92c095b5a0120c1e561f2af81f867c5a623cb1b8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217405, "uuid": "69525eed-a77e-4efe-b8a0-46de7717db61", "comment": "Malware payload (Dridex)", "value": "b19f8b4551ae1a7e1037649d848ecc5a6013b40f62881e306ed777bd3c694a26a4d52cefa392039d187a229cfa6b0f89", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217405, "uuid": "d3e10fc3-14a6-4bb2-8442-c0df0b7a59f1", "value": "B414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217405, "uuid": "b7d7dd72-1115-45d2-aa66-85e27211828e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217405, "uuid": "43a02ff6-bfed-494b-b2da-0aae5001813c", "value": "3072:8opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:DpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217405, "uuid": "7d2c9173-1f44-4d5f-b9ee-e97e7dda4b7f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217405, "uuid": "82a3bdc9-cb23-4ea4-93dd-a8899c746ed3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217405, "uuid": "c7e67525-47e7-4204-b486-cfa2c87a59e8", "value": "201b1f5eb491b4e9577c630523a74bb7e0a7d2b3a7892f883d7655b400e5cbff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5007ce1-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158590, "uuid": "24a1a549-6354-4999-979c-92dfb2d65d94", "comment": "Malware payload (IcedID)", "value": "49516cd88f2b96e6b15f1f0716b8fcae", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158590, "uuid": "86a9cecc-71f6-41c6-818a-339a48f796f7", "comment": "Malware payload (IcedID)", "value": "20b4b3cc2f00f29c848f9fecb2d71bf8f4e7dcd6b70b7664c1a799ed9eefee49", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158590, "uuid": "66adf220-0ffc-4ba7-9b3f-f9349fb60b61", "comment": "Malware payload (IcedID)", "value": "9a47a937d310cfbcc37595dcee7e5b79bfb7578a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158590, "uuid": "2b724f91-e82d-4b75-a77a-9268b3a11042", "comment": "Malware payload (IcedID)", "value": "766e457f3200a79d845823a856fe9356fd9dd3b3b7d3b80060c9cf0ceb42885204c82d2e3c4a6b4d1e5761d5867f4799", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158590, "uuid": "b77cd525-b87f-4658-80c8-a3bfad7e1cf2", "value": "6EB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158590, "uuid": "84c0dfe2-c0f3-4709-a148-359a3391d971", "value": "3072:y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:yzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158590, "uuid": "540c7a9d-d83f-4715-bc4a-e6983dba095e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158590, "uuid": "89602918-410a-4768-9f2c-32396bf64d9b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158590, "uuid": "00af1578-d5aa-4ec0-a628-b8cd17006555", "value": "document-1436183219.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76583536-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232734, "uuid": "3e72c0b1-be7f-4cfc-98e8-8f06a9d2a39c", "comment": "Malware payload", "value": "0bfc1892cd69575afdcd05bffaefaa3b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232734, "uuid": "6fcbbf16-f215-4c1a-b2b0-b8d2203c5302", "comment": "Malware payload", "value": "20c61529562e15c7329abd953e84f32a6c93a3a0d9fc55c9db0587d5df5200d9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232734, "uuid": "f6cf143d-55ad-4e81-bd4b-a087d1580137", "comment": "Malware payload", "value": "afc06497140368840cf13e9c8b7bb0ba7d5fb57e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232734, "uuid": "4cf81bc2-3475-4a33-a359-0933d2505e0d", "comment": "Malware payload", "value": "07a920985577014c68425a87f674338af63573a536c07cc365f38de4e307b9dcf1485388715964c672ba2e0338ff7be9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232734, "uuid": "2c0b33f0-8b82-45d0-8e40-0bd57c378076", "value": "0814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232734, "uuid": "c7630b99-2596-4e4f-a5f0-18ea1d221516", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232734, "uuid": "fc801696-2d8f-4512-8548-5bc2bba0c51e", "value": "3072:9opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ypjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232734, "uuid": "db140101-caa7-46cc-b354-16542af3abc4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232734, "uuid": "422a32d9-16d9-4de5-bcb8-2d0a01293c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232734, "uuid": "df29f817-fe2c-4166-8825-e8b8d0ca3884", "value": "20c61529562e15c7329abd953e84f32a6c93a3a0d9fc55c9db0587d5df5200d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8e6456-9268-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226227, "uuid": "88e7bd61-4b65-4263-95e6-58dcd5f6fdff", "comment": "Malware payload", "value": "01ac6e68117e3930a791d9cf04873731", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226227, "uuid": "404effa3-df65-4b0a-8769-0c8170a98cf2", "comment": "Malware payload", "value": "20d5b81b5831929f59765e71cb0047a61d100312ff46bed64dc7ecb85c99c587", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226227, "uuid": "3edeb7e4-3d3c-4fa9-8861-db17a3430910", "comment": "Malware payload", "value": "deefd0bd755d9e4ef9e99932e771bc27b5400cc3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226227, "uuid": "e42c851e-753a-4db3-b754-4f160fc2e818", "comment": "Malware payload", "value": "1ca927d359dbb9867ea508ac286cb995ae35e9795fa7929da9b0afd2d1ae2b441ae6c3590797ebb1a9050285a6b63606", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226227, "uuid": "a39f80ad-6076-4872-8953-db01cd61c44b", "value": "40248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226227, "uuid": "0b82fc02-f836-49cd-9840-58c49370728a", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226227, "uuid": "087131c7-3247-4bff-a2c3-fecaffbfe07f", "value": "3072:F6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:FoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226227, "uuid": "ccb0ac8d-9966-45e8-a9fb-be8d6686f7b8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226227, "uuid": "d38f1649-9f8f-436c-a359-401fa83a9bda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226227, "uuid": "df8b55d9-5ec0-4809-9f75-d62a49e67f98", "value": "20d5b81b5831929f59765e71cb0047a61d100312ff46bed64dc7ecb85c99c587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f4a062-9240-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209009, "uuid": "eac18747-6a61-4ac7-97c3-fe38e8da1703", "comment": "Malware payload (IcedID)", "value": "5de3e34459c3f1df5c66067518588df2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209009, "uuid": "ad3573cc-b53b-43c9-af05-8c4f62788ab9", "comment": "Malware payload (IcedID)", "value": "20d87e3726d685933ebdddeb40d37d0d8d2dc46e06f18aed540765da6072abef", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209009, "uuid": "ca92eaa3-4033-4211-9586-b63a167d2cd3", "comment": "Malware payload (IcedID)", "value": "38bb34550b95b7d145f844859a566070d39cca08", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209009, "uuid": "712eb3c3-e390-4fcc-8012-b6fbe920f11e", "comment": "Malware payload (IcedID)", "value": "bd60f3fe5fc10692152cbd25e869a46469a791209457d7ee1625b2187a3b0177e970f818ca97f0d5dd45e8143456565a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209009, "uuid": "f8424f64-cf60-4919-88e2-1e84024f681e", "value": "A6B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209009, "uuid": "b7b9138c-da97-4339-9dc1-a1a67f6ad31f", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209009, "uuid": "00dfbe83-79cf-4158-8ff7-386da44a9183", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209009, "uuid": "054cb45c-932e-44a2-8ec2-4744840f11e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209009, "uuid": "2ee2904d-b47a-4b1c-8609-23ac355a7255", "value": "document-2011328773.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9234cb1-924f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617215667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215667, "uuid": "81f81811-370c-4ad9-af00-1eddd7940865", "comment": "Malware payload (AsyncRAT)", "value": "7901542b90730087b7205726909f01d5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215667, "uuid": "139926d1-af11-4d46-9d36-7b6650fc091c", "comment": "Malware payload (AsyncRAT)", "value": "213528a5164fcb5253010129aac3855b4b905c9c5a9514a2a2b9db7e2b592a73", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215667, "uuid": "d4e75a47-e304-4359-b198-c752ba0975b6", "comment": "Malware payload (AsyncRAT)", "value": "9e49fa0a2ceb45512e85650d74c4d593b245de91", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215667, "uuid": "2710c9d9-4ac2-4031-b065-dcce7bc12ae2", "comment": "Malware payload (AsyncRAT)", "value": "7f62e4ea2d5ebab28db2deffb4254b32b15445a64d56c545d625fbf9e875659767a011b36733271d52ea539078736571", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215667, "uuid": "bce03bff-4878-44e8-a958-2410aaad2b72", "value": "7554DF22A3986B31F67EA7B91160152023F2F525D723FB1D3EE845DD1996F8083B7B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215667, "uuid": "5ce0f3c2-f40d-4518-97a2-b30ec3b780da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215667, "uuid": "c3fdcf48-0ee1-4f64-ba67-e91fea7f0c27", "value": "6144:3qtedmWMt/XneqIILVEg7kM3ly9CdCVAFYt19tyPmmAR4x:swYeyJ/lYCoVEI13yunW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215667, "uuid": "b110fd77-ea42-43e4-a8cf-57e9ffaa4519", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215667, "uuid": "c3351e4d-0f92-4d27-a738-070aeb28be97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215667, "uuid": "cf8cf219-6ea3-4a94-ac2e-8277403f29f2", "value": "7901542b90730087b7205726909f01d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffcbe61-91d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162850, "uuid": "a994a9fe-59a3-4b30-b6d5-7c51703dd81a", "comment": "Malware payload (IcedID)", "value": "df6996c339afd6406c78fd58c36428e4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162850, "uuid": "eecaa1e3-7af9-4256-b4c3-fd8c67740376", "comment": "Malware payload (IcedID)", "value": "21d2d24b1722628d5cf1e5431453bab23f5267393905ee436183a6c1bfed8807", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162850, "uuid": "47e4d80c-ed7d-4482-ba41-29d533dd4941", "comment": "Malware payload (IcedID)", "value": "47daf80ff0af80c5aa122efa453561dec7b07314", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162850, "uuid": "01ff6207-16a6-448f-af13-042496c91b98", "comment": "Malware payload (IcedID)", "value": "5b31370a53f2f4654d13e3c02629ea291b78fc65247a552271d9f429578d2dc5d191a06c6fd3e9577035dba79d5f803e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162850, "uuid": "5b50c9e7-e54e-44af-ad54-cdda1917fa93", "value": "F8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162850, "uuid": "694b481a-ae02-4df0-80c4-eff6bf117a47", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162850, "uuid": "425f4a96-e8ee-4121-8595-ffde30cce020", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162850, "uuid": "20d926d8-b317-4aa6-970e-0a9fa8dfb6f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162850, "uuid": "8b680250-2c19-4b3f-8619-25fb44018e3e", "value": "document-636168554.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3676183a-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212870, "uuid": "7a2a82ab-1db8-4c17-a1e1-488a30950012", "comment": "Malware payload (Dridex)", "value": "7c3a0de079b08e2835d3a84063092df6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212870, "uuid": "1d743167-d0b7-49b9-b585-cc3b96964244", "comment": "Malware payload (Dridex)", "value": "21e94ae9954ec66be81788382299032b14e87d57965f2c297714bedde4ce66fc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212870, "uuid": "709c0744-0320-4ab9-9fff-304b4e5dd5e9", "comment": "Malware payload (Dridex)", "value": "17ce118756aa84e0aa8ea3301595e4fd1dcc9003", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212870, "uuid": "f4e178e2-82c8-4f16-8162-7d71cfbf8bcb", "comment": "Malware payload (Dridex)", "value": "afc83222937fcd79fb99a4b53a0c07b256172018e027db7d85b60d48ddf2a701b6cd90ee37ca92e2fa13aa5b9d15a189", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212870, "uuid": "8b062569-9266-4ec6-94a8-9b4cf9e299f8", "value": "DC248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212870, "uuid": "3307bbe6-a3b1-48d8-9fb9-5dfaa644fcb0", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212870, "uuid": "a3fc3d4f-c323-49c8-922d-6edb73b176fb", "value": "3072:j6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:joMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212870, "uuid": "4053900f-1311-49c0-b283-707928be9dbd", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212870, "uuid": "f57db0f7-fa2e-41da-804f-f89cedbedda4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212870, "uuid": "9e82e12a-ba83-4af7-b2c7-84ecaa7f9569", "value": "21e94ae9954ec66be81788382299032b14e87d57965f2c297714bedde4ce66fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74125800-922c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617200518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200518, "uuid": "114362db-3b4b-46d6-903c-3fe093a1ee70", "comment": "Malware payload (IcedID)", "value": "60ad9ace3cbb82cf53a99fd2b4827454", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200518, "uuid": "c2de880b-a601-4365-8d31-9a90f085fc9e", "comment": "Malware payload (IcedID)", "value": "2286df9c491b7a13d21f300e2668ba5b8f23f278a9628c5ce27cfa93f87c34a3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200518, "uuid": "2fd29afc-cc0f-4707-89d3-f6f57ab43bc2", "comment": "Malware payload (IcedID)", "value": "ec9ad9d9914d69f69e2b2c9f8a065f3392899d09", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200518, "uuid": "9ef46e91-423b-4198-892e-d7d8412fc7a4", "comment": "Malware payload (IcedID)", "value": "6c190dafcaa0c12478f8fec128a8177923deb26eefa8e18528fcf3aefd7a84579f5ac2fdf67322dd05ca6d9a8a96943b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200518, "uuid": "4e71986e-0c32-46a1-9588-0466002ebf57", "value": "34B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200518, "uuid": "340fb725-ad2a-4865-940c-ad3ea19cf749", "value": "3072:g2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:gqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200518, "uuid": "12d9732d-bd43-440f-8eda-37b5e824433f", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200518, "uuid": "a17f1944-849d-4e47-9130-defa5d408f08", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200518, "uuid": "e35a89aa-86d7-4692-b344-0ef44d417ca5", "value": "document-1983936858.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb40d6e0-9265-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617225226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225226, "uuid": "769457a0-516b-44a2-a4b0-fcc73c33b8ff", "comment": "Malware payload", "value": "790ae851043f8014edcbc53a6ada450c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225226, "uuid": "dbf20eaf-1071-469e-a272-387eca89c0c5", "comment": "Malware payload", "value": "22d6b08bca93fd5784bfb3daab65aa253b13040c356e9c74d3ec9bc0028197dc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225226, "uuid": "4b2ffb08-4bff-442c-aa05-907ae224aa27", "comment": "Malware payload", "value": "7682509ff1bf59f2e43f42c406d87002e4cb28c0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225226, "uuid": "68549f2e-a69b-4add-a63d-d9ffe250925b", "comment": "Malware payload", "value": "b2a808979f41b6e59e03ad75f757d0e6129dccaa1147076b4ab226c707ac47f6de167e811d01eb031c887fa597d16154", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225226, "uuid": "c61fea4b-3460-433c-874e-ac9481b71ebd", "value": "3B248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225226, "uuid": "56a87d3c-9546-4d34-af49-26631d62adb7", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225226, "uuid": "a60fa407-8181-4322-8ce2-b23e358b9058", "value": "3072:T6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ToMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617225226, "uuid": "8efd177a-187b-41f1-bcb1-5ee4bd63019f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617225226, "uuid": "7364b12c-0033-48bc-a300-d7b361a9dcf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225226, "uuid": "c775d4fd-e788-4806-bb3a-ce12302e25f1", "value": "22d6b08bca93fd5784bfb3daab65aa253b13040c356e9c74d3ec9bc0028197dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0369e8-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216321, "uuid": "70690b3e-999f-4049-b139-babb007df9d2", "comment": "Malware payload (Dridex)", "value": "ea9afac4e44d572f86b835a118b00924", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216321, "uuid": "9b7bd092-1fd9-4a30-8fdd-4c44583b0196", "comment": "Malware payload (Dridex)", "value": "232d2df7bae53a9b711ca8b47df01476eb7b57002762ad5c5ac07034aa86f328", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216321, "uuid": "a3d7e23c-a3a4-428d-962d-9bd838d5ba70", "comment": "Malware payload (Dridex)", "value": "1750801c9db569d483221ab2d3a97aea7d4c76ab", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216321, "uuid": "a97f1d8f-daa3-45ac-aed3-3f8660b41341", "comment": "Malware payload (Dridex)", "value": "61ba5903d01b360376f84c1307e729190d4b3582fe1a33429ec0602b8571cb905b4a7c1e19b2ff283d13deb7cd827d09", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216321, "uuid": "4dba2833-e61d-4181-9e3d-72b23ab8656c", "value": "9414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216321, "uuid": "f48be737-ac92-44cb-8439-046eb1809ad7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216321, "uuid": "339017bd-0808-46b1-8852-4a4eab193b9b", "value": "3072:lopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:KpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216321, "uuid": "0f8d0c3a-4018-4dcf-a836-bac12270bbe9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216321, "uuid": "502fda76-bdcf-43c2-9101-a36c2d5cdaa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216321, "uuid": "175dce42-528c-44d2-95c2-5bad39a10fdb", "value": "232d2df7bae53a9b711ca8b47df01476eb7b57002762ad5c5ac07034aa86f328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4598683b-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217191, "uuid": "30549f42-098a-4e39-814e-c90b5a2adcc9", "comment": "Malware payload (Dridex)", "value": "94064928420a4842bbbf526af4cdf915", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217191, "uuid": "a5ac4277-b356-420e-968d-fcb32813c987", "comment": "Malware payload (Dridex)", "value": "233dde7b1d0e0c4bfb500540809ac1554afade05fdfeee40f71d9651a9f60ca1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217191, "uuid": "1581cc29-3376-4b4b-b67c-469b77941751", "comment": "Malware payload (Dridex)", "value": "c616606a4011a20632f28c4b151f621c6067a941", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217191, "uuid": "74d379a5-59c0-4d52-871e-18d18788aba0", "comment": "Malware payload (Dridex)", "value": "2ffbc945711522de21e9900b3f2c56f51b1e39504a044478409f05d6d1761eb7331b1c86f8322e00f6dac4e37c039868", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217191, "uuid": "e4908170-dc5f-47c1-b6da-d5ffe926f0e4", "value": "E814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217191, "uuid": "a56a7b7c-f541-4646-a0e9-ba7cc2157e71", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217191, "uuid": "1156f3d6-866f-420b-918a-856c8fbf86c5", "value": "3072:vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ApjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217191, "uuid": "fbe825b0-49f5-4b63-9525-0ad7f149c71a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217191, "uuid": "60d355d1-b28d-4ca8-83f7-7d3b02113adf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217191, "uuid": "c46c3ada-132b-48fb-a8f0-269376ad6bee", "value": "233dde7b1d0e0c4bfb500540809ac1554afade05fdfeee40f71d9651a9f60ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0366ffa-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216967, "uuid": "51f616bc-1d54-4b8b-b07f-cb48751fb315", "comment": "Malware payload (Dridex)", "value": "a98ea4bf1f541a187c16809fa5cfdb09", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216967, "uuid": "c26f58e4-9bd2-463e-8fab-9eb7119b7871", "comment": "Malware payload (Dridex)", "value": "234c9de724b1be30ddd63c05a36a317b77fc564dacef13c001b11fbb62876b34", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216967, "uuid": "bf6850e8-e7ad-4fea-ade6-b3ca089fce1b", "comment": "Malware payload (Dridex)", "value": "384b564cc4b5c9f27ca07a147e078972b02cf43b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216967, "uuid": "d94712ad-d587-441a-a03f-691eed6452a6", "comment": "Malware payload (Dridex)", "value": "bd9a1770937b49068e1479805075e59adc7a4ad43a1526d096b33bcfce7462d9acb2e93c225c238e0608f679f1c43eb7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216967, "uuid": "e0057437-dca2-4483-b3e5-166f2dfaedce", "value": "6C14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216967, "uuid": "5f21de70-1dd6-4c9c-8bcf-899a3e46135f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216967, "uuid": "88fdc191-e70d-4a54-b1f5-ba539240b688", "value": "3072:vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ApjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216967, "uuid": "22da0072-d0e7-4d0c-a0a6-fd0b2b9c8460", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216967, "uuid": "0dab51fd-f701-45b6-9b89-fcfa8e0e186e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216967, "uuid": "5024a893-512c-4457-8702-4a70f7422cf6", "value": "234c9de724b1be30ddd63c05a36a317b77fc564dacef13c001b11fbb62876b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7397e7b-9250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216173, "uuid": "e14175c4-948c-45ee-92d8-8877a43a686a", "comment": "Malware payload (Dridex)", "value": "0fab222444c19692a1cb20c146df2485", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216173, "uuid": "e474d1a7-770c-4c81-a62d-64f376011cf8", "comment": "Malware payload (Dridex)", "value": "236b602dbe44c988421fd6ce974e23212b153cdb63956ad12e980e8fff08a10a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216173, "uuid": "2e605c47-ec34-4db4-9d70-c3b7e056767c", "comment": "Malware payload (Dridex)", "value": "c334b7deb6796379b60f2ac75142108b710ffc50", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216173, "uuid": "95da6fc1-2c0a-4608-a062-f4923b7e66f2", "comment": "Malware payload (Dridex)", "value": "7223f5b36b77e1f57b83cfc9e1bfc6b42017d40b19a2c08b940536e2ad26af5708b8c27cfa8a7d0b9bcefb1f61fc14cc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216173, "uuid": "d0733d64-ce9d-4373-bf59-655680bd497d", "value": "1E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216173, "uuid": "ebdc7dac-211e-498f-8983-b6c3eb253567", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216173, "uuid": "437044a9-4843-4dbb-97b1-bb0d6de5476c", "value": "3072:1opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:apjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216173, "uuid": "05c79a25-1381-4141-b8b9-d12a9f1dfba2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216173, "uuid": "777fbcf8-7740-4a0f-b9bd-16d385fe2e73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216173, "uuid": "10acd131-7bef-46df-83a7-240ce1dec53c", "value": "236b602dbe44c988421fd6ce974e23212b153cdb63956ad12e980e8fff08a10a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17783093-9206-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617184042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617184042, "uuid": "b703bb59-54b6-4e24-a171-1c1f6b000d53", "comment": "Malware payload (AgentTesla)", "value": "8a8a496889e61b1022ced848ac27cc3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617184042, "uuid": "442051b8-c8be-457b-bfc3-d8c148efa041", "comment": "Malware payload (AgentTesla)", "value": "23741f6b3349b09dae80e09a75a8653eeb1bb313ec3d294e6aa6ce80ec7fdbf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617184042, "uuid": "ba77bc9f-7123-448b-aa91-5df65234e580", "comment": "Malware payload (AgentTesla)", "value": "7ad5bb7a6beb9c3f0e7b519ec80741ee82108143", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617184042, "uuid": "424d0554-e604-4882-a6c2-4db815d5d35f", "comment": "Malware payload (AgentTesla)", "value": "a066a1fe44937fdee59bc24b58a27728742675497a440b2c184d0c7e3ce765cccfe7e1d9a45ba22072b33f011680c6b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617184042, "uuid": "af199f05-ff4e-4bad-ae17-56e22cf88ed2", "value": "DFC423503B5F6F0016A9D074660CF112B48FA7F2CE146B499BB011D865BC1EEDC6FA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617184042, "uuid": "0ee5e9ef-43af-48df-9f64-215656c5420c", "value": "12288:Gn4qFKuJRiIkSo/kC+NxiMRMbRhfNWUkJEt55ryO7y3T:u44KuJRGSRziM+bLxZvryoy3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617184042, "uuid": "0baa5794-56e0-4799-9a45-e9e86ca6cd4d", "value": 589737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617184042, "uuid": "24365bc1-1562-4805-a668-8905cb2c0775", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617184042, "uuid": "4caa6d25-6acd-416b-83a9-2d167d4bed39", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843b6285-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216866, "uuid": "ffdd87f8-43f1-43a2-bc30-1c38f3b60cba", "comment": "Malware payload (Dridex)", "value": "dace7e7d1f2bb0d528ff02698bef001a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216866, "uuid": "9f3a8e13-b2a8-4691-b95e-0b575370a80d", "comment": "Malware payload (Dridex)", "value": "2384b73c20a914930d25871441009f2beea28fefdc5a188ba752ade1c2525223", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216866, "uuid": "ec5e69e7-c0b4-4f11-8b6a-ed980b8d7cb9", "comment": "Malware payload (Dridex)", "value": "c59301ac60c08f479e50c8a14bd74eacd37f5822", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216866, "uuid": "98dece3d-24bb-485e-b281-4326c8b5a51b", "comment": "Malware payload (Dridex)", "value": "05600cdba548e7679d1a2314c1ab9616379f307ffd92ccf765b794cc457e8c19742fce9ca61fb32660f0d6688ae0337d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216866, "uuid": "f40b5b40-80b7-453d-8b9f-98872405ab76", "value": "9114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216866, "uuid": "a209598c-748e-4817-9647-92a7b7bcf385", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216866, "uuid": "508c2273-f009-4e06-8841-8d65d2651a35", "value": "3072:Oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:xpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216866, "uuid": "699fc804-8244-453f-aadd-0f3baafca1ca", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216866, "uuid": "e87ec0cc-8b57-44d6-a8a0-2547945658d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216866, "uuid": "cabdc89a-9a77-4967-96fa-211633881760", "value": "2384b73c20a914930d25871441009f2beea28fefdc5a188ba752ade1c2525223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c2148a-926f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617229375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229375, "uuid": "5a819b03-135e-4f6d-b9fc-b6e4f8e80993", "comment": "Malware payload (AsyncRAT)", "value": "465216966d07b75e020e8fcf19a907ba", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229375, "uuid": "7ede99df-f733-4111-858a-eaac7d6a58b3", "comment": "Malware payload (AsyncRAT)", "value": "239220e85470c99f53aa67a3f292c1d7af7b148ef2e48173f82f6472cede87a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229375, "uuid": "66f971c2-070e-4e51-8286-e4b87fed4000", "comment": "Malware payload (AsyncRAT)", "value": "efb8cc520f89eeb500736866ea2094dcace6426c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229375, "uuid": "0878d3c4-120d-4c25-93df-e74e9f8d69e6", "comment": "Malware payload (AsyncRAT)", "value": "d1f2a86672e640959b46dc053f6cde97e340f81be2d4d76c0ef230399ef84d536c59ba18102c4f4b9116d178abca2b86", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229375, "uuid": "1b968ef9-848f-43b6-8048-1b12c4c5da4b", "value": "20436D003BE9822BF2BE4F7459F322464676F1637A03D65E2CC4419B5623FC69A425FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229375, "uuid": "d51df754-cb48-4425-911f-637aa133454d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229375, "uuid": "79bd4f74-449d-4ac3-9d8d-45074b5f247a", "value": "1536:Qu1a21T3xN2X3N6EAbEbjazNX6z036+dWtlHXFBT:Quc6T3xN2X96EAbEbjINX6J+kH1BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229375, "uuid": "4c56c4d5-73ff-47ab-a25c-575f08131d13", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229375, "uuid": "10582ca4-0f71-441a-aaff-24cd5805c7fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229375, "uuid": "829c15a0-b2ef-44bd-9fad-f7fdd47c615e", "value": "465216966D07B75E020E8FCF19A907BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d458010-925a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617220156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220156, "uuid": "bd84b65a-e6c4-4423-842c-94b1a5d570c0", "comment": "Malware payload (Dridex)", "value": "f23c20afef66555d9bc05c56db70a6ce", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220156, "uuid": "79c94902-9600-4e5a-bc43-6931f926d4bd", "comment": "Malware payload (Dridex)", "value": "23b35f094e88218e8e1a59e275ff638e91f523e491d639872888bef102a1ff64", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220156, "uuid": "aa7a8f17-cace-400b-b077-703ed0185d85", "comment": "Malware payload (Dridex)", "value": "8042da70eefb85c3bc50aaeee467fd39ddd2ffd6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220156, "uuid": "2833a1e8-9863-4320-86c1-44abf467b716", "comment": "Malware payload (Dridex)", "value": "1c12965c1ddc43b116aa77105fe633424d280319502c95aad3877cc758092e9f8b6fa5c8769ca25530c0a3581edfc086", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220156, "uuid": "3b4493d3-1db1-4573-a5cc-8f29a169ac6e", "value": "1414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220156, "uuid": "bc6173c3-3ecc-4fc0-bdc5-354e29c8d1bc", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220156, "uuid": "5afaf962-308b-4c6b-b5b3-4ba2b55c78f7", "value": "3072:Ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:mpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617220156, "uuid": "c13584d6-7e2b-4033-95c5-4078c5c1bf2c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617220156, "uuid": "c5aafb69-92f7-45a2-aff7-f75a99f868b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220156, "uuid": "ee628f71-0874-49f9-973b-fad61a28d9c3", "value": "23b35f094e88218e8e1a59e275ff638e91f523e491d639872888bef102a1ff64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb79f56-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159140, "uuid": "66b0354d-56cd-45b4-b227-0115e0e5b18b", "comment": "Malware payload (IcedID)", "value": "592f45aeac5f5f560dcf4cdf8248ab91", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159140, "uuid": "63a064c0-6be9-4930-a2b8-86cf34890370", "comment": "Malware payload (IcedID)", "value": "23b989b50d939c84188596093912e2cbfdf595d97ffde28ccc2c5a67423a7d1f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159140, "uuid": "31fb8b31-1387-4b9b-8dbd-61be8f8d8d41", "comment": "Malware payload (IcedID)", "value": "a4f58419886dc311e4e52eb8266f56ba500e4df6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159140, "uuid": "25adb805-73db-4723-a69b-ad28acb4f962", "comment": "Malware payload (IcedID)", "value": "bcc1636fc2c5f5a4a8311eb0c2a5f8ca450c3d05cb3f0a1821a75473f7db97f46cee779f06b1374a3e7d86601efe64b5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159140, "uuid": "fa2e5dd0-2b0a-432a-86fa-d25b2a87e3e9", "value": "DAB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159140, "uuid": "60009377-5979-467a-9835-72e3bbc746b0", "value": "3072:s2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:szxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159140, "uuid": "febabe97-21b6-4f28-a547-7a1825d7e59b", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159140, "uuid": "d05188ee-2a24-4d05-a739-46dd4807c894", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159140, "uuid": "eec9ffbf-f682-4c6f-b439-90d7cc116773", "value": "document-582085787.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5301751b-920b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617186289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186289, "uuid": "12efaafd-3494-4dc3-9fad-54b655f2396f", "comment": "Malware payload", "value": "6fa88634d48292c87281eb2821d5d0db", "object_relation": "md5", "Tag": [ { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186289, "uuid": "74aca735-cbe4-4ea8-8e93-bbd4a47da7d2", "comment": "Malware payload", "value": "23bd4805912f729c26dcfba949bcc152ebc8320bbe63e3b09cb2e05f6df86585", "object_relation": "sha256", "Tag": [ { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186289, "uuid": "931d667c-5ee8-4585-a0b9-68bd45c1b9e5", "comment": "Malware payload", "value": "46bc799a7b8480c7ac99f57760f77daaf1b70aaf", "object_relation": "sha1", "Tag": [ { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186289, "uuid": "567887d3-9e27-4492-bcb4-c1320d0a4d19", "comment": "Malware payload", "value": "b04152e52683c820660d7ddff2bbb394055bc72315a74f86ad936c450108a1e9aab56191c82cfa260b2e64d4326008f3", "object_relation": "sha3-384", "Tag": [ { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186289, "uuid": "420aec20-9d70-4dc0-9709-cf843bebcbe5", "value": "49A4281477ED2373CB257611F4934678E39186CA816AF6BBF7A2B8111FFE4644A068CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186289, "uuid": "533e4e1e-37a5-4ad0-80a4-bda174c4a653", "value": "12288:pZRYrL/4uGv9Qr4s/KV/tGs8FwaAGtcMtR:7RYf/41v9Qh/KJtGshh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617186289, "uuid": "550ed83f-d29d-4d67-a46f-feecb6ad5cfe", "value": 468807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617186289, "uuid": "a115ab8a-1591-4ff2-8173-a6ee59d722a5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186289, "uuid": "5f03a98d-6207-49f8-b074-72ea6a018753", "value": "pay", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a42ec4-91e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617170354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170354, "uuid": "740b68e1-17fb-4f3e-b37e-d933fdadecb5", "comment": "Malware payload (AgentTesla)", "value": "02584547892db13a882c9bda73acacaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170354, "uuid": "427e581b-54b9-4193-bf5f-49f0314a9077", "comment": "Malware payload (AgentTesla)", "value": "23cd04354a8a5eea8fc0908ae207a8d8c0449dd038cca3370e34d67cd74d2a77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170354, "uuid": "f42a8bde-2303-4183-b0ac-be671027e4d5", "comment": "Malware payload (AgentTesla)", "value": "d30ee533769e249c7edcd3ddf78a25a929fd8071", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170354, "uuid": "1bb7b971-1dec-49e5-8d94-5df76e4a5517", "comment": "Malware payload (AgentTesla)", "value": "1bbad274e356fb814c5faaef1bbb4ee5c49fe920437390a08a5e64547f285a09fcce03dd43fe21b61b3151f9cdcb5216", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170354, "uuid": "8fc6b05e-2a08-40ff-8113-c88dbcc7b4a8", "value": "6635F0A4F985D2B1F61437B919315371062DEEE214039F4DBA4CFADA247AACC4CDBE42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170354, "uuid": "82b18201-0ff4-4ebd-93e9-89f5b9a5c08f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170354, "uuid": "53615b08-271c-460e-94a9-99224b4f9071", "value": "12288:oiMRWzE5vCTRoix/YRWpfru2yKzaPC0so39fKt8IU8NM2/o+A4aXhG6kQm5mhqL:oiRtDD9z+HptfKt8IUn2bAxXhmd5zL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617170354, "uuid": "0b23ed91-5861-4516-866d-96e18368aeef", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617170354, "uuid": "d8e2c753-7824-45b7-8da7-0810fe33a07c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170354, "uuid": "bf03b415-7afd-4353-9ad9-c370d03ad220", "value": "SHIPPING DOCUMENTS_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c0fd2d-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199317, "uuid": "09e23031-f988-4ac0-9d2b-252620425632", "comment": "Malware payload (IcedID)", "value": "0d60ae371f2748d60e6acd03d322bb54", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199317, "uuid": "680facb1-4d59-4e66-8478-b1f12a50139d", "comment": "Malware payload (IcedID)", "value": "23f60fc58e1b1a9dbdafddb00d7f291e684aa91a1d3507f922a99a877d71306d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199317, "uuid": "d667d031-9b2e-4a36-8b4e-3b8591770336", "comment": "Malware payload (IcedID)", "value": "2c1696200da01d284d568b8d9feb3273cf115d8e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199317, "uuid": "bcea43ed-7e3b-46da-a38f-50fc4f913479", "comment": "Malware payload (IcedID)", "value": "dda9d1ea92667d3415ae74ba8c39bd12a9ad8476a2bcd11e8827ff813ca27f1e7bb1b851f943d3e02b56e81023e49492", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199317, "uuid": "2c2f1ed9-9367-48fd-99de-5605b1459591", "value": "0EB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199317, "uuid": "e6ff07a7-386e-45ca-abc5-87240f9794f7", "value": "3072:s2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:sqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199317, "uuid": "1ab652e0-e900-4818-8329-d9c3461ce15b", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199317, "uuid": "60dc9cec-06ac-4165-a4fa-a5c189c99280", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199317, "uuid": "1303f688-319b-4edf-83e5-47a0449a1864", "value": "document-54045633.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16673602-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217541, "uuid": "75c79ed1-6470-4f8d-bda0-4f14deccf9b4", "comment": "Malware payload (Dridex)", "value": "257d04a3a5c7eb9d2145374d2ec5851c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217541, "uuid": "d1f726da-e2df-4d47-bbf4-1db4a6a626b6", "comment": "Malware payload (Dridex)", "value": "23fddc8d0aaa52b936109ffd7471bbd1af05d72492f4582b680300a8e2937ea2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217541, "uuid": "9107d04d-9cb3-4afe-aa7f-9b785765c424", "comment": "Malware payload (Dridex)", "value": "27b86e7caea187257ba5d894afdd67bc7bf22980", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217541, "uuid": "069d9161-0594-4780-9cec-6f5df42f49bd", "comment": "Malware payload (Dridex)", "value": "939b95e99be43368abbf30deff1d29ecb3d20f58fcab2fa97a2a94a4648e616bfa93d9fbce0778ac238e8f070b45e77c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217541, "uuid": "6fdb3073-3c58-4363-bda1-6ac5835e17c2", "value": "7414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217541, "uuid": "482efa53-9b52-4136-844f-66e6cf5268d6", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217541, "uuid": "e30f3b12-85bc-4e95-9bc7-d1121c5e50ba", "value": "3072:lopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:KpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217541, "uuid": "916bd02e-b786-4b5c-bc91-bdee1ee15d97", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217541, "uuid": "32b117fd-f92a-41de-a291-df1f01eb4e43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217541, "uuid": "3acf1f39-dcb7-47d9-a968-4d9c4d6ffa08", "value": "23fddc8d0aaa52b936109ffd7471bbd1af05d72492f4582b680300a8e2937ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440ebc0d-91bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617151905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617151905, "uuid": "78ad74f6-2665-4e6c-8e96-cd968c83f44a", "comment": "Malware payload (RemcosRAT)", "value": "dee644872518bad0830557a38bb9857e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617151905, "uuid": "ed81ee25-f4fa-41cf-877e-7644646d2478", "comment": "Malware payload (RemcosRAT)", "value": "240962dca128e601bd3bbaabf128d7f79eaa1e52b3ce29a8dcfeaf1b9e8635f4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617151905, "uuid": "113d0652-1766-4d7b-a320-698c56bb49ac", "comment": "Malware payload (RemcosRAT)", "value": "1c6c71bb00bde682e208bb8742348fa71bcdf588", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617151905, "uuid": "049cbe56-db4a-4ade-84fe-5d19d33a8301", "comment": "Malware payload (RemcosRAT)", "value": "cb98ff3e80790f7d804dcce182f7e14a8260904518dfc5ad09c0fd2e3c447b4dd04bde2c401a5966dff06fa253886a42", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617151905, "uuid": "9bf4919a-6db8-41d3-9be3-4d1723a438f4", "value": "30B31257D993305EF10E6D3CEB80287156F76E8D1B0FB7B981581F8B4BC6AA0D2249D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617151905, "uuid": "6acebc4e-46df-4019-8ea3-d8f0e96568d9", "value": "3072:bLUy1OibuKgZYM02IiJbrWSNQuxnjpHQYQ:bAy8wuHuKHtjpHQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617151905, "uuid": "00b8d8c7-ace0-4741-8e10-829a5546c5b8", "value": 113697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617151905, "uuid": "6cc095ef-68a8-46b8-afb8-287eef09aceb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617151905, "uuid": "0a81b0fe-2f66-47bb-8d21-7125157e7bcd", "value": "HSBC CUSTOMER REMITTANCE COPY. PPTX____________________________.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a71140b-922c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617200502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200502, "uuid": "0d8272c1-4686-4e86-8ddb-dbcb93d38121", "comment": "Malware payload (IcedID)", "value": "64c80ed7641137ed006a7c3845b3004e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200502, "uuid": "0f903a67-8546-4a17-96ba-9d1cabbed64b", "comment": "Malware payload (IcedID)", "value": "24282e5060ba95ff5a2c3c0eeb178e1025a2fa6d6d08d12f5018f52ad61915b9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200502, "uuid": "b3d1a7b6-60cd-4f95-be65-e3406ddf3d7f", "comment": "Malware payload (IcedID)", "value": "085ecce44bf08bb4f6fec85b76bb5d6fdb20ecff", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200502, "uuid": "13e88043-0b02-4176-bb21-b1939fdcec83", "comment": "Malware payload (IcedID)", "value": "50723fdac982fd1971e6a5c605f319b2c89bea713f37a32e6b050a8578c53958983f17f7183bfbec17b2c9573dbc8bde", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200502, "uuid": "49ed36f0-6f6c-4695-aca0-4e6fad82c98b", "value": "40B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200502, "uuid": "eaca9da1-ce22-4e90-8022-9ee2e17316fa", "value": "3072:E2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:EqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200502, "uuid": "4a18c3b8-dafa-4e85-97ad-3c0854eb8384", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200502, "uuid": "644576ab-43d8-43ce-80f4-47304513a376", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200502, "uuid": "038774ff-76b7-4534-946b-343da69cfed8", "value": "document-71188089.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38ca231-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216919, "uuid": "3f7e639f-ad0f-49cf-a9c3-c2816c2948cf", "comment": "Malware payload (Dridex)", "value": "fa3300a1fbe56033e2d93569846092d8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216919, "uuid": "b1489935-02af-4ca7-bbc8-8693c630a878", "comment": "Malware payload (Dridex)", "value": "24598033e27ade8bdf70aebee32f4bcc774a1bccba1a1815ac2cd917498c28c9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216919, "uuid": "f83708c4-1d9e-4a8c-b6e8-db0c182cb2e3", "comment": "Malware payload (Dridex)", "value": "d49aacfb7737ad81f6438af21a3458dbf6c4e608", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216919, "uuid": "90b392fc-2065-42e6-a419-29039f53dd60", "comment": "Malware payload (Dridex)", "value": "d9360709dc102a5d1279d5cacc975a6cb4a00ba6cacd314af58b837bc85ac52af5284b0dc35b29aa1b7835e40fff9b27", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216919, "uuid": "80f365bb-54e5-4493-8213-09f9b715c16b", "value": "AC14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216919, "uuid": "0f5db3c4-d6a3-4385-80a4-1b236bdfc731", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216919, "uuid": "5e562787-983e-40bf-b09f-10715c266de0", "value": "3072:Fopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:qpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216919, "uuid": "bf0dc660-353f-41d7-8003-8677ffcc031b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216919, "uuid": "5548c196-0a34-4ab2-b67d-ba2e13a3b06e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216919, "uuid": "d120122c-9500-40cb-a28d-2886dfa0c93b", "value": "24598033e27ade8bdf70aebee32f4bcc774a1bccba1a1815ac2cd917498c28c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4637b57-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213055, "uuid": "71a6c58b-61df-4d3d-bfdc-7d9de452e6fe", "comment": "Malware payload (Dridex)", "value": "00914150820824fba985b008a1400118", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213055, "uuid": "3cf15b17-1f9b-44a8-8a4a-2f3af0beea99", "comment": "Malware payload (Dridex)", "value": "24a357ddf5b32bfddf8cae6fef8c6bfa23106830cb954ca21be2b7547a2f1f32", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213055, "uuid": "adc92b8b-b0c0-4cbc-a143-b697fd8937b9", "comment": "Malware payload (Dridex)", "value": "fa7c782cb45411bbc6510c888c5b0cc7cdf03b5b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213055, "uuid": "50f49aa9-ae88-4c9b-8108-d36bdadf15b8", "comment": "Malware payload (Dridex)", "value": "aa6a9b2f6e43e33e356b6fd26a453ad139148168587ce6829a50975567520f7a7d2a5436d4fbf5770f3f104ab206de77", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213055, "uuid": "d5f8b8af-f481-4a0f-b3c9-dae2b56d9624", "value": "0B248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213055, "uuid": "e8457cf8-e93d-4522-b60a-b8a3c36f648f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213055, "uuid": "fd67a864-98c4-4380-91c5-bf3fb6b09f52", "value": "3072:k6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:koMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213055, "uuid": "40e73366-986d-4ef3-bf1a-990fd71ae36b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213055, "uuid": "a95434e1-fb14-470f-a680-fa4cf05506e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213055, "uuid": "2b9a6e90-b8b1-4b46-ac7c-7ce5d0e0062e", "value": "24a357ddf5b32bfddf8cae6fef8c6bfa23106830cb954ca21be2b7547a2f1f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6c615c-924e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617215244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215244, "uuid": "622931ad-a06b-4420-a13c-3beafd1bc403", "comment": "Malware payload (RedLineStealer)", "value": "e36c3dae815c0d11688c8068792f175a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215244, "uuid": "9da1ffe4-6f70-4017-a2a8-732fabe8001f", "comment": "Malware payload (RedLineStealer)", "value": "24c6a342ebad96c85df3bf4318a0df5a42e27647657157ee5f9ab0b4ba051e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215244, "uuid": "b2ed49f2-3052-4deb-8762-eddd2041397e", "comment": "Malware payload (RedLineStealer)", "value": "c024cdbcc0f7e1a433657e755741fc59e2b501bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215244, "uuid": "cbae9341-4e49-4750-a4a1-afc549716c43", "comment": "Malware payload (RedLineStealer)", "value": "47b9896ba95fe3ca6d30d77e2beb996210f95e930d31192d852a0b717a5f14f256bb8ecb675744f95ab87a889c091e87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215244, "uuid": "91b856d3-6e32-4762-a487-a08e27eed7f8", "value": "8264E00075D1C033D56249394861E2A59D35FCB16F349ACB3BD42F6EAE753E28A3A783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215244, "uuid": "be776251-b5cb-4ffa-b882-c858241ed180", "value": "061a2e87f94cf9f8906a2def43fae40c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215244, "uuid": "434310a9-8619-4ec9-9359-b92e0b1c3094", "value": "6144:17tE73V/4tSLicdRnjAJ2aXnwaxI2n/jtsWCZBZQC7JTm/2AC:1W73t2S/dFjqXwa22LtshQuAtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215244, "uuid": "287384b9-b45e-49fc-a10e-b034272bc5fb", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215244, "uuid": "aecddb29-57c3-4b66-8fc7-1b0543fb238c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215244, "uuid": "db37cd89-0f24-44b4-a118-14fd4a640678", "value": "e36c3dae815c0d11688c8068792f175a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dadf64c-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204695, "uuid": "2964628c-8ac1-4cdb-88c4-5295ab5c2172", "comment": "Malware payload (IcedID)", "value": "aca5ebcb99b7e087096e0b403be9314a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204695, "uuid": "0c8a93e6-e242-46fe-9857-bbb2b25b1b6d", "comment": "Malware payload (IcedID)", "value": "253217c541d7edb6d25add3e93cd310566d66bcf58e4225e1aa459c4f5bde13b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204695, "uuid": "7b82f7c2-cd58-4270-9706-446d49cacfb0", "comment": "Malware payload (IcedID)", "value": "1a0b74222119d898f91a1abb315e021e6e84352b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204695, "uuid": "5b428a79-8d5e-464e-a170-48ef5528aecc", "comment": "Malware payload (IcedID)", "value": "bd36e24abda649cde4fd588223beac1a87c0a0771c30e508fe39834be98b38d935b87d7459ea6b233d2aa5a7902bf58b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204695, "uuid": "b0a3dc42-e5ee-49a1-95c0-470874c27c50", "value": "51B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204695, "uuid": "11acba25-258c-4d46-990d-d1a7434002c3", "value": "3072:s2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:sqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204695, "uuid": "e71fecdc-45ed-4119-8d7c-135f51a908ae", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204695, "uuid": "9b15c4ea-7d55-4fcb-90dc-85b6db63fcbf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204695, "uuid": "6b4d4e3e-a0c1-40d4-a516-b0bdc4dd52e0", "value": "document-1001149810.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910464ff-923a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617206580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206580, "uuid": "72f0d8e5-4fbe-478e-8cd6-d0da143c81a1", "comment": "Malware payload (IcedID)", "value": "be3e1f6fa188de9de1eca89c39e82cb0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206580, "uuid": "3deedf6c-b0ed-479b-8f60-5c78e842d28e", "comment": "Malware payload (IcedID)", "value": "2551e5fdb086e489e08e95dd21efb8e56884728c15c65e5d00cc958efea21d55", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206580, "uuid": "03baad34-6ce1-4ca7-8956-b35a83642480", "comment": "Malware payload (IcedID)", "value": "e3e6fa7595dacb173b869d3e759748c0a14029ef", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206580, "uuid": "ac13b153-41ff-4502-8629-67b9d4a8172b", "comment": "Malware payload (IcedID)", "value": "ceeab965f0063451226612d83f98e7ff91a3e9f17eec7caed4d68d78a129227925323d288ee99e4e3bf57d1239859de1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206580, "uuid": "ad930810-9060-4123-bde0-c9aa5c2f1913", "value": "5EB3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206580, "uuid": "cbba6406-25c9-49b3-a4a7-af7c50ee6367", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617206580, "uuid": "45ea3771-f79f-425b-88a8-190342e6c096", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617206580, "uuid": "1c351b5f-af5c-4601-af46-7a226436dbe2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206580, "uuid": "6ccf51c1-c6a9-4360-8b26-15a79a173dcd", "value": "document-2123090105.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fd9104-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200193, "uuid": "f29a9e11-7c07-4f41-9bbe-c811e47614f4", "comment": "Malware payload", "value": "025d4fe247ec285625d3d8b5ed755edf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200193, "uuid": "4b5eefa6-9cfa-4f21-9960-79991885742c", "comment": "Malware payload", "value": "25e43e7542b73ef3d8ed5338c28ca0310fd3ff40bd846fe64151b8db6b854ed9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200193, "uuid": "0d4b9e21-3f85-4eda-8b65-1009175fd17a", "comment": "Malware payload", "value": "8f9ea9a22e975cd823a6734bd8803ef5f75d072a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200193, "uuid": "1df51d74-35c7-4d5a-8405-00bb850580ac", "comment": "Malware payload", "value": "c3c1acc972d9b22a578c84e7b5aca7192a05030b88e5f8b35e04fa2bb8d2864b43e10b3974c58c0d7e7b8b34cdb6fe1a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200193, "uuid": "aa732988-c051-455b-b481-d27dff709560", "value": "6CC2F9F6FC07382B463226337C4244A2F9754193612030717EAE422E9F7A69957EF76E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200193, "uuid": "a6c0c891-a93c-421d-81d8-f8eb06505d5d", "value": "384:Sc4gsg23qX/mhwNgyjmXRcJakaZmDG0k3QUqsm0LS+cumR+pzBNT+lkSgcbbv:ScKg23a/m8yRcJUsGj70c8kJIbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200193, "uuid": "f64a905a-5581-4f6f-be51-07b5ba54d1fc", "value": 26821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200193, "uuid": "00c8d742-6fc5-432f-a6c7-38ff8d637a73", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200193, "uuid": "7ceb48a4-2886-431f-adec-c60571b39fa1", "value": "25e43e7542b73ef3d8ed5338c28ca0310fd3ff40bd846fe64151b8db6b854ed9.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6272f66-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159478, "uuid": "0c34650b-1a5c-4855-865c-a12f8ed26e2f", "comment": "Malware payload (IcedID)", "value": "65ee350ce5bfdb6de34124157c8540e8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159478, "uuid": "ba2123b6-3b81-4b5a-889b-897ccc030b10", "comment": "Malware payload (IcedID)", "value": "264a72921f689cefc822902493857659f81ce303e5960139260b298d3bf7a86d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159478, "uuid": "9d6afcf6-7c84-4b43-9fad-0a5abacec842", "comment": "Malware payload (IcedID)", "value": "3d62a5e98f0689d3c2c9b1ebb270b1d35e3a5576", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159478, "uuid": "08589b82-ae3f-4c2f-b5dc-68e139903d7f", "comment": "Malware payload (IcedID)", "value": "fe363342f0449a0ad1f48a1819f13e572bc4c829825a92a7b1c2582790a0c4c768e7968e5e8f010d91ab9f2f7ad87d88", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159478, "uuid": "7915355b-b992-4735-9e4a-fdf761e9d544", "value": "11B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159478, "uuid": "af7cc13a-9fdf-4757-ab3a-9626ef3d976e", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159478, "uuid": "632b452c-4f7e-4360-a3e1-3c7994b730a3", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159478, "uuid": "b9faece7-fe5c-4bdc-a09c-abddad7dcc28", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159478, "uuid": "a62fbd04-985d-48a9-8b44-e10044e1c4e0", "value": "document-2077903511.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae6c4e1-91e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617171324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171324, "uuid": "fc79849e-c08c-47c3-b57a-b3d5698d1400", "comment": "Malware payload (Loki)", "value": "8cb51e160915eb8cb046bb8869dcc834", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171324, "uuid": "abb0d856-b6db-4feb-b8ca-a2c7442a83f8", "comment": "Malware payload (Loki)", "value": "267036c9ba44fd83bde81d7267642dcd7fb785b1de48f9e1a0943006db54cd1a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171324, "uuid": "e425b6ca-1459-4e12-ab3c-e84d39d71ccd", "comment": "Malware payload (Loki)", "value": "493da6a91eb98983b9f2890200dde1fd978236d9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171324, "uuid": "8a04d216-14f0-45bc-8123-fad0b6f9c778", "comment": "Malware payload (Loki)", "value": "34a0226b3fe482cca3c7c828c0b538d793ed3043d132b940f1f48096f5dc518a5575bf5a1a73f8c82823ef44356b383f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171324, "uuid": "40fa807c-45d7-4fc4-a48d-52cc7b8ca349", "value": "22C533A4AEE78F9BC26D46B0C0DB2904C8FA8DA1C1194C173B5EB522F43B93465477BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171324, "uuid": "5718bbb2-187d-4b38-97b9-d3645f7f0328", "value": "49152:DWb3oUayQNpm8TyDxW/IGqTJBKT0sm2jG/0+PgyoSajKQAfDhzVaT5Tq8PuKX:D/B73m0/7qTH17fTLYKTfDhYFlDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171324, "uuid": "9cb65a85-a21b-44a6-ab38-2ae29da641ab", "value": 2693120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171324, "uuid": "d4957c00-6d01-4472-b982-2b774b81c8d9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171324, "uuid": "bd52e1d0-f02d-4082-9a89-ba75d7de1ea6", "value": "VSLS PARTICULARS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47078988-9240-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209033, "uuid": "17451c23-d32e-4048-8b10-4aef62ced230", "comment": "Malware payload (IcedID)", "value": "89032c60fafc2445d7039477038c1a8c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209033, "uuid": "87e2e4d0-ee80-44d1-8514-4e7c74853ad4", "comment": "Malware payload (IcedID)", "value": "26bfb8254094186fc805b527c2b8b025f11d77fdb5c3b3fb9676b15864726170", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209033, "uuid": "7c8a9dac-63e8-493a-9e71-c5be239cef46", "comment": "Malware payload (IcedID)", "value": "e71f5c0de37efd47665adf621570bb59229f7fae", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209033, "uuid": "4062e5e7-f507-465e-8dc2-ddb10421f9b7", "comment": "Malware payload (IcedID)", "value": "1250f5e25d8e9eb9e8be38007eb1bc847aad97b2db78fc3b8bb1f6b95225de148ed4830920f4051f7971d26cb3150310", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209033, "uuid": "e9de8e92-b40c-4579-9b66-c40e0564d604", "value": "5CB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209033, "uuid": "02d0ddcf-b1c0-42f8-b68f-138cb05ec36c", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209033, "uuid": "03fefa28-3872-43e0-9630-5a8e0bcb59a5", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209033, "uuid": "983019fe-c81c-4561-bea2-c9f9e1d96e6d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209033, "uuid": "03a52446-dced-4510-ac17-4455dac829d0", "value": "document-631739829.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c458cf-91e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617169738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617169738, "uuid": "66b6ae3c-f8ef-4883-961c-e4cff21fe4db", "comment": "Malware payload (Dridex)", "value": "271e68f15c05b1711f43b8d5d3a0144b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617169738, "uuid": "ad702964-1062-44c8-86df-11d81af3aec4", "comment": "Malware payload (Dridex)", "value": "26dfc586add62b3d10c7c6388f3b3258e65abb087174223a8354b42a6f5bc6cb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617169738, "uuid": "e7111de4-08cd-40db-8e70-bb389eaee4b0", "comment": "Malware payload (Dridex)", "value": "59425bb179327eb1ff00e1120833387bdaf0facf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617169738, "uuid": "f587eb16-a1df-48e8-bbf4-b04fa4bce7ef", "comment": "Malware payload (Dridex)", "value": "53ce66e19bb527f4c56cba035382dc6ed2f41d8a3a4ee094d4086bd60b24818790d19d3646283fb3d4c0584a1d91bbd0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617169738, "uuid": "825ff02b-967f-4f09-9841-09d22a0ff3ba", "value": "6914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617169738, "uuid": "4063fc4b-5ede-49a8-8722-f96933406b26", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617169738, "uuid": "2ed9c3a1-afd4-453d-aaee-0ea314ff7fa4", "value": "3072:H1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Vi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617169738, "uuid": "d898314c-1899-4cb3-a530-1d630bfc1e64", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617169738, "uuid": "b56356e7-9982-48a2-a9c5-9216bf9e9a80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617169738, "uuid": "8a6dd295-2921-4761-aa39-639ab00dd3ad", "value": "26dfc586add62b3d10c7c6388f3b3258e65abb087174223a8354b42a6f5bc6cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5ad1f1-926e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617229040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229040, "uuid": "6d52cb9d-99b1-4280-b2d5-5d972a191d78", "comment": "Malware payload", "value": "0d764b9776617f565ebfd774374a0a23", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229040, "uuid": "614a5cfe-5e9e-46b2-9ac3-d2b008589afe", "comment": "Malware payload", "value": "27005b8c2cd487487db625c1163be61e49f05f4b8c945d0d1e58ad48ce58a217", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229040, "uuid": "506d157a-bcdf-4bd4-bf21-e4389defa3e0", "comment": "Malware payload", "value": "be881190bbe1224b61ecf995ba6f0055d3e701f4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229040, "uuid": "7357a76a-9732-4c30-b294-7ef745456b13", "comment": "Malware payload", "value": "7c8357052b135d30dff8cac1c098114158c562f84eed4d23cd7add9eaa1714b3966f8d9e596bab9d15bde61616dad70a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229040, "uuid": "fc80b341-95ef-4d26-886c-382668da1b89", "value": "EB248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229040, "uuid": "e07ef8d1-ad12-47e2-8eef-86bad0aaf52c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229040, "uuid": "693aceb0-b9f2-4060-acbb-5d51ec586f69", "value": "3072:E6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:EoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229040, "uuid": "2b52e853-5e5b-4b9e-a65e-7551a36d93d5", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229040, "uuid": "75987ae7-1452-441f-899e-9c57db76f865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229040, "uuid": "ef82be8c-c5ab-46df-8385-813e531df2db", "value": "27005b8c2cd487487db625c1163be61e49f05f4b8c945d0d1e58ad48ce58a217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db360c2f-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204986, "uuid": "2c860898-0138-41c6-87cb-07fbb6c188c8", "comment": "Malware payload (IcedID)", "value": "ed067f453c218510e73d124c5454d4a3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204986, "uuid": "7c992486-53e1-4cec-b238-a1aa49b3d28d", "comment": "Malware payload (IcedID)", "value": "2720bf80f505fe172f01e8fd68d719af8a000dbea3b492634062439d5719e757", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204986, "uuid": "03d8e642-cff9-4882-a533-e7b8eec3f85c", "comment": "Malware payload (IcedID)", "value": "bda7301ca6d05a1b50d8b387ce83be1c68b623a9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204986, "uuid": "640b2bdc-05d6-454e-b453-b63ef1e9b008", "comment": "Malware payload (IcedID)", "value": "da087ed2afb8d69d86f232075f02e2036ad40804e0b110138650f13dde9ee19006394839f193f8c9f65509b3a5b145e6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204986, "uuid": "76ce529e-0911-4280-ab52-629995a6c49c", "value": "A0B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204986, "uuid": "5516f6eb-b19f-4ff8-83bc-7d8b8388631f", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204986, "uuid": "f77892df-92a2-4d1d-8e3d-dc19b352d3a4", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204986, "uuid": "6a12b7e1-bd38-4d8d-accf-e20328d77c70", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204986, "uuid": "6665819b-6aed-45b0-a8d3-aa7f9a58e9ec", "value": "document-515735610.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b55e4ae-91ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617173070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173070, "uuid": "58330cdb-d075-4fe5-98c5-62a014cd1368", "comment": "Malware payload (AgentTesla)", "value": "bf8e7e5d40a1cdb1c277efde53a43954", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173070, "uuid": "89125c01-5b4e-4406-8611-9bdfdb87db21", "comment": "Malware payload (AgentTesla)", "value": "27474c990ba223ff89d638c91e706f1b50c607c58bef7efef185efea85e7dd20", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173070, "uuid": "90e88f1a-43a5-4216-ae4e-8abb83c59665", "comment": "Malware payload (AgentTesla)", "value": "52e6b42d0866ce6f8ab728e7d56912017deca760", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173070, "uuid": "fa79b23c-1b6b-4c54-9f9f-ab227798efd3", "comment": "Malware payload (AgentTesla)", "value": "3a5d85855cbc6635db18849f570d7ec7320956fc0df5291aa547661f474371e43095be7de515d82f206b16be1b97396a", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173070, "uuid": "1611b8ef-64ab-4fc2-98fe-ce90074ebab4", "value": "88C423BBA8879368D95739FD6B4BC3302FBF145A351E6DD1843460B0F9A24CACE46724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173070, "uuid": "3fe65bca-997f-4f2f-a4eb-cd3f585d8df9", "value": "12288:R61fSIq4/eCD0FvuIOpC/TBrLBDZxr1oFGFkts0xe4XLJ66b+:RISIqSxgzhRx+GF+sye47J6y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173070, "uuid": "250664df-b92d-4482-a882-cf895ab08074", "value": 574561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173070, "uuid": "1d3568bf-cee2-42c6-8ba3-6b71546fbc52", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173070, "uuid": "62b99960-a922-4baf-9584-16e6d38726df", "value": "Accounting voucher display doc_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6022c02a-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217235, "uuid": "99f8f04b-93ed-4b73-830c-d9ac97120f73", "comment": "Malware payload (Dridex)", "value": "70d08bba35e2de44d5c476dc670685e9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217235, "uuid": "8a365f41-005a-46b3-91e5-6b6a2b99e9c9", "comment": "Malware payload (Dridex)", "value": "27505991aa4b60ff6495848e6f15acd0ba281c806d2376c9341f93d8d3741f7e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217235, "uuid": "9ce5089f-f21c-42db-8e31-c79895da9223", "comment": "Malware payload (Dridex)", "value": "3d55d60ab36304d28121816d0a9c87b5e76133a6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217235, "uuid": "acba4f6f-563d-40ba-805c-bc66f5b6f063", "comment": "Malware payload (Dridex)", "value": "275ae2584547396afe19af4365bd5219b123175256af2d5077f348a797a0fcd169ff4b3c39856b302f3a97a89e6496d7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217235, "uuid": "710fe276-c60c-4393-9343-5f3c63c48357", "value": "9D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217235, "uuid": "9709acdc-7a04-4e18-8b3f-1626986f3dca", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217235, "uuid": "efd357b3-f88a-4a66-9b77-a04d8b6053a0", "value": "3072:Dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:EpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217235, "uuid": "f18d2018-4e9a-4b58-8d27-b7604bab8937", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217235, "uuid": "10908f3c-bd79-47b9-be9e-513857b38e1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217235, "uuid": "b2e2032e-c55c-4bcc-8b37-ffc876b7e7e4", "value": "27505991aa4b60ff6495848e6f15acd0ba281c806d2376c9341f93d8d3741f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b881c0-91f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617175693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175693, "uuid": "d36acaf8-ce68-489c-9380-40f779118435", "comment": "Malware payload (IcedID)", "value": "ad144bb0ff48c327e0c28ffb9406b90c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175693, "uuid": "add3d45a-88a4-4b22-b511-90f1dc265118", "comment": "Malware payload (IcedID)", "value": "276849da1ded2b54c53a4d18ed0371385942cce22ba8dfecdfcb2e92414dea56", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175693, "uuid": "5896d7b7-7339-4c19-a804-2f48ea5c78e1", "comment": "Malware payload (IcedID)", "value": "34032d88936d3e5a394f7e4dea383cc1c3622243", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175693, "uuid": "5a48b94e-7532-41d9-9fdf-483b748ed5e4", "comment": "Malware payload (IcedID)", "value": "0607203bcd4dfb9de37d0c0435a41a0a56035dd2284347c8550f6e0ceda31c8648a38b634f4c094cb26d102bb5bf8d5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175693, "uuid": "74d08e6d-8be3-4392-bb6b-b39744f5a3ca", "value": "21835DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175693, "uuid": "0c70bd1a-681f-40fe-a216-c47ee1bce58b", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617175693, "uuid": "b6c6c7ee-7c58-47c9-85fb-5067f716d92e", "value": 88726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617175693, "uuid": "7e6c9fa6-1749-4348-9230-7a99847cdf16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175693, "uuid": "56f90749-aa60-4636-b7aa-4da06d42a37e", "value": "ad144bb0ff48c327e0c28ffb9406b90c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe79805-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160756, "uuid": "935c125d-adf4-4ef3-9876-0ebfc0a9cd1c", "comment": "Malware payload (IcedID)", "value": "936e8d62c1c93917a612560b19f24398", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160756, "uuid": "308c4092-e46f-4abe-af99-dab0b094d8fc", "comment": "Malware payload (IcedID)", "value": "2781f8788f9bf4e745f9509ffed3c46b3df7f671c9b37d7f233e7fe4d8bab277", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160756, "uuid": "1803de64-ea0a-4fe9-add0-a6d31b47fe95", "comment": "Malware payload (IcedID)", "value": "8cdc84080da2ccc5aba541147a5ff49dcb557ad5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160756, "uuid": "afeb15a8-a0e5-45fe-bcd3-7769e340b370", "comment": "Malware payload (IcedID)", "value": "9a8730b444ebd37dd08b93c110ddbfbc4efe6a39e8a3f67cd793d681483a03d47384cf6b3c58995da4f9e8d2df6ca50e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160756, "uuid": "a5ea8f14-b56f-498e-86a5-01e6e1697137", "value": "1AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160756, "uuid": "82924043-6c95-4f59-aeb9-eb63cc52ff11", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160756, "uuid": "e7dfe375-73de-4a23-b854-1b3a31945762", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160756, "uuid": "1307fe6b-9354-46d2-a4be-37132c75813b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160756, "uuid": "c7d0143e-5105-48c1-bd02-cbea8628563c", "value": "document-733645249.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963b6c51-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223768, "uuid": "19ab3670-c5e9-482e-9c63-456c10673741", "comment": "Malware payload (Dridex)", "value": "040cb0fa24790c30735893db751d30ab", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223768, "uuid": "44971a9e-8777-4285-980d-186353dcf7ac", "comment": "Malware payload (Dridex)", "value": "27d55890da3bc4e3f7cb7c152d2e88e21a166c3d989789399f055c1f75a40271", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223768, "uuid": "5e6dcd33-9fe5-46ba-bc81-964485ddc3b3", "comment": "Malware payload (Dridex)", "value": "5f34e8f6479cc61495ada8c120da8a4fd7d888ba", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223768, "uuid": "df8c0555-a309-4456-9536-1d7a69693f0a", "comment": "Malware payload (Dridex)", "value": "d2012f1ba395b22b32349f5066b6d872af5f774882c8f5ffeaa4320c867727d1de393208ed203e50bb389377c139684b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223768, "uuid": "9edf9d92-b1ef-48cf-9193-daf5ddc8362b", "value": "74248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223768, "uuid": "cac709a2-b408-48e6-9435-ad63c4c301f7", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223768, "uuid": "33b1fac9-038c-4895-80e0-9d09dc89952c", "value": "3072:D6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:DoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223768, "uuid": "8fac6de0-a891-420d-8fb7-6927935b67a1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223768, "uuid": "2f9783a9-6274-486c-8f0f-50c6b3a8c569", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223768, "uuid": "8267234e-0439-487f-98d8-218ea146108f", "value": "27d55890da3bc4e3f7cb7c152d2e88e21a166c3d989789399f055c1f75a40271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181858e3-9264-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617224416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224416, "uuid": "ca551f0c-ae72-46f0-9a1d-0d3fb44e14c0", "comment": "Malware payload (Dridex)", "value": "e8402b69b647321b769bfbf7111a7a7c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224416, "uuid": "da4794ca-00d2-476d-9779-e56d8e47256e", "comment": "Malware payload (Dridex)", "value": "27e6de2a8bbd2ee1944216f2572246ed2cd58c2993a416423e1dfcc880e1f318", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224416, "uuid": "e665c997-804e-4738-916f-87906cd6d304", "comment": "Malware payload (Dridex)", "value": "9a5e25cfffa1774af2d95da614fb5fe191cba891", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224416, "uuid": "46fa98fc-75cb-4de3-b3fd-4f3501d64fc1", "comment": "Malware payload (Dridex)", "value": "1a4662b94371660049ec8d5758376b77bdcba781969af281b8b65e0a1d20ee3c8b895a14897fa86d7bf41381c07f93fc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224416, "uuid": "b64cc534-f99a-4c79-bd9f-57b094fdf208", "value": "2B248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224416, "uuid": "f3c2ec77-24f4-4403-8b66-512f879f0539", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224416, "uuid": "24cadee3-4c8e-4fbc-aa38-b5823ce619fe", "value": "3072:/6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:/oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224416, "uuid": "a14bb334-6833-4e96-953a-9d77d48480c6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224416, "uuid": "2667174b-d6ee-498b-87be-35d781b2a521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224416, "uuid": "0145bfa1-7de6-4b8b-b646-216f4468fd6b", "value": "27e6de2a8bbd2ee1944216f2572246ed2cd58c2993a416423e1dfcc880e1f318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dca47cf-91d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162551, "uuid": "9586b23e-d358-4ac5-a89d-ff9d21899215", "comment": "Malware payload (IcedID)", "value": "ce6943fd3f5c2a5fc89077929f9c2088", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162551, "uuid": "3b6a024a-46c0-40fb-afcf-e0c54d268733", "comment": "Malware payload (IcedID)", "value": "27ff305d9722536a5f0c491b0bcf0109ed7ff15eaa3454786933873042c7e71f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162551, "uuid": "7edc45d1-c5f0-4021-bfb0-520eb55f3da0", "comment": "Malware payload (IcedID)", "value": "0c5973053fd37b1fe024dc5a739254ef5b853653", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162551, "uuid": "b8d8d5cb-c122-4507-89ce-0226fee2922d", "comment": "Malware payload (IcedID)", "value": "24f57c49fd56e9c02a79b334179ab4bd928f5615ef38476e1b785897d01f01a2d4289d6077895c8f233a8ba2ec6a0733", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162551, "uuid": "9f817d17-1879-4e76-8000-4f548e6768be", "value": "3FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162551, "uuid": "9ff21095-ef49-4ebf-bf15-5d60463ee10c", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162551, "uuid": "ea66622f-fbf5-4c4b-8681-449059b25099", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162551, "uuid": "c6d3760d-a2de-4f59-ad78-766e7c680b05", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162551, "uuid": "e4ad3ecf-738f-4919-8cfa-14b47a037dc0", "value": "document-942794268.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1a9964-9271-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230358, "uuid": "6992778e-3de4-4aa1-8544-244a923241bb", "comment": "Malware payload", "value": "ef3d57746d250a4d3416183ef0062f0a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230358, "uuid": "fea66c08-7cdc-446a-b3ac-63ee897be1d9", "comment": "Malware payload", "value": "2806d0e8abf6283a00dad4a6c38400ededa8ff4c51541268566332f8895cd6b6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230358, "uuid": "ea35184e-2261-4d05-9240-b0a63af4c09d", "comment": "Malware payload", "value": "c34f2752ebadf8e907c9b26c6c022d35e67d3292", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230358, "uuid": "ece196a7-e431-44b6-bff3-3ec6bde48544", "comment": "Malware payload", "value": "ce0006125ee46240036e32ac2859f316f31a81ac645ca39e45cf15c7a9a42d0ea9cad0f450b694c1c35e241307f8dd61", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230358, "uuid": "bb724aae-7d7e-4bd0-8854-4d9625af9d0b", "value": "ED248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230358, "uuid": "57d96ca5-dd29-47ed-9e6a-795f011e275f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230358, "uuid": "5546a47f-2b20-4b69-a53d-87b1fe6c201c", "value": "3072:U6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:UoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230358, "uuid": "7cff17a4-9352-45ad-9e81-5cb0481693cd", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230358, "uuid": "c483eb9c-820c-4ded-af9a-63e9b325f0d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230358, "uuid": "90939e3a-f735-4823-b677-b230b59660d6", "value": "2806d0e8abf6283a00dad4a6c38400ededa8ff4c51541268566332f8895cd6b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f40341-9266-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617225345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225345, "uuid": "bfdc40c5-fd93-4a5a-bc98-dfb2553e0147", "comment": "Malware payload", "value": "fc17a7a2752747fdd82020ecc82ceaf5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225345, "uuid": "253b3662-4a6d-4aaa-b034-fc2d5915d474", "comment": "Malware payload", "value": "281424ea662141eb08fa5dcb9af9dc1a5844c91d1eebc67884349dbed220ab83", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225345, "uuid": "ee0394ab-0aa2-4d91-8f60-3fcc3239e3b7", "comment": "Malware payload", "value": "320ebd2379a8827556a66cee975d350c50da325a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225345, "uuid": "ab03d9da-903a-4940-b1bb-b8b0ad61d20c", "comment": "Malware payload", "value": "4e918be4ff675e6c0ac4d2552f927e2c69f137b90238bbb80b5e91a64960f52f09646947e5a8baab0dafcfc747ebbaca", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225345, "uuid": "02f68bfd-9055-4ac8-9899-b5a4e91518f4", "value": "AF248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225345, "uuid": "022c1a91-e494-4ae0-a8ef-13fd799cbe19", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225345, "uuid": "cdee3e64-a0a2-47e8-8ab4-25298d003a76", "value": "3072:r6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:roMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617225345, "uuid": "633dc8fe-3347-4d7c-8777-a130444496ee", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617225345, "uuid": "51a2ce6a-67cb-4511-8793-8ee091d19dc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225345, "uuid": "2869b7d4-6452-474c-a007-8675a4eac5b2", "value": "281424ea662141eb08fa5dcb9af9dc1a5844c91d1eebc67884349dbed220ab83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d85bce-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212968, "uuid": "814d0e78-d1c3-409d-a3a1-af37b1e3fc68", "comment": "Malware payload (Dridex)", "value": "442f35b487c378745fb7f8b58ff53c82", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212968, "uuid": "acd2cca4-c361-4516-a7de-bd5bad107699", "comment": "Malware payload (Dridex)", "value": "2820352521b1186d1c864ca5036f8a445d54a464e175b7a1a5cfb4e272d5bc97", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212968, "uuid": "0cc1f9f1-7a5c-4fc9-a97e-5603f2a1561f", "comment": "Malware payload (Dridex)", "value": "afdc375c024d5eeebacf7cfd25d85272e5d80094", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212968, "uuid": "1bb5b86e-78da-479e-8f46-27f2b40d4968", "comment": "Malware payload (Dridex)", "value": "3b713d9db62b44be32ca34e5a03d2db771965ad651b2db12bcd6e6ac1e40f817e5663600cea35b1779f5bab8f0b7a986", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212968, "uuid": "c82e2a88-1d67-48dd-89eb-9934af6d3471", "value": "17248C5FE339E486FAE3CAF44186A72296A39C92436F680DA0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212968, "uuid": "0e560540-3d7f-44c8-9fac-89faba6468b5", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212968, "uuid": "19ea8888-5239-4733-bd72-babf94da13e4", "value": "3072:q6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:qoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212968, "uuid": "d54825ee-d568-4706-af6c-b61b478b2bf6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212968, "uuid": "529051b6-bab2-46d7-af7c-766833549a41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212968, "uuid": "dbb3a152-b217-4028-9d6b-7ca6d6c363f5", "value": "2820352521b1186d1c864ca5036f8a445d54a464e175b7a1a5cfb4e272d5bc97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5278d9a5-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212917, "uuid": "eb43f053-a9cf-4d75-b71d-85c85989c50f", "comment": "Malware payload (Dridex)", "value": "fa1a633aa320d112bae721347344943a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212917, "uuid": "5fb85425-2c5c-4ef4-a068-115d8370e704", "comment": "Malware payload (Dridex)", "value": "2826e70359df82cd113a2089750c2152fa2339dfd69016962de10de3a27bc0fb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212917, "uuid": "f2681e00-1e31-4ef8-8688-f70933cc0b8c", "comment": "Malware payload (Dridex)", "value": "922febf0aa32e1e5414f9b3363f97887fbb1f7aa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212917, "uuid": "1b8aeb0a-823e-4464-b023-bb61f02c0835", "comment": "Malware payload (Dridex)", "value": "415205c3501e5abf6bbd33032f767ae916c161fc152a9a4e7a18ece87af1e8592fdbd560e2fbe1f87902801a5442592e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212917, "uuid": "0b3ef580-fe73-472c-92e8-8c708e1fb534", "value": "64248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212917, "uuid": "f68c4540-38f6-4acc-85e4-be2211c56f22", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212917, "uuid": "d86fea12-58ac-45f1-944a-6c1b2e4e457f", "value": "3072:R6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:RoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212917, "uuid": "d964d31e-31bf-48a0-9145-5e8a6261a9cf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212917, "uuid": "8fca1c94-70c2-4763-88a0-124f27e3807f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212917, "uuid": "957d9e30-90f4-4a06-93a1-384be52fe720", "value": "2826e70359df82cd113a2089750c2152fa2339dfd69016962de10de3a27bc0fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c132818-920e-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1617187620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187620, "uuid": "27b074c3-0303-407c-9db6-760c889e7403", "comment": "Malware payload (ZLoader)", "value": "c46fe253708828f41db239814d556d9c", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187620, "uuid": "c090ec34-8f95-48ab-94fb-c1dd15c0ee1c", "comment": "Malware payload (ZLoader)", "value": "283690aca24795544cc3b83709ba88a84720399b0cca9bca20eb99f5516d04bb", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187620, "uuid": "0f50e0b6-58ef-4252-8999-df59e83389e3", "comment": "Malware payload (ZLoader)", "value": "a33cd103e4b562e4350bfb71c5fb20fd3514cad5", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187620, "uuid": "4fa74151-c2bc-4736-8b29-f53247687d8f", "comment": "Malware payload (ZLoader)", "value": "b7876450fa1bd1841dfa19b24cf6f77714305a5137b3fb971b0d5ca819a2ff81d7418fef5ae190e4cc0d6df0fe277b4c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187620, "uuid": "acf0a5ce-5443-451c-9d5a-8f59f0ce0578", "value": "5EB2C090B521B148C767C83E6ACD4DF8EB0C687199C82C1B315D9ECE32422C7728F2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187620, "uuid": "5315ed21-e4d6-407d-8a1a-568c1c8aebbe", "value": "384:6ltGXYHrfzmG4oomVf9JmQOZrevMCIfMrhJU8GvKfugt6+MUlM9zUpyEUAN++:M0YLb0oomVfrmQCBCIdwuJxApyEu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617187620, "uuid": "398d3776-93fe-435a-b250-ea4f4bc61ce6", "value": 24686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617187620, "uuid": "045a2316-dbb6-4085-bd93-1638af12707a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187620, "uuid": "e5c7d8fe-d0f4-44f7-92ff-68977fc17f65", "value": "v27645.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df41f01-9216-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617191059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191059, "uuid": "811e41e0-51ec-4abf-b4bd-bbfdef1a8729", "comment": "Malware payload", "value": "afa3cd09271948d2b22e6a408ef81778", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191059, "uuid": "06b7ec83-e164-4517-aa8b-cd13f7e0f03d", "comment": "Malware payload", "value": "283b2fa0fcddff18278d924c89c68bbcd980728761bd26c5dea4ec4de69b841e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191059, "uuid": "e078f8fe-faef-4f17-996b-fcd71cc6ce63", "comment": "Malware payload", "value": "dbf1dec381a4cb5ce62e251eec18f0a57fe6f5d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191059, "uuid": "ff50bbda-cc30-4d78-84a8-ce55d72a5efc", "comment": "Malware payload", "value": "8eeba0f1978d9cc6ffc5efaa3787abf344bc87556d2f1d7071e9a85332bb54eb801391792fe626518d21beb7d6bcce65", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191059, "uuid": "308862bf-409b-401a-8e1a-2ef3b9ee69ee", "value": "F8265C50FACB94F6D6071D7180FFA33F673155098326DBC7DA406E93E82B6E15A32229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191059, "uuid": "599796bd-2c6d-4029-b11c-5e9d6b5f022a", "value": "49152:epP+u5RDaXyLBreNEDx75Ua9NeAcFwMDxHjUCXOAWPRtMLH42bTVADWM2tJ11zqq:eEfNEbUNFwuHICeAfLY23M/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617191059, "uuid": "5781f577-0cf8-411d-8293-b648d37003fc", "value": 4685824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617191059, "uuid": "827e0a1f-5493-4e15-8f5e-81cb04014dde", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191059, "uuid": "1649d9b9-fb5a-44ce-b0f3-644b670f0e11", "value": "SecuriteInfo.com.Linux.Filecoder.ECh0raix.D.9401.28129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f509252-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163654, "uuid": "7fb1cdcd-20f7-4ce2-b3bd-b2bbf92b83a7", "comment": "Malware payload (IcedID)", "value": "fbc70f5412ec8e2346ccd6bfc419090f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163654, "uuid": "0f4ed207-1e16-455d-b84d-ea7c6d355739", "comment": "Malware payload (IcedID)", "value": "2848b5d541d009539d9b406b6529508bf0062be843af26bd068a729b9f78521f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163654, "uuid": "8347aba4-b91d-4e93-8ac5-70042c915880", "comment": "Malware payload (IcedID)", "value": "4335aab6b01a5bddd324d1ff3e3a52611606b1ca", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163654, "uuid": "1ef44b3d-fd5d-4431-94ca-ad775323ebb0", "comment": "Malware payload (IcedID)", "value": "e44366f72b4921dffcc616a5d9c424412f55ce6173efa7ecf7350db277235782b39228c3c976164523852986b9df68bf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163654, "uuid": "8f81aab8-9b0c-4219-a92b-04203d19444e", "value": "C9B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163654, "uuid": "01f3a38d-482e-4488-ad18-7095454d848e", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163654, "uuid": "15e8dca0-3230-49a5-9bb6-2bef3f36c1d6", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163654, "uuid": "b4fb4ca3-9200-4133-8049-2e8dc2673362", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163654, "uuid": "2e4e27ea-0156-42b3-8567-b51fb9f5ba6a", "value": "document-528317386.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcbe027-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217339, "uuid": "2b04d611-5973-4a53-9b2d-99ca09e4a5ee", "comment": "Malware payload (Dridex)", "value": "870bffea8bf778a120d06d94d12ef649", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217339, "uuid": "4f893a2b-31a9-4f31-890e-80d6fe29671b", "comment": "Malware payload (Dridex)", "value": "28496885d1656ccdf2700bb30feacb8db58487db274ef9b70052464cc55d6f71", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217339, "uuid": "be51c876-d9ab-4bf2-8025-2b8754037c7a", "comment": "Malware payload (Dridex)", "value": "4d6059952caf53d30fbf84607c8cf2f473c2b38d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217339, "uuid": "5f728a00-39f7-428e-ac25-3dbfd3b93c40", "comment": "Malware payload (Dridex)", "value": "0cec968875061e263b3a065cc4187519b7cce3a0dc558c102aa3a12908459c5b7dc9f3fc1f4da04e511a30cefcb6fa2f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217339, "uuid": "9804e659-a563-44ab-9e25-ea7bde1f08d7", "value": "0E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217339, "uuid": "417f40e5-393d-45a1-b36b-d274a3a9701e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217339, "uuid": "20a10254-b7e2-40e6-a55f-d0c293ade2d5", "value": "3072:iopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:1pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217339, "uuid": "bea2d32d-1542-49a1-a79a-dad7f9240a93", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217339, "uuid": "4ffca0a6-c8e2-4bf1-a1ba-eedb7356665e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217339, "uuid": "82881a22-ac99-4746-a7b2-b542567841f3", "value": "28496885d1656ccdf2700bb30feacb8db58487db274ef9b70052464cc55d6f71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a26f02d-91f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1617176369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176369, "uuid": "3556e196-6a52-494a-a391-afb435ef27de", "comment": "Malware payload (ZLoader)", "value": "a467c5e63940b8bc9b56f382aa20ea94", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176369, "uuid": "f1101af0-bb2e-4193-aa28-0336fcb98b7c", "comment": "Malware payload (ZLoader)", "value": "287352aca562a84f441ad7794832770ddfe283a8f05bab7a37f2ba66f3dc7edf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176369, "uuid": "42539755-514d-43f5-85e9-3a9b694d21b4", "comment": "Malware payload (ZLoader)", "value": "eac1e8911a5fced479130bd8c7382aa6cb3278c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176369, "uuid": "615af4b7-fa14-42ac-9bb4-d0c56ac4bb25", "comment": "Malware payload (ZLoader)", "value": "e3c5ad7eb881f88428d7a266358cf2860ef10099fa583fc1aabd8ec067957da68c11ab3fc175ab9c869e27052d1d8b91", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176369, "uuid": "8096538c-5694-410a-a4bd-bd04c8061548", "value": "BAD4AF02A7E18034F5B31BF845BF64688ABE79E0073880DB52C425ED5B37AE4AD3475B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176369, "uuid": "4c62bd74-be50-4bcf-9177-ed8ead24f79f", "value": "68f3f2a2ffe0dad5256ecadb0543767a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176369, "uuid": "aae748f4-e00f-4ed7-9398-1d90eeb43deb", "value": "12288:eRNmLFMfAqHo/W5ChAUCEFAyj/MuYjUX3VoEuh1+RoqfxWh9x01qM:mKMfAEo/PhA5PEcgRHfIKoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617176369, "uuid": "2402b781-00ad-4192-97ab-2ed918af8184", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617176369, "uuid": "1bf4ea86-5829-47d6-9e44-e27006c2fd1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176369, "uuid": "f59d8562-b425-4047-91ee-292b47c03258", "value": "a467c5e63940b8bc9b56f382aa20ea94.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5f3dec-91cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158841, "uuid": "a8316369-851e-4d63-a2dc-e6c18a3afa71", "comment": "Malware payload (IcedID)", "value": "5614168cf266a181d2245583d0b0b51b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158841, "uuid": "5b669a85-1764-4893-a3f6-bc63443fa95e", "comment": "Malware payload (IcedID)", "value": "28788f27b27c3a345fb44fe6ba28ad9701cc00b23bd1544bf911e6cf7022c9bf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158841, "uuid": "7e2e0df1-3e85-4544-b5ca-ff1b8ef8fa96", "comment": "Malware payload (IcedID)", "value": "6f0a8676c4ff6c779934d0c86121a92fc1fe7546", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158841, "uuid": "4b4c60ca-409e-4757-8f17-86ba29be77a6", "comment": "Malware payload (IcedID)", "value": "2454d5138ded8ea99d5b08be81d2865d3b8645194d3cd338b0975a27fd9488799dfec71904c355960985df950382c399", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158841, "uuid": "e1bac103-4776-4af7-9bde-b1fcdbe13dd9", "value": "D2B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158841, "uuid": "4438b857-be52-4442-bc2c-6fd36d53067f", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158841, "uuid": "8442e8da-772e-4db6-99ab-0f595b4f8a97", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158841, "uuid": "c25ab4df-6107-45a6-a13e-0b16ef10bf34", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158841, "uuid": "5ba6aa22-9b09-4377-99cf-d6120059bc2c", "value": "document-1064640198.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2cebb6-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617231078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231078, "uuid": "4002bb4c-51bd-4894-851d-3fe4d4821793", "comment": "Malware payload", "value": "0f484b8e688557a9a15ed984dd204ce2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231078, "uuid": "1cbc9693-2674-489c-91f4-76670844ad4d", "comment": "Malware payload", "value": "2891d2c7366512e8c41706eb7a1d2fdd664a8f22c1e7e21482f7245e7a5d0d29", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231078, "uuid": "33ca4dec-ec7c-4376-b1ef-ffa16b71f837", "comment": "Malware payload", "value": "a4071bdc300ff0ecdcd6457e42c1f66ff8cd9e1c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231078, "uuid": "f1977932-1690-4a1d-8815-42496dab2204", "comment": "Malware payload", "value": "324b292e92158150f187be077f07588da89ded036faadd3dab8261e5582f7d816edfdf922720830ef908aa498ce16333", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231078, "uuid": "73b85132-3d5f-447a-afaa-29a300c197f7", "value": "0814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231078, "uuid": "195d71a0-95ad-4550-9b3d-d7043668f701", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231078, "uuid": "0eb9423a-7cf8-44d7-bde0-d5ec89afa1e1", "value": "3072:dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:SpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617231078, "uuid": "3dbd0ca0-beb8-4ddf-b44f-de4fa2ee302e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617231078, "uuid": "c207f4e8-2abb-4182-b805-ab3c4197282e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231078, "uuid": "12fb8498-b211-4bd1-84dd-1f25b0eb7707", "value": "2891d2c7366512e8c41706eb7a1d2fdd664a8f22c1e7e21482f7245e7a5d0d29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edd758f-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213233, "uuid": "7ddc966e-96e5-4e8c-a67b-01557ec2f37c", "comment": "Malware payload (Dridex)", "value": "51516bf3d0d9213fccab8bf0c79f2372", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213233, "uuid": "82be1e7f-557c-4477-9ce8-f906c1531cec", "comment": "Malware payload (Dridex)", "value": "28d56aef122a624d09c1198742459c170582832f25cf746aa8ab18bc71ae8f8b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213233, "uuid": "429547cc-4523-4ede-a882-2533e2be1571", "comment": "Malware payload (Dridex)", "value": "a36b2cf4fb8087198b92a7530bd5e9f6044af5ad", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213233, "uuid": "7ac99725-18b6-4d8c-8743-faa6dd9e7784", "comment": "Malware payload (Dridex)", "value": "f2498a5459e5c7e03ba2cc573a3f666e4fe004607c2e9ce29468c28e158c6c97301ad72546fa587d1573ea8c083cecaa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213233, "uuid": "f94dd4de-a0a0-4c03-afca-27ac68d7319c", "value": "9E248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213233, "uuid": "b9676bfb-9ebc-4f66-ae7a-fc64ef039fcb", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213233, "uuid": "f663603d-2831-4f68-b2a8-423e4f134850", "value": "3072:16TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:1oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213233, "uuid": "66eecc18-9e5b-4af1-adca-334aa304fb08", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213233, "uuid": "b2af642e-7a01-4608-b51c-cc99cc2fd68f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213233, "uuid": "3e5f9765-70dd-43e1-a50b-b5ff1abfc9b7", "value": "28d56aef122a624d09c1198742459c170582832f25cf746aa8ab18bc71ae8f8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd326d9-9258-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219268, "uuid": "fcecf23b-41a0-4f6a-88cd-83e1087b70a5", "comment": "Malware payload (Dridex)", "value": "fe1611217c945972e7535c9c7031b6df", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219268, "uuid": "011afe08-56af-4d94-a035-998788ebfcd3", "comment": "Malware payload (Dridex)", "value": "28f79c1bced76fc398c562b8c7c3c1a76a06962fb764efc86eee7a711eb61106", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219268, "uuid": "6fde21a9-7294-40d7-90a2-8a87c343a055", "comment": "Malware payload (Dridex)", "value": "54df0ab8da4b8978abfbf43a882061d5ebf28c07", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219268, "uuid": "a4796b07-bc1b-4d8d-9832-3e38738fcdee", "comment": "Malware payload (Dridex)", "value": "13dee90c50663c2dc0df83971e241f9289173ed08a50c36e65df675d0af324b9f77305a8515de4f4a3a077225e5e86cb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219268, "uuid": "0f2389e4-2277-403b-8fa8-aac057ebb3f1", "value": "AF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219268, "uuid": "ae5602bb-c701-4fa9-917d-de0ef61c15fa", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219268, "uuid": "115e3ed9-b868-49be-9630-345f07609ada", "value": "3072:nopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:opjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219268, "uuid": "169a28cb-a887-453e-a9a2-5f62f143580d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219268, "uuid": "935d1832-1e27-4ffb-9575-0ff5f60da490", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219268, "uuid": "414be47a-e553-4748-93a0-8c5fdd244ad6", "value": "28f79c1bced76fc398c562b8c7c3c1a76a06962fb764efc86eee7a711eb61106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce8fb99-9247-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212183, "uuid": "b4d14f94-2a89-402e-b18e-44bf7b37b2b2", "comment": "Malware payload (Dridex)", "value": "350d0bc77e332dc7d45621434ff8f6d2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212183, "uuid": "fd197117-8359-4805-a418-07211902d622", "comment": "Malware payload (Dridex)", "value": "290f3b2eaad0eeb90fe8c562b48a6723708cdacb052653e2897712c275b95abb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212183, "uuid": "88db8230-a3a4-4b7b-a5a7-1f1ef87d7084", "comment": "Malware payload (Dridex)", "value": "f6e4d151dbe5cbb40a2d837dc527da0b7f2d9160", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212183, "uuid": "58297008-b6e2-48d6-92f2-11dd2fcdf10f", "comment": "Malware payload (Dridex)", "value": "54f879e3e9dc06d2e9cfacc6561d538851c489f6fd326e6162d3677a08508eed07bbc9c590758655a5415c9ce0e256d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212183, "uuid": "c0b57f14-e1fc-4064-a5a0-8137865ddb14", "value": "4B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212183, "uuid": "b0dd310f-eb2d-4fca-b42d-a88bf7a5daa4", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212183, "uuid": "44a11712-ea6c-41e4-a96d-2ff257f81db0", "value": "3072:1opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:apjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212183, "uuid": "8b061428-5424-4bcf-a2ef-faca413397cb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212183, "uuid": "e9811364-6664-4f76-b532-fe7af77b807c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212183, "uuid": "43765ac7-25ef-47ec-8484-552db06696e2", "value": "z8GH86Z4Yz.php.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ded9f1-91e4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617169517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617169517, "uuid": "1d822ffd-4c62-4d45-b10b-9b3fc7b8876a", "comment": "Malware payload (Loki)", "value": "e110634cb25751437a19b14c228c3436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617169517, "uuid": "de61196b-33c1-4da6-a561-8d4151669b6c", "comment": "Malware payload (Loki)", "value": "296828d37dd5732fa8bc85dd59c8032bdcbbf5aff62399ae72cabdd1989c475b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617169517, "uuid": "fab81d41-66de-49ff-8622-498aee44a8fb", "comment": "Malware payload (Loki)", "value": "2fd501689ded1e417a4b50679cec64cb667043ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617169517, "uuid": "ed733db8-3432-4a73-869c-881d15437153", "comment": "Malware payload (Loki)", "value": "9295667c17ee8eed388aa64b0e1a5df0a036672ae541ffcd10df698dbae2d640d3f40590a1c1eb44343dfd48b093d6f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617169517, "uuid": "e82a3181-2f89-486c-9904-960851cb150c", "value": "B014BE00B2E5C473D1920A750821D7B15A36FCB69F35A6CB3BE43F6A5E352D18A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617169517, "uuid": "8aec50cf-23cc-4e2f-a0fd-c9d91082866e", "value": "ec18f4d9317b5556304720b9775af997", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617169517, "uuid": "1d0f75d3-23d0-4c99-ba77-31a2e534e97b", "value": "6144:fNIeLNiIqLFKUTNRpdHhOlCjwTb4lu4J4yc:5LoIq0UTNR3BOMjUbwu4J4yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617169517, "uuid": "db9c6213-798c-46b5-9187-79a96335c8ff", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617169517, "uuid": "ee3334c1-ed17-465b-a3ef-16f4e7dc2c1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617169517, "uuid": "18cac7b6-9265-4e11-bea0-74d1918c66a9", "value": "Nuevo orden de compra AIGNEP033121.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7b498f-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217793, "uuid": "7ec389eb-fc75-4177-9119-782a2b08164e", "comment": "Malware payload (Dridex)", "value": "e092deaf47ed78cfc6fe61ebfa7430f8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217793, "uuid": "8a19fe16-0486-474e-b2e1-3775f18c1b82", "comment": "Malware payload (Dridex)", "value": "299ce0ec00edf4ac99091aafd7cef93cd11acf948fbf4ce87b3ba00c23f5220c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217793, "uuid": "1c5662c9-40fa-4d79-b66e-e73a8d6ecbd7", "comment": "Malware payload (Dridex)", "value": "231594f31bf1d08f96f6b06bae57d43bfb22a81f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217793, "uuid": "017f12ec-f8de-40a1-b684-16334837377d", "comment": "Malware payload (Dridex)", "value": "2b2d72212bcd690dd014e963b36fa9a5dab42f0977071a2e7aaf0f3e1a9a69062930c05a0b1d3009f98aaebe83cec1f6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217793, "uuid": "c392b75a-ea52-42e7-a4ff-e6581b9efdd6", "value": "4B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217793, "uuid": "4052c5e0-2767-45f9-bc2f-67b4eb07e340", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217793, "uuid": "b355dd26-31d8-4246-80af-d7664d3995a3", "value": "3072:Qopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:3pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217793, "uuid": "1cb8e3ea-df87-4a25-9902-75eb3cec28af", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217793, "uuid": "81cc23f1-dd4b-4f89-83c6-3b10327c5f4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217793, "uuid": "2d3b3fab-4f87-4ba9-aee3-50a48c41551e", "value": "299ce0ec00edf4ac99091aafd7cef93cd11acf948fbf4ce87b3ba00c23f5220c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae8cbc2-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232581, "uuid": "20eba244-8228-4a2b-a6fb-594b3be0cc9b", "comment": "Malware payload", "value": "cb9fd73fa86f3a56e950808f3b8ff1c7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232581, "uuid": "aa67a636-32a2-4324-ac2c-d9cad098ea50", "comment": "Malware payload", "value": "29bdd26797dcce13125394e0fd38b5119f3123f464964dbda0bd7c687c1394ec", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232581, "uuid": "27fea762-dc78-47e7-b259-7bab565fa199", "comment": "Malware payload", "value": "52fd1ee8951d8e53f37eaad639e9382f805015f3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232581, "uuid": "4135526b-3c86-4a5d-aa26-dc83401a43b4", "comment": "Malware payload", "value": "c679928651e3878e286a5cf3fb96a5d110cc9cc8478d7d20b7a62f82e078a3bb6ec8ee04be08c00806bed2efc3ca68a9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232581, "uuid": "3d2e06dd-1820-4c58-ac47-1ff4e2957c1b", "value": "F814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232581, "uuid": "f39b2413-adf8-41f4-9899-efa8e66c60c7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232581, "uuid": "828d6d40-6ae6-4cfa-9c65-736fe3667fcb", "value": "3072:xopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:GpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232581, "uuid": "99b2077f-af58-41db-8ebc-12e86505b987", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232581, "uuid": "5bcf4b5e-5857-46db-b506-5bdef2fd0a4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232581, "uuid": "06ebf9b3-12c1-4689-86ef-cc2c5e3d183a", "value": "29bdd26797dcce13125394e0fd38b5119f3123f464964dbda0bd7c687c1394ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "206ee6b8-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216269, "uuid": "f526253d-ba7c-43ca-b62c-0e752def8401", "comment": "Malware payload (Dridex)", "value": "bdc6b303271ba716d8be799d57cd8bbc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216269, "uuid": "c498492a-e29d-41b4-b53c-1f2452d1375a", "comment": "Malware payload (Dridex)", "value": "29f110821c2a853d00346c4d9cd8a3e03f15b75ef9d2b06b203c48abc62a31c7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216269, "uuid": "13d42587-1ec2-4aa7-8ffe-de3ff48827a6", "comment": "Malware payload (Dridex)", "value": "6a5652e4b4baed07e9b63e34f32122e64e313db8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216269, "uuid": "63ed07d4-ad4a-4660-9418-a4e8e0a6fb80", "comment": "Malware payload (Dridex)", "value": "f3c1b9cb0041061e11f3be2c6341aa904e43cbba87bee57aa067adec838af6fe6ad171e2f09e05eb287ff4ecefc1062d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216269, "uuid": "901e945d-d972-40bb-b0c6-4a3ead99afd5", "value": "5A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216269, "uuid": "3a194955-6824-4366-b0fd-4cc1a907cb11", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216269, "uuid": "36fc0636-3f49-4717-b56d-1cee7828b69a", "value": "3072:Kopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:tpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216269, "uuid": "2fb8d438-82d6-4821-8aea-904118700304", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216269, "uuid": "56b7f171-86c5-4614-a810-5b7740d86948", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216269, "uuid": "92e6ee38-66f0-4f9d-8f86-7b79e4c0e70c", "value": "29f110821c2a853d00346c4d9cd8a3e03f15b75ef9d2b06b203c48abc62a31c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10677d97-9274-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617231275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231275, "uuid": "f26e5777-5364-4628-90fc-a4101786b598", "comment": "Malware payload", "value": "e645f9416d723a0c300a7fc39f20de00", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231275, "uuid": "53268614-0580-471d-979d-007516b6c961", "comment": "Malware payload", "value": "2a016f1a3ecc78b699685ad0b7e765f0bbbc61792eca3f1ac6c63037dc31b38a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231275, "uuid": "9af951d5-16a5-4ff3-82c6-38a68cbaa7d6", "comment": "Malware payload", "value": "bdd2908a3687ea52f1907bf041b9cc768a991b27", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231275, "uuid": "a3dd2105-8db5-434e-a76e-d920a37dc4d8", "comment": "Malware payload", "value": "5ec572fbbc12c9a0907137a64cc12f9335606fbb7dc6d2fe9587a9bf6045061c77d3e4eb3e5d6742ddde7790ffe9dd70", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231275, "uuid": "390e83fa-a6f4-4134-9bef-5a496f3cff2d", "value": "5314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231275, "uuid": "b174aead-72dd-4a5d-b149-e6ccd11d27f1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231275, "uuid": "e4d42489-472b-488d-87c5-ef0e5a453181", "value": "3072:2opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:JpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617231275, "uuid": "874bd8d7-70a9-4148-b934-41bad4b4c978", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617231275, "uuid": "a57bab9a-a9ff-411f-8f47-aa1d14e1049a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231275, "uuid": "639aa935-5a44-4db2-89cd-1240197313ef", "value": "2a016f1a3ecc78b699685ad0b7e765f0bbbc61792eca3f1ac6c63037dc31b38a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f997e37-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232186, "uuid": "a326b8dd-d0b7-43d6-8403-e00cbd566897", "comment": "Malware payload", "value": "9cf02476d43caedcaebb4c9bdb6af655", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232186, "uuid": "7e06647c-90b7-4def-b01c-62f38613af47", "comment": "Malware payload", "value": "2a10ba6fd5b6e6361ab99ad9e8c55a18800dd7d60ce6e83ae0c35f194e53833c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232186, "uuid": "1adfa809-3f74-4c69-9eaa-8489d5ab6e4d", "comment": "Malware payload", "value": "fffcfbc5dbdebafe7e18a1d5e4386004aad8b559", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232186, "uuid": "36f5641e-1526-4272-95c9-18be6487ec59", "comment": "Malware payload", "value": "453b7b9a9e9c27dd230ff85d95cd26c46f09535daeb4878b2c188a9ae626ec7d30a3efd52dc6b43f1784d3442fc6eb03", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232186, "uuid": "40db0871-d1c3-4fb3-9978-6471b8abf7d5", "value": "6A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232186, "uuid": "1f139e91-ca8f-44f7-be6f-6ea4b0b2119c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232186, "uuid": "d6adc738-2e34-4c44-b2fe-3603fd748baf", "value": "3072:Topj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:UpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232186, "uuid": "f08e4e7c-1599-4565-81fb-0c2b1bb66249", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232186, "uuid": "e9af55b6-dc49-4bbb-94b8-05294160b745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232186, "uuid": "e1399ff6-603b-4348-a7f1-721ac717c9bd", "value": "2a10ba6fd5b6e6361ab99ad9e8c55a18800dd7d60ce6e83ae0c35f194e53833c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe4c843-9264-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617224697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224697, "uuid": "f17bac54-9cb7-4721-bb16-2a0117acd8c0", "comment": "Malware payload", "value": "baa84b3d145afbfa9e6ecea9144699c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224697, "uuid": "91773ed1-b58f-440f-9f59-345de3d260aa", "comment": "Malware payload", "value": "2a16c97f0d59f469fe061aa9574f7b379ff3788b3aeb5a29f5d59e7709e3c26c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224697, "uuid": "d64ef9b1-7dc0-4e73-9a92-a641b9718f82", "comment": "Malware payload", "value": "61f9e2a459df556954c5d81964d31c242f771385", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224697, "uuid": "1a2dd752-261c-4031-9cc8-4e681f125855", "comment": "Malware payload", "value": "89721b40d9d2861f89e3073d8932f1bba986fa53af4c948a887784991ff6e06e24db7bb78d11bf525931735c6b2b46e0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224697, "uuid": "3bdece7d-4430-41d3-8386-f2ea4354522a", "value": "4564F66320127EE7D3658A3EF7615A0B21199DE4F9C0B44CA32773BD897984D67B8233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224697, "uuid": "712742a8-a634-49a9-9bb7-8beab820b11b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224697, "uuid": "e93fc465-cb92-4d1f-9fd2-b1cac3d287b3", "value": "3072:FySI2HQ3zDgI4g8pzb5drZ30j3FV7U+QnMmWiIfLnp7CXjhz5c6OxXLlZb:kZL6Z30j3FVghMmWiIfl7Cc6OxXLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224697, "uuid": "237359d0-525d-4019-946d-9ff4e6dae5fc", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224697, "uuid": "0230e1c0-731c-48af-b893-10ea4f300021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224697, "uuid": "29037216-ab88-472b-a901-63368f389233", "value": "HWWKFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a1756f-91c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157326, "uuid": "c4c6afdc-05e0-4c62-89a6-6f28dbf0ca94", "comment": "Malware payload (IcedID)", "value": "02a78acbd1cf66283067dfaf452b7647", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157326, "uuid": "4d8efa8e-8e9e-4161-9093-b246d44f2d0a", "comment": "Malware payload (IcedID)", "value": "2a4483f99af47eca1e18f501f640a0ca26c11312c8d457ada1d4d916d1f7ce2b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157326, "uuid": "c5626db5-0dd4-4376-bcfa-3067d5eb98eb", "comment": "Malware payload (IcedID)", "value": "1cde6d7d5cd011fb68a1da04f2599e9bd8639826", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157326, "uuid": "6f71b720-24aa-45a7-a7db-22bede0bae32", "comment": "Malware payload (IcedID)", "value": "1c1f77cad54f7bfb5f0de4dda0495e41bf117b01953e3615de8399bbd0a3194ed4d81df35d90f44d263bfe1d871a6259", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157326, "uuid": "2226d080-3d90-4c45-9fc8-8e7aa3504cba", "value": "96B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157326, "uuid": "128a05b8-12cb-4633-a016-dade21563ad0", "value": "3072:i2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:izxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157326, "uuid": "8aeac75d-ccd0-4e97-b78a-e07a5b3f8f57", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157326, "uuid": "adb8b13e-f5f2-453f-990a-d16d65859265", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157326, "uuid": "714f1a91-0daf-476a-bc97-f47560b10eca", "value": "document-843481891.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee48db8e-9250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216185, "uuid": "d8132177-74c0-485d-8236-80365d1f5130", "comment": "Malware payload (Dridex)", "value": "7b9f5dbb657c429ce1e0d65458d5b643", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216185, "uuid": "995a640d-1a3d-4e12-882b-e7d9a5e452c0", "comment": "Malware payload (Dridex)", "value": "2a464ba6f93bd9cf761872a25814174b32f4072fc1680b8478474cc0b26f9315", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216185, "uuid": "1c5e49a7-df88-4b98-9439-ff1c76110d35", "comment": "Malware payload (Dridex)", "value": "72477326d247fd827e8c0ceb915ea7e8d1677157", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216185, "uuid": "044bc566-6dcf-446f-a5f1-4f613ad05a8d", "comment": "Malware payload (Dridex)", "value": "fc4a75238b3f9fc56e9ce70e2dfb1a03b49b67476903045950bd20c38d5084b094d4c03a524ea2ddf3548f21a2d799ef", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216185, "uuid": "37903b5a-d77a-4b98-8fea-dd540cfb474d", "value": "A014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216185, "uuid": "182c194e-e941-4624-a2e0-8bd73d5134a1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216185, "uuid": "3f7da9b5-ee92-4248-a451-f41d191e3824", "value": "3072:sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:zpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216185, "uuid": "5097246d-fd7b-4a4b-985c-4d524a4680c1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216185, "uuid": "9341e316-3369-4f7c-b976-95536659e819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216185, "uuid": "31afc504-3ca3-4c7e-9a39-539a7eb38f64", "value": "2a464ba6f93bd9cf761872a25814174b32f4072fc1680b8478474cc0b26f9315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2170c511-923f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617208540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208540, "uuid": "e6d631ca-4bf4-4f5a-84ad-977f06117ba0", "comment": "Malware payload (IcedID)", "value": "dffb8e483f2f7e1304fc14a56ac48f1b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208540, "uuid": "96456475-44b4-408b-95a1-a6d25f180b27", "comment": "Malware payload (IcedID)", "value": "2a56b0023588bd35c0f7623dea14ab4966a932c004b4a81e871d5f7a4adecdb9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208540, "uuid": "22dad2e0-8e54-46d0-8f42-9dab86217a6c", "comment": "Malware payload (IcedID)", "value": "ab07db227cd37f1610b52912ae9b989f22dcc364", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208540, "uuid": "9291c260-f662-4349-9c1a-3ba4b3e29aa5", "comment": "Malware payload (IcedID)", "value": "a5e054e8216abe405556c47b230fa2d930224496e393523d4747ef33ebe94cd7ad843d008571359de9402851233f6fee", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208540, "uuid": "01a4a889-dfde-43b5-8108-16accbb3ba74", "value": "A4B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208540, "uuid": "c16a449b-6778-4033-8184-b8f8088a0354", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617208540, "uuid": "682977f1-15b9-4705-9d61-fca173dcefb5", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617208540, "uuid": "288563ea-cef0-4899-a366-a5f6c64c596c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208540, "uuid": "dd4a3254-87e9-44da-8ec8-654f55bb4b00", "value": "document-961259182.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d02e15e-923d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617207701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207701, "uuid": "e861d9ca-73d3-4faa-9f23-1d1bafef80bb", "comment": "Malware payload (Dridex)", "value": "30f8b838c42d34b524ca7e16c259dce7", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207701, "uuid": "bdbec6a6-0ccf-4758-8fe2-5fabd901f49a", "comment": "Malware payload (Dridex)", "value": "2a7d98e350c431dcce79966d10ed36236a0fa0dfa113cec0d629ddb3faa43be2", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207701, "uuid": "3476b03d-bc49-4d68-a3fe-5f3520991a6b", "comment": "Malware payload (Dridex)", "value": "89d75c516d3eb872197fd35f94cd85130536a98d", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207701, "uuid": "e1830e78-c376-4ee8-9955-9c7279099ade", "comment": "Malware payload (Dridex)", "value": "1fc9a69c7ffb2923e561a3b709c2148060be43f517ecf7ad20ca840598c70422fc9eef1a775ccdc45865335fd8c5575d", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207701, "uuid": "ec147b35-f2be-4c40-814b-0244698245dd", "value": "2D84DF42EAD54431EB726F3808738B514BEF79D18E308CABA29C205D1F676D0567CB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207701, "uuid": "16eb90b6-923f-4f63-9c04-3ac1a2f764ab", "value": "f80d389dfa6eb310b9592775bddbb2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207701, "uuid": "2056b112-7f78-42bd-80d5-51a19d3a9475", "value": "6144:NCyziEGu+B0VlPM+iHlDx7YVUggVSkMObhe+UqN2oCh5pGCN+zT:4YiE06/iHlDx7YG7RTIZQFi5pBuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207701, "uuid": "d1e1a3a9-3e96-4759-bb0d-1eb09870d403", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207701, "uuid": "a498802a-c386-4f43-893d-78b8d8740a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207701, "uuid": "8a6af62a-ccac-44b9-88f7-8ec7a3f9cc23", "value": "2a7d98e350c431dcce79966d10ed36236a0fa0dfa113cec0d629ddb3faa43be2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72f2150-925a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617220441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220441, "uuid": "5a06150c-0625-4f11-8d2e-468484fed30b", "comment": "Malware payload (Dridex)", "value": "6053ecfa4e19adc70d2be1e91db2796e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220441, "uuid": "8dfdebdf-7495-42a8-8eaa-ca34a8deec8e", "comment": "Malware payload (Dridex)", "value": "2a7e48fe0914d03fb4ba50c5056ced9afdcf45c0733b92cc99f0dac4dcf4ec44", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220441, "uuid": "2f90cff6-ecdf-4cc4-8181-1144e299f9cd", "comment": "Malware payload (Dridex)", "value": "0e3c5b08fe7a35f8dc3a49977b96fb1d549bb5f0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220441, "uuid": "cdd4fb53-4c6e-48b7-a8ad-5e1b0e2ff7e9", "comment": "Malware payload (Dridex)", "value": "23c309b777597b387474fbb3289bb34a483bfc23ba7f2677b46f007920aac8e0e50bee1a4c253bff9b4e7e412eb06dae", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220441, "uuid": "763c345a-d367-4d0f-b238-5140d0ea9f1e", "value": "2214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220441, "uuid": "91c13da8-5eb0-42cc-80b3-51df7ace2144", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220441, "uuid": "f69183a7-7009-4bc2-b2b4-c4fcdcd9d83d", "value": "3072:Dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:EpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617220441, "uuid": "71ca9b8b-b30a-4fe9-afa3-d2a398f05c9d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617220441, "uuid": "8e00bbcd-2eef-4a53-99e7-558fd3be8a2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220441, "uuid": "82414f77-1b4b-4eb4-8a4f-8a82680ade9f", "value": "2a7e48fe0914d03fb4ba50c5056ced9afdcf45c0733b92cc99f0dac4dcf4ec44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f35ba6-9238-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205598, "uuid": "ed0f6c4b-104b-47d6-aa29-e29099505852", "comment": "Malware payload (IcedID)", "value": "908a825aa262791e4977da941fe6c5fb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205598, "uuid": "b7f58fc8-61a8-4193-838d-fb8ab63679d9", "comment": "Malware payload (IcedID)", "value": "2a99ca7dd71e66682f95addb22a4c16b42a0d618fd095859cf0968f491953ee6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205598, "uuid": "12ce63b2-3f9e-47e1-bbfa-adeea59cfd77", "comment": "Malware payload (IcedID)", "value": "d2c7746bfcc8bb35c418674a1d9c62a6e9ce9d2b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205598, "uuid": "4a574b9a-336b-4fb0-a548-d15806dbcc7b", "comment": "Malware payload (IcedID)", "value": "976df4956fad5a1399ae8ae197221c5560ae0a8960b57e12d3494e3282378e7029bdae0847eaa3503801b1e597ed5725", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205598, "uuid": "56169e2f-da2d-40b8-bfa0-280a087e6846", "value": "FCB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205598, "uuid": "433f5881-9f86-4c46-ab80-8d1d80d97883", "value": "3072:I2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:IqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205598, "uuid": "beeb1992-93d1-473e-95aa-18e88287a7cc", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205598, "uuid": "d6ff02f5-34a5-4968-b544-cc24dfc99eae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205598, "uuid": "8741e0d5-5369-4524-a6fd-cdbba3a480ef", "value": "document-1483863414.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1759f098-91d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617164285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164285, "uuid": "badba828-da65-4197-88b2-9c967d1ef1d7", "comment": "Malware payload (IcedID)", "value": "f9e7c203f654a6037022e97704611995", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164285, "uuid": "bc622825-fbee-4300-900e-c78a70d903ec", "comment": "Malware payload (IcedID)", "value": "2aba9f9fa7dcc63683b4765e82f2c4d6ae452b8b4c050fc5f1548d5d593b3db5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164285, "uuid": "334f5222-9ea4-4d35-aba8-729346548bb8", "comment": "Malware payload (IcedID)", "value": "6848cbf404ee790809098841e1d204a5797b60f0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164285, "uuid": "be7f3628-1c53-4dd8-bae8-36d8e628da27", "comment": "Malware payload (IcedID)", "value": "ab4ab77b3a61fc8e9420ea893e587357b1ba6617d80dd55db692e9301099599fc4c993859ed3542d0fd629a625de5a84", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164285, "uuid": "93afe11c-b99a-44dc-b3c3-04fe3c09c30a", "value": "16B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164285, "uuid": "795a6356-988d-4307-875c-f95b6c4405f2", "value": "3072:82CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:8zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617164285, "uuid": "3fcf9f52-b8d7-4eee-bd75-cecf0a4d6c0b", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617164285, "uuid": "691ce48a-e018-4499-8ed8-85f7a88a58b2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164285, "uuid": "91ed36bd-de44-4aed-b547-e36503a5f75d", "value": "document-2095957312.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475b6362-91fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617178968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178968, "uuid": "69ddb668-a1c3-4c4d-906c-48695394d8d0", "comment": "Malware payload (SnakeKeylogger)", "value": "a03973dba8800e935ea76aeadf94808e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178968, "uuid": "486c7cea-4bd8-4792-9910-08f8eaf600e5", "comment": "Malware payload (SnakeKeylogger)", "value": "2abfa74470f048f7c564f6fb2aee27e37107018f639f48f7b88ddf9cc7c59925", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178968, "uuid": "9390e001-909b-4559-b78a-523cd016654b", "comment": "Malware payload (SnakeKeylogger)", "value": "e308884e3849cc1790626f8d366a4c9a0ddcf29c", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178968, "uuid": "9da31247-1b6d-43b7-a77d-1c23b00a4061", "comment": "Malware payload (SnakeKeylogger)", "value": "caa6652c54689f0dc56e68dedfb89dfe1ffd3ffc4085c49b250ebf5715d11a163403f3b01f658f81fd15044fa5e2d590", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178968, "uuid": "7a0b193f-9e97-495b-81c3-9d709deadb81", "value": "E5B4238113C8D932F404C93C58818102717FC9E5DA1F76A87A9A21EFA793B3D8F5E679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178968, "uuid": "8fcd2796-413e-4a07-a457-b014e18bdbd8", "value": "12288:MYYg/WqD+43vT9DYFY+V3o1bc853/5REEOOYD6XECAJx4nXbAE:5Yg/k29UFnC1bXP5RYD653", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617178968, "uuid": "12f1eab0-8ce1-428a-b7a5-b70425abbbb1", "value": 531199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617178968, "uuid": "28754254-630c-4ce1-9d59-01e8ea8d92e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178968, "uuid": "5bb93155-0d8c-47e0-8495-3dd0af57e39b", "value": "8090800.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7f3b71-91ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617174283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174283, "uuid": "e14ee4c8-5cf2-437b-adfa-a5462ce8250a", "comment": "Malware payload (Loki)", "value": "c5fb57232f9a7f2707959b4f7e041626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174283, "uuid": "c408c785-4998-4117-9f3d-3cba6a1771d1", "comment": "Malware payload (Loki)", "value": "2b092204fefa727fd5a2e73af2c92cf37a6b249147f2f2a6ebe70e7fc04d703e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174283, "uuid": "a5d16191-06ab-4261-bd34-23954c98c953", "comment": "Malware payload (Loki)", "value": "a3a19daf276191bda43dc95a017f290fb2f93912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174283, "uuid": "b3f171c3-f53e-40c8-93dc-1e67529c7502", "comment": "Malware payload (Loki)", "value": "9a74f2936b65fa0e35797f695cd2ce2da87ae674c129941481e99bd42479605ce9ced1f89261168dcd1c98e1af6b30a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174283, "uuid": "bae95edd-bbee-484a-9aee-cae3c4a07411", "value": "25F3125B32F58CB3D2A702700DBB8162F7B64D042B11A9EB3B796F590D642478D2639F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174283, "uuid": "aaf1525d-1070-4332-9c4a-84dc923c2085", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174283, "uuid": "57880bb8-6837-4640-861f-f80086cddcf9", "value": "3072:3Ts3BxJNmJ6t7lYIw6u1mar/vPsoLxLxhV6XsMmyW8D7XjAIxO/yBKilajjW1deq:3AP37aIStFP0XlmyVAIxOfi8jjW1deBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174283, "uuid": "75a4e27b-1ebf-44a5-987e-fc72126f2925", "value": 162837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174283, "uuid": "a80fd7c3-7757-4859-b400-f0ccf16b9157", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174283, "uuid": "6c284478-c22a-47d9-b7bb-32acb027108b", "value": "c5fb57232f9a7f2707959b4f7e041626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c77758b-91f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617174709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174709, "uuid": "05939d5d-9640-44b0-bc35-3054e165e354", "comment": "Malware payload (Formbook)", "value": "d5889f96c48fc0453c53142637d810dd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174709, "uuid": "42b396b9-b20e-4831-b0bd-a1dfe80d0438", "comment": "Malware payload (Formbook)", "value": "2b143c2fe0a31089b8a3a389e9297456b557462f4c0a74909fe1796d9f4239bc", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174709, "uuid": "827bb525-4fca-4c93-b191-68dde9511e7b", "comment": "Malware payload (Formbook)", "value": "df26a232e1af5fc7f444174feae31c69adffad40", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174709, "uuid": "512c494a-9a16-48e0-bc02-fadcbc4b7730", "comment": "Malware payload (Formbook)", "value": "37c3afed77570ba0917b6e0db93192ec7ab212156f5014e8f2f1f0e84fd48c51dc613c3e36c93e6196d15af80c5efce6", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174709, "uuid": "b9bb90eb-2c50-4e9e-ac9d-95f66bc133d6", "value": "147423B0B934AB83DC30CB6A7A95BCBF7617C259A275FB60F74E140D84547E3464A20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174709, "uuid": "c1928670-3ea8-4f68-89af-8c93dd46dbeb", "value": "6144:0M0rhLtAIZHxVBXc79nDc+JFH5sHmhHUsqSNPGG+sZpjcz05ZhFaiDut3K8FGpqy:0LeIZHxVJcJlGaUmPGNsnoz05rFteaBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174709, "uuid": "97297e9d-e3d1-47d4-8c8c-b8368fb15398", "value": 351682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174709, "uuid": "a982f6c5-b99f-46fb-9227-b57e723b764b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174709, "uuid": "a701c484-1967-489c-8c73-a6dc39cf1645", "value": "Order Drawing.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7d5145-9233-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617203759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203759, "uuid": "f0192a3f-7891-432e-a79b-aa5c2ccb6d3d", "comment": "Malware payload (IcedID)", "value": "6b7af225473fb63dfa864d33c8c06653", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203759, "uuid": "ee781788-e1e7-4ee2-892f-7d9e76f50e19", "comment": "Malware payload (IcedID)", "value": "2b2939ea37d054940e51c6dab0e2e1b0f7bf64bac5d0b2b54b4e268b059b0550", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203759, "uuid": "f2e30adb-6cd4-49e7-aae7-4b4c75c891c3", "comment": "Malware payload (IcedID)", "value": "776d8071cd8487187e3846c121ec91ab7d699337", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203759, "uuid": "6a228abc-7b84-4736-8c28-535a1f46a6e6", "comment": "Malware payload (IcedID)", "value": "94aca1ccbfcb2e81691a8ed9edab2e2663a72c5445b3e513b30628c261c50a74a52ec4bea716be9e0b6052accbaf7021", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203759, "uuid": "88fccd1d-27b7-4008-bc72-b27ff591000d", "value": "84B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203759, "uuid": "e9bd1e87-bb0a-4ac5-9953-c22c7c880b66", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203759, "uuid": "40c22702-4ec9-49e0-9344-9fba48d3d8ac", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203759, "uuid": "876f0cce-b1b2-4150-929a-be23f57d8b04", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203759, "uuid": "5d4491a1-63c2-4a3e-b348-4df99b0bf190", "value": "document-1331024229.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b3486f-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212903, "uuid": "1767dc62-25ba-4668-9b10-a2cbaf1e9812", "comment": "Malware payload (Dridex)", "value": "cc7f677c367b328f48f7c19719a85fcb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212903, "uuid": "50bf80e7-e804-41bb-a78b-15ae39e99587", "comment": "Malware payload (Dridex)", "value": "2b50a3fc31b2ecfd59c5e7968d5aefb6558b5f532e721e0f92464f22256b2359", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212903, "uuid": "9d62f3cf-521e-4400-aabc-b9af251c2ea7", "comment": "Malware payload (Dridex)", "value": "7d8eaec4223bf4bbf3ed84c4667979bc0fc28d2d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212903, "uuid": "f7abc49a-6cad-4a1b-afcc-30eff169ece7", "comment": "Malware payload (Dridex)", "value": "54d011868f0e9ce7b02478eccad293fd89a221fe1b5dd25341be79af52c1f446160db516edf30dbd7a388861811f1a19", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212903, "uuid": "2c35a135-eab2-4279-9d87-f9d10ff53d73", "value": "8F248C5FE339E486FAE3CAF44186A72296A39C92436F680DA0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212903, "uuid": "bcb4efa7-f367-4b01-8e2b-b7c1c060a0d5", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212903, "uuid": "64e60cd9-ffe4-4077-b506-77044987fde6", "value": "3072:M6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:MoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212903, "uuid": "27d00c08-e4c8-4061-97ac-109a0ba54600", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212903, "uuid": "693cb8e8-2370-4a4a-9893-8788dae49ed9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212903, "uuid": "fed19fd9-240b-4a04-bc29-bfbb7d129499", "value": "2b50a3fc31b2ecfd59c5e7968d5aefb6558b5f532e721e0f92464f22256b2359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9df158-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199321, "uuid": "84d4bc37-6af5-46c4-91b8-1f4e7d04e0d2", "comment": "Malware payload (IcedID)", "value": "35ed9cdb57d30b1a28fcfe6031434073", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199321, "uuid": "ac48c4df-5e4d-4a0b-bff4-fc86e9cdf407", "comment": "Malware payload (IcedID)", "value": "2b5223405738db90acdc4cb750356b8f82fd75c0cc89cab5f38de11649f30f9a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199321, "uuid": "79ae742d-9ca6-4c38-be3a-4b4a0aa6da8f", "comment": "Malware payload (IcedID)", "value": "8c0c869f890ff6465473654ef4a524f052536279", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199321, "uuid": "e5ec0ac9-92eb-4699-8952-de2ce6343d39", "comment": "Malware payload (IcedID)", "value": "a19438c3007578192c94718b3379a5a9972d45f026d40d4df3f513ca8dcc5b838901bd4112cff0794b0455ed89b2c770", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199321, "uuid": "097624d6-1069-4f94-9778-88100557136a", "value": "BDB3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199321, "uuid": "e56fece2-7370-44b1-89e2-5434efd8b9dc", "value": "3072:s2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:sqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199321, "uuid": "fa0b0f99-5361-4817-825b-9d5f187cf9fa", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199321, "uuid": "1ebf308d-333d-4f20-98be-5d372dac393d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199321, "uuid": "c1911681-5cfc-47a0-bbe6-4142308b9ce5", "value": "document-1067580175.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd84a1e-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216940, "uuid": "fd634e30-d8bc-4af9-84b8-83e46c5d2a59", "comment": "Malware payload (Dridex)", "value": "1b9f176a5b34f30be12c435c4da8feea", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216940, "uuid": "8104915f-b433-4c60-8289-a5c4927af25b", "comment": "Malware payload (Dridex)", "value": "2b7ba3ab4608a12f6f70178ad65f8f1455e7f0881fb201710bdb703e20fe23e9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216940, "uuid": "fc749a0a-859e-4bd7-bec3-9dc9489ce778", "comment": "Malware payload (Dridex)", "value": "fa1a11065038ec9c669f8809e55211bb3379db2b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216940, "uuid": "bbad700a-8491-49ba-8915-f2d7a9b97f85", "comment": "Malware payload (Dridex)", "value": "12c8298c358a3117cdeab9d9142660f47a56806a839e0da1ea669a69a5976d1ef33bafd2dbf24ba7bf9bf22d41016a08", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216940, "uuid": "de6c0e8d-203a-4163-96d7-5a0d673855b6", "value": "6014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216940, "uuid": "300e6945-29b4-453f-89c1-cbf8a8e80218", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216940, "uuid": "b7a0401b-870e-425b-a6c3-a3f67b03376e", "value": "3072:Kopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:tpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216940, "uuid": "54ecbacb-6816-4c44-baf3-d776bdac1947", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216940, "uuid": "7ba3d297-b70c-4860-97e3-031e89f10e64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216940, "uuid": "9888e672-9d78-40a5-8f33-f5c8f7a390f3", "value": "2b7ba3ab4608a12f6f70178ad65f8f1455e7f0881fb201710bdb703e20fe23e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e978b3ea-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223049, "uuid": "fa201044-0b31-4e6e-8924-f83065c40980", "comment": "Malware payload (Dridex)", "value": "2e6e4cf741176b8e6825234caeb0ec3f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223049, "uuid": "c4d834d7-0462-4bbc-8655-2f30dc3dfac5", "comment": "Malware payload (Dridex)", "value": "2bc067d8693a780dbbe20958cd774eb75c578df8bc1336e83bc0ec1a3338f1d4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223049, "uuid": "be83eed0-6eeb-44fa-bf8d-378351820829", "comment": "Malware payload (Dridex)", "value": "dbacbe390258d47cef543b715a2d363ad6a8d8a2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223049, "uuid": "a529db76-701d-4db9-8158-5a8cbb5a9922", "comment": "Malware payload (Dridex)", "value": "f8de33a8196cc92e180a516a87b1f8700b02194a157dc2661a18f63486f9518a9b2d7fd2cc88effe9887ed0a48ef78ef", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223049, "uuid": "e68771b3-ea72-47a5-9bfb-3a2369c5c741", "value": "92248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223049, "uuid": "05418f9a-68ac-4b44-8fcc-b65df3d71f98", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223049, "uuid": "235ef0ac-8cd1-428d-a70a-f4c3ca7b348a", "value": "3072:86TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:8oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223049, "uuid": "0d250498-3617-4794-9675-5779207a8fd8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223049, "uuid": "c1dd547b-7c24-4784-b5dd-3767298b953c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223049, "uuid": "38e1199a-c795-406e-b41a-d0bec996312f", "value": "2bc067d8693a780dbbe20958cd774eb75c578df8bc1336e83bc0ec1a3338f1d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b55f70f-920e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617187538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187538, "uuid": "60188b46-0acd-419d-a2e5-7c0e59ff0a55", "comment": "Malware payload (Formbook)", "value": "ca08afc75b2b74bc87663b2af0c53d55", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187538, "uuid": "ff6850a3-9791-41b6-a7c1-5b5c788364aa", "comment": "Malware payload (Formbook)", "value": "2bd2b5a44a6451840ab0f820f08f2eed0f1763711b0e0427fb4d0579e6603fa2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187538, "uuid": "4fd72b71-43f2-43ca-8dcd-09033eecb1c1", "comment": "Malware payload (Formbook)", "value": "f2bcfa267be90302db50f807aa03954f56de26de", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187538, "uuid": "1476ff12-a8d9-4d50-b669-0b67e7298afa", "comment": "Malware payload (Formbook)", "value": "13d3be6d2ec3ad6d22952b79ba89acfa0215e9617b3f4806afcbf0364e397f64e63a4b5038b268f8b82e3c7bdb89a68f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187538, "uuid": "b15afc75-e40a-44a3-a2a5-175afcdc3ca9", "value": "AC126BC4E3EA84B0C3A462B74364524A407FDAB7B6A79CF07D9DE1523F65A031E752B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187538, "uuid": "57ad82ae-5a48-4afe-ba21-b26465fdd557", "value": "192:508bLoFwYlC5P1oKJtlUX1B2/z4ZrDiS0sXrRMowS9sjoURwPZZRS:68fAwYlC9umlUDVNxySi8URUrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617187538, "uuid": "a866d296-7a99-4dd5-87cf-a58600bb094d", "value": 9907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617187538, "uuid": "af3898bb-3ea2-4ee0-94d2-2f19a509df5b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187538, "uuid": "b20e62c5-43ee-4b5c-88e1-53795a17787b", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.2221.13825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca9f9b8-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159489, "uuid": "bb83dcc3-6185-4790-89d4-ce9bb2d939cb", "comment": "Malware payload (IcedID)", "value": "64ebb512ab21637c8ca24a29b7ad9c37", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159489, "uuid": "14e58c20-3c53-4b75-befd-a0482d027021", "comment": "Malware payload (IcedID)", "value": "2bdd670b637c09704625cb6d03081bb8ed09ff3e1f20c7a0ed6326a74ff08764", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159489, "uuid": "82ee3bb6-6b42-4910-8e9d-6fb9abe31c55", "comment": "Malware payload (IcedID)", "value": "69b9a5c941c077d001b230e82d20f7f4688df2c1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159489, "uuid": "34f96dcc-7ec2-4050-8fa8-26e7f24c9020", "comment": "Malware payload (IcedID)", "value": "1d5260fa4c5e9ee785759f34077bd7f65efefe993282491b1e1e96f423c8fe6c22beb2d49d0fe4f1921fb7d7fb09fa8f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159489, "uuid": "079f9bb8-03d9-4d7d-8acf-279af71a64b9", "value": "A6B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159489, "uuid": "40e53f72-1511-42d9-8a11-aaf3084a5780", "value": "3072:Q2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:QzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159489, "uuid": "64ce7629-1aa6-4eaf-ad17-6cd998b09579", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159489, "uuid": "0c1d1971-45c2-4fe2-a29a-50e365674755", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159489, "uuid": "b68d4658-2c7d-4d25-9158-52545ace8746", "value": "document-411488845.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d983cfbd-9250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216150, "uuid": "e5fafae0-6fe4-472f-8ad3-9433d2e54cd1", "comment": "Malware payload (Dridex)", "value": "3cfff356d43b7906c58c7da8b19c7cd9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216150, "uuid": "2c58194b-f711-481e-8fcc-883ba5baf904", "comment": "Malware payload (Dridex)", "value": "2c0633eb716004c7e778be4ddf2c4021ae1cdc571830db9c24832faebac822a2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216150, "uuid": "2d5dda86-87f0-48e8-8bab-51ae9b09812e", "comment": "Malware payload (Dridex)", "value": "e039ff24e9f3fcf3bbf20ab7f7226b33b2ffcfa2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216150, "uuid": "1b4f07a0-79cc-4a2f-8134-c166cd5d7a52", "comment": "Malware payload (Dridex)", "value": "e71bd487dbc65cefec08f22fb666cdaa66fa0c32e354631c029560951fe2588f993c120f1714d1400211f40db8170008", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216150, "uuid": "2790adfc-a399-49b9-ab1b-90f001da580c", "value": "0014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216150, "uuid": "606e2d42-901d-4a7c-a050-b1ccfb7f726c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216150, "uuid": "7dc8d851-a263-4822-a0fb-bef0068514a6", "value": "3072:7opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:MpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216150, "uuid": "ae3b5ec7-b41d-4e07-a552-f2ab040b9cb2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216150, "uuid": "93b53b29-7a06-430c-82a1-f8a0ea4f0edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216150, "uuid": "77a37a78-3df1-4c00-b302-e9575f2030a0", "value": "2c0633eb716004c7e778be4ddf2c4021ae1cdc571830db9c24832faebac822a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a5ffbb-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223870, "uuid": "beda6961-47cf-4df0-bbd8-e23301621582", "comment": "Malware payload (Dridex)", "value": "dd4e1bb35b343aae0a8723b65c2ef8b9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223870, "uuid": "f977dca7-6dda-4a50-9b14-6325735d226b", "comment": "Malware payload (Dridex)", "value": "2c12b1d6aff8aa758916265d2ec05c5884373bc90383ff19218913966aea65d1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223870, "uuid": "1026c21b-b0eb-492d-a8ff-dc20615f82ad", "comment": "Malware payload (Dridex)", "value": "dc3268681e73d93e51404f85740198d2c59aa215", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223870, "uuid": "bd2a14ce-5c09-4575-94c3-37660040a5b2", "comment": "Malware payload (Dridex)", "value": "5edf2e141aeecab7baafa148e13b1836b8a4020e58c8ef33e3d48808fbd1c7a372f9ed42dc7c920d9c9d456ae980c836", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223870, "uuid": "d35d583e-e439-4716-a5fe-b9fe35f659cb", "value": "EC248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223870, "uuid": "3ec01b67-5174-4a6b-8041-f80accac0bab", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223870, "uuid": "835835bd-b1b2-4ccd-8548-f4178eef5286", "value": "3072:P6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:PoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223870, "uuid": "a6645dff-269c-4977-ac18-ab4e3ab13994", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223870, "uuid": "13800780-381b-4e8e-8e64-7c4c2840b6b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223870, "uuid": "cec23edd-88e7-4a11-be25-bd26d30be1e2", "value": "2c12b1d6aff8aa758916265d2ec05c5884373bc90383ff19218913966aea65d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e43536b-91c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157022, "uuid": "a084682d-bdd0-49c1-b38c-7aac9667fa97", "comment": "Malware payload (IcedID)", "value": "13c74aa1207ac4cce26fd9b2a9bfb45b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157022, "uuid": "477fb717-bc29-4c30-9f5a-6efc371e96e8", "comment": "Malware payload (IcedID)", "value": "2c4f5a0d8d82eb29cc7bf464cb3dfaad3b916f490924e0c0e9aabb69c41cc6bd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157022, "uuid": "27a32d1e-9d04-42a1-8afa-38f23ff254b7", "comment": "Malware payload (IcedID)", "value": "c5b2f337158c3c7c33b332cee7fd2c193befc18f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157022, "uuid": "a24fa3c7-1ca9-4d17-b1c6-de491338b7cb", "comment": "Malware payload (IcedID)", "value": "d2b4e11a8ea60f8def6532bd063e25a01dfa7b575be4e07632d536f7118baaaf4e1a02dfe032a8a17c41c35efab39b22", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157022, "uuid": "c6770f56-0c57-4b79-b724-d1a151020c6c", "value": "10B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157022, "uuid": "989baabf-3db3-423e-8a32-fb318ec50d3a", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157022, "uuid": "3c70dba0-6fcf-4772-b445-eccf0476776b", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157022, "uuid": "abd73cf8-f004-49bf-9e3c-06fce50ccfef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157022, "uuid": "086b9957-568c-4040-8ea0-0b59c9d061b5", "value": "document-841707082.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e82850a-91ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1617174256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174256, "uuid": "981e22f7-a396-4da7-aa04-05451c6dfde0", "comment": "Malware payload (Smoke Loader)", "value": "ac0329cb18bcfc52a17d5e710e13bac7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174256, "uuid": "3c176b5c-dac6-49a0-a60a-a87e0e4b19b9", "comment": "Malware payload (Smoke Loader)", "value": "2cfe6c2923835f1115ef597905029c8f1331b46812f8ec2000e71785c29b90e2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174256, "uuid": "c3ceec54-02a9-4d17-a30c-2c7990bf7dea", "comment": "Malware payload (Smoke Loader)", "value": "eaac313a8aae7b6c4f5fec2515293e1aa32570e8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174256, "uuid": "8e25dcb1-387b-49dd-8a4f-7d333cbb4777", "comment": "Malware payload (Smoke Loader)", "value": "07502139d2a81ea19eb23cb2ce10f1ab359297b33134700cc3a43cfe028b03d857fc41ecdd6e3d092cdf52bf8eec8a08", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174256, "uuid": "b289d661-5e9f-4c0c-941e-1d981ec99776", "value": "B964228591A45ED4A6418A2E20CC0B335EBBBED29A3285675CDF2CF54D0A10F76F7B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174256, "uuid": "8bb41e3a-5acc-4387-94a2-e71495c0f887", "value": "6144:gmQPbhvLPFP7EtbCLBLmsoADXgeZNpbymheCEGdqfQc74+z:CBB7IWjoADHN9ymhe8gh74O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174256, "uuid": "1f4b1572-d840-481c-b7d8-8274f79da89e", "value": 311860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174256, "uuid": "ea35c18b-351a-433c-beba-1982b6c731cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174256, "uuid": "d7ad438b-7f13-41ae-aabb-af0619559524", "value": "Signed Trade RFQ_TXT_DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91334d2d-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218177, "uuid": "9b28a74c-61ea-4d39-ad35-95bea07c7016", "comment": "Malware payload (Dridex)", "value": "65bc1026f1315beecf47f361bf4d4878", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218177, "uuid": "f3cb8cc6-0809-49a4-a3ca-689dbd7b5914", "comment": "Malware payload (Dridex)", "value": "2d2f3742972ecef1f6574fa1c4d6e478ff13c3b7a63162aabdd958dd9fbd73ff", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218177, "uuid": "f08837f0-0499-45a9-996c-1e22a5b616a5", "comment": "Malware payload (Dridex)", "value": "7c9d4c7d5c1d4d135cc8cae78d5d09a25e7787b8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218177, "uuid": "c0efddcb-6764-4fbe-b182-fe810cf90752", "comment": "Malware payload (Dridex)", "value": "70ccf0ec238f1249730196950ffbc8ff9ab4c8fc826c1caa012cb6dc93fde4f86c823162d3ba9b4cb07432434e2b4bcc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218177, "uuid": "58c65332-5e16-4a70-ba4e-fb56f26524fe", "value": "EB14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218177, "uuid": "152f2a16-507a-4073-b2d8-325d7d9766a6", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218177, "uuid": "45feef0d-1224-4905-abb0-3610688dab45", "value": "3072:nopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:opjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218177, "uuid": "811fc0de-50af-440e-a722-91361707afb5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218177, "uuid": "c9cf2c3f-9304-4f25-9ddc-d44448c4c077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218177, "uuid": "23dc283f-7c29-49f2-889c-98fc513950a7", "value": "2d2f3742972ecef1f6574fa1c4d6e478ff13c3b7a63162aabdd958dd9fbd73ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e3cf69-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218070, "uuid": "1794b40e-57fc-4898-93e3-7a850320da71", "comment": "Malware payload (Dridex)", "value": "896160177c438e716f5e285ed347d4e2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218070, "uuid": "70890298-d792-4c5a-a974-3157881d7aeb", "comment": "Malware payload (Dridex)", "value": "2d408b5d0c04a8dc6a19545b1c4bc0f1fff9d5b15fc7761e631cd7c6acbe140b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218070, "uuid": "5c90ef74-158f-4f99-a730-2768409de200", "comment": "Malware payload (Dridex)", "value": "ee542186f0f045a747778a0c82b155cbcc3c10f0", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218070, "uuid": "949abb67-177b-4326-9c75-9a0b5e83a686", "comment": "Malware payload (Dridex)", "value": "70dd88c6db1f3f1f3e43917febb23191e5b28b056ec5f24b08455e653c0d7a25c2fba6ee8656fbdc5808ea615bb8ecb4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218070, "uuid": "0593be4c-f23c-4173-aa45-55b3ae1ced1a", "value": "EB14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218070, "uuid": "47dbcda6-b25a-439f-aef9-de75f9e873ca", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218070, "uuid": "bb125f80-56a9-4d45-9122-0545fdbbaba9", "value": "3072:kopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:bpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218070, "uuid": "20df9277-3a3d-4777-a7be-bdefdfb45dec", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218070, "uuid": "ba09b938-d937-4ea0-a2af-213de0bc7332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218070, "uuid": "37e7ce9c-6717-43ef-b01d-77c610da66dd", "value": "2d408b5d0c04a8dc6a19545b1c4bc0f1fff9d5b15fc7761e631cd7c6acbe140b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eebc72-9231-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202775, "uuid": "610fd0ff-bffd-4bf7-a40b-e03b0e09a24c", "comment": "Malware payload (IcedID)", "value": "5d0acc4333f2730555e89c483658f311", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202775, "uuid": "8b2f5e04-6090-4264-a933-71b1dca1c07d", "comment": "Malware payload (IcedID)", "value": "2d4129f3d0ba847fd277dd6d27446bca178307eda99947f7ca595f5179283cc5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202775, "uuid": "ec1023ba-b44f-4c26-bf14-195ab344e084", "comment": "Malware payload (IcedID)", "value": "b394c78cb15123b97e364b21c1a4f3a5207d4be8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202775, "uuid": "7d069bac-0c17-4094-9ba9-2e061b5c2092", "comment": "Malware payload (IcedID)", "value": "50abe25c7950bf4605839c962c046a0e20b5ca6751071214d9045dc7bd3c50f2663da4c9fd83e1ab218e907bb0f8d1e6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202775, "uuid": "1bae26b3-0ba3-4ef3-a10b-c6d10097b815", "value": "C4B3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202775, "uuid": "83489ccf-ad8b-4cee-ac33-c225a758e35a", "value": "3072:u2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:uqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202775, "uuid": "2a5e8952-9417-46fa-ba28-76a3daed5503", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202775, "uuid": "5d72c12a-72af-4951-a3d6-e358cdc37e8a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202775, "uuid": "d1549c2d-f1e4-42af-ac89-e110d40496b6", "value": "document-208586804.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d08bdd-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213300, "uuid": "7a92351c-2cde-4985-b51d-b7237dd2bca1", "comment": "Malware payload (Dridex)", "value": "a867b645edd1aac665512d9a851c9d44", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213300, "uuid": "26151209-1217-45ee-9b00-080baca274b4", "comment": "Malware payload (Dridex)", "value": "2d44f995abe4619f879e3a401cb840579490e2783dba1e4d458d83eb14912f24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213300, "uuid": "41fba8a3-e0ad-42a7-b227-9699eb6ad86e", "comment": "Malware payload (Dridex)", "value": "46e3ebd47a9d357a1b772ac2a97efede3d8a9c49", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213300, "uuid": "4585e90c-d20f-45fa-9899-88e747334bdb", "comment": "Malware payload (Dridex)", "value": "454ddde924b47a4e24aa2c93ace82a7480d04752352fd0d8aace1ff42c349aecb1bac113a53f4ab4d020b765ced5970c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213300, "uuid": "af8c46d8-e459-4665-9ee4-48d018f5b534", "value": "1B248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213300, "uuid": "c946e4dd-c8c4-4b59-86c6-7b722fb3b03d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213300, "uuid": "419b83c8-ba02-464c-ab23-df3007d60f3f", "value": "3072:f6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:foMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213300, "uuid": "b621f299-280b-4878-b4e1-b5dc5b6d85df", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213300, "uuid": "05250aab-711f-43ed-ab46-c7d7cbc6a1bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213300, "uuid": "6fc6a429-e9c6-4753-917a-307df2e657c9", "value": "2d44f995abe4619f879e3a401cb840579490e2783dba1e4d458d83eb14912f24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bcb1ff-91d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162558, "uuid": "ac3fec0b-9b99-4179-bbf4-a4dddcc8290d", "comment": "Malware payload (IcedID)", "value": "d52cd5cedb3abbf1d796347475b1f4dd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162558, "uuid": "c6f9bc9f-74ea-49a7-aedd-afd75c48f06b", "comment": "Malware payload (IcedID)", "value": "2d8dd0b23f93b9eb14f8b34e15be11c98bba912ca74439f70cb6261bd035bc00", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162558, "uuid": "3eb7c781-4ea2-4ed8-aba2-7afbcb9e347f", "comment": "Malware payload (IcedID)", "value": "cd38657273a33c002a0b38a3f4a854df18cd5ab3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162558, "uuid": "4c2dad51-a499-4ab3-b093-0d3e3bda07c4", "comment": "Malware payload (IcedID)", "value": "735ae020feef6926b16b2a4a1f9e754232897921e26e972ab3626def3be390a3f083ca14892fbffecdc67c073472b1f1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162558, "uuid": "2d7b8718-1fdd-4488-8975-819e77eb287a", "value": "E3B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162558, "uuid": "2c091f77-a9ce-4c75-b77b-01ec7b21d094", "value": "3072:82CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:8zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162558, "uuid": "a94609da-f513-42e0-957b-47a00b3cbbec", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162558, "uuid": "876b5345-ff70-4fd8-b6c2-4fc411b02870", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162558, "uuid": "3137ea09-42b3-4a06-889a-c73c6aa1b481", "value": "document-160932515.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781968c7-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232737, "uuid": "881b76bd-6a03-4e60-a3e6-9a3154be7f78", "comment": "Malware payload", "value": "c46d0c13a13b8112076a5472a08bf773", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232737, "uuid": "afd3b2e0-6a5b-45d6-82fa-ecbd7f24fa82", "comment": "Malware payload", "value": "2db589e4d37d91dade3c59843dde83d77d624a432aa0736a9dd6896efee6c66c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232737, "uuid": "5be07d3a-5653-44e4-b257-a85c31b59fb5", "comment": "Malware payload", "value": "8da86dfd3f4c6e969c5b69a62973f37a308bca11", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232737, "uuid": "6385ee27-55ca-46b3-8d93-5b381b0cb769", "comment": "Malware payload", "value": "9b78edf2c442d2ed13800eadb80fe5eac0fd9e70a449c47c8691382565250cc822b53246c12baa77cc2d502565011a47", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232737, "uuid": "bc70f2cd-72fe-48ae-b010-ef2a1e531e7a", "value": "C414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232737, "uuid": "b753a5c5-1514-423b-9de5-cebb7718097f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232737, "uuid": "a7c4cd33-2fd7-4240-8b3e-5c83cf0ece77", "value": "3072:gnopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:gopjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232737, "uuid": "2fa6a9da-d5ac-48d4-890e-facba1cd7e45", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232737, "uuid": "7dac85f6-46f4-449a-84d4-6795ccc91f32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232737, "uuid": "6bcb6b03-7fa2-4d53-a73e-152dd62e69f1", "value": "2db589e4d37d91dade3c59843dde83d77d624a432aa0736a9dd6896efee6c66c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b07e95e-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204691, "uuid": "40158334-5b90-4457-bca4-24a73ac96709", "comment": "Malware payload (IcedID)", "value": "04b99026ca19a1406e87dede52672bfc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204691, "uuid": "05907aa1-31e9-4753-a4b1-724b6375a3a8", "comment": "Malware payload (IcedID)", "value": "2db82ebaf068314ebe93fad88ada43e909836caf103ea8b1c0465d5df03fe401", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204691, "uuid": "2492a80d-3452-4ecd-8ffa-8966f7e16f65", "comment": "Malware payload (IcedID)", "value": "f6241f2d76201de064ff91c4dc2fb95a04851d17", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204691, "uuid": "1bcd5b64-db55-412b-8d9e-43d433e92bbd", "comment": "Malware payload (IcedID)", "value": "ed9159d72e669866efbbb51e8e10c72a3f90706d152d9d2c31ac2ae6efe0730314b08a7706ada78f7d3ef1f8321a267f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204691, "uuid": "3df9d6f4-e2b8-4969-b341-2b4433d1e06d", "value": "05B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204691, "uuid": "d0a0af37-cee2-447b-b9ab-94b352757650", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204691, "uuid": "6303a634-3ee6-423d-b655-a630005ad7eb", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204691, "uuid": "d8006f23-f28a-4895-b6c6-f66806e8d9ba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204691, "uuid": "df36e884-1cae-4e57-994b-6e5b96a02110", "value": "document-1080301076.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6130b8-926b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617227513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227513, "uuid": "8cf34eeb-4ee2-4a41-bbf1-4f7f09ace5fc", "comment": "Malware payload", "value": "658046d6022ac9f4b91354150f9a4fb0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227513, "uuid": "38be063a-7b4c-4e1b-a163-5bc27805bc67", "comment": "Malware payload", "value": "2dbb3feb982704ac12a9c16f78d70a9dc45e6525a72f1100559564b12fe829a6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227513, "uuid": "254559eb-3e38-477d-ae42-e89253e558a3", "comment": "Malware payload", "value": "c036e4c70b39338984838995eeb2925d8bb8aa1e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227513, "uuid": "3a0266a8-b408-41ac-9418-6601be57fd0f", "comment": "Malware payload", "value": "95c5ed545958ba331d8fcde973d30a379860cd9ec030e60d93c291864aa8d1c3b486940fe5742db07e666b250de88535", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227513, "uuid": "d6a36eed-387e-4bc7-a3d9-854a75d2cc84", "value": "A3248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227513, "uuid": "b3243656-820a-465b-a7e7-12331d70f4e1", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227513, "uuid": "2e510380-1d44-480e-a440-7f7e36a4e77f", "value": "3072:x6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:xoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617227513, "uuid": "b03a96ef-95bd-41a0-b890-0ba5b0e74154", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617227513, "uuid": "85247013-2e54-4241-977f-bd27bffb2798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227513, "uuid": "80b41f43-1af5-4eb3-b817-2692641ff035", "value": "2dbb3feb982704ac12a9c16f78d70a9dc45e6525a72f1100559564b12fe829a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ee76fb-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200142, "uuid": "fd9e4201-4c63-4a1c-b59e-7fe98182eb7d", "comment": "Malware payload", "value": "354f6734367a7d6a530622e897ff1eb7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200142, "uuid": "c1eedc8a-f1b3-4046-b0f8-e8eb1070e5b1", "comment": "Malware payload", "value": "2dce9dedb545eb26a6222845e98dc3df51def2ba4cf271019f066a28ce05f2e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200142, "uuid": "23a50a69-1779-4d5d-9b98-95f99ca4070a", "comment": "Malware payload", "value": "ea6342254745543c8b238fc32d58aab5afbc6ee1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200142, "uuid": "4604eda0-b61f-4172-8c0a-bfe47c7104f9", "comment": "Malware payload", "value": "c873e9d735b8ab8729e8660a4773131df583a2ef6ca4ed0de731c32be4f7aa5a183e37e84d396e7d3e15128ed8a12bc8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200142, "uuid": "315ffbf2-d139-4c4a-b0fe-593c0f45f584", "value": "3DE229F1FD0B386B15BA40A3766304A7E9F8A093920070B87D9C845D2F7E64D57EB29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200142, "uuid": "1ea39795-f848-4d3e-b0b4-10ab7aafc3d6", "value": "384:UcFi/geP6w/i7bArSpKvxEAtOwQM2QJrLhzPQhjl3hJuD3DoNawQU:3QgeiwAbArSpKvZOzpQJVuXJuDzoQwQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200142, "uuid": "fdfd89b1-6efb-4a68-b799-28fdb28a796b", "value": 31430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200142, "uuid": "17ab843c-fc2c-4c2f-9130-5b871321ee17", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200142, "uuid": "8c6ac370-9c27-4822-983d-6b11486e1540", "value": "2dce9dedb545eb26a6222845e98dc3df51def2ba4cf271019f066a28ce05f2e7.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49374424-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217626, "uuid": "cc75a6e5-27d8-45df-8199-596d9acfd700", "comment": "Malware payload (Dridex)", "value": "1e7d63aca03368abd613a3dbb1c5d234", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217626, "uuid": "0e51d48b-109b-47ab-b037-5c97efbe5e8b", "comment": "Malware payload (Dridex)", "value": "2dcfedd21dcba38fd00ecc05993f9d0379e6cf49575a4674f31dc867fc4cd08f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217626, "uuid": "2b972bbd-6ebc-4e65-8208-2ebd3e2fca81", "comment": "Malware payload (Dridex)", "value": "19abaefc411c7b08599dab354bb46a572bdd47dc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217626, "uuid": "9bfddf1c-fbaa-43a3-aa33-de20bc543691", "comment": "Malware payload (Dridex)", "value": "b51623dce96f01da82559548557fa53b4c6d667ecdb19701a52819434d9e74d4d11b3d9552c190a56a201d5671482d52", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217626, "uuid": "da2ce0b6-60f4-443f-bb9f-f77bd679b0a7", "value": "2514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217626, "uuid": "454bee3b-f2cb-4d33-89ad-1ecb29445aff", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217626, "uuid": "da7fc9e6-0084-472f-88f9-451d7ea5e007", "value": "3072:popj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:upjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217626, "uuid": "82bc60f0-5bec-4120-bbcc-f4e1aaf57655", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217626, "uuid": "7a97b00d-b3a0-4d28-a0e1-04220e486bc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217626, "uuid": "44edfbe2-9a22-492c-a6bc-765b78c000d6", "value": "2dcfedd21dcba38fd00ecc05993f9d0379e6cf49575a4674f31dc867fc4cd08f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf83cba-926d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228261, "uuid": "5462e1e7-eb04-4ec1-9fb0-168a8db6446d", "comment": "Malware payload", "value": "c93d1bec606446c30adafb0257b8d7b5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228261, "uuid": "3d4c3d0f-633d-4bc7-b6bf-4d65dd0aad91", "comment": "Malware payload", "value": "2e296d8962c6664b3b79e07551629ee6273827dbb7bfe88e013abb1162a512fe", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228261, "uuid": "70334f4f-6863-422e-9687-0c65518f8228", "comment": "Malware payload", "value": "4043d33aaed86caf0ee62796ea5bdb139b288255", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228261, "uuid": "819d8baf-f0ee-4f23-9ce3-c91c48feffa4", "comment": "Malware payload", "value": "66da30028abdc000e61891d16a3ecb00627143b9157fab74c131ba0a60522d35cfe3311c86d1dc86634f6accbd6c67ed", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228261, "uuid": "93415863-b3be-40d9-a3b4-40f24be581cd", "value": "2E248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228261, "uuid": "593ff102-2f16-4893-88ce-07c71f0ce223", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228261, "uuid": "9db0b9b8-5a9c-4254-aaee-2e121a049e55", "value": "3072:t6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:toMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228261, "uuid": "93e81df6-7b26-493c-aa53-eeb098f97ff9", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228261, "uuid": "7005a1a0-5b4d-4a3c-8bee-df6f899eac2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228261, "uuid": "beb49cd5-dbc7-4d00-b7a1-3f231ceae3ad", "value": "2e296d8962c6664b3b79e07551629ee6273827dbb7bfe88e013abb1162a512fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc45049a-925f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617222597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222597, "uuid": "35d17832-f327-411e-89c1-0f22fa4bf8ce", "comment": "Malware payload", "value": "735796b1e684791d26ef19cea8f454fa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222597, "uuid": "5af48807-6274-40b2-ac1e-243329deddf1", "comment": "Malware payload", "value": "2e69efca11af096cdfa2285cceac56868afbf2720145f550af9f8061e4ce5ec1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222597, "uuid": "46033911-4245-4b3c-87e3-475defc2e4ff", "comment": "Malware payload", "value": "e2aacea099f9f30f03ed76f329b9b0120ab5d947", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222597, "uuid": "2ff52525-c4bd-4ec8-b010-cf77d741935f", "comment": "Malware payload", "value": "89a214e143dcb2dc1e3434ce8ef8336dcb9d708ce8e8bea6ffd4889de01ed05b287c458977ead83a959321698c522cf1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222597, "uuid": "e259edd4-ab55-44ca-8da9-b012eadcd8a1", "value": "A3248C5FE339F486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222597, "uuid": "45250358-f3d4-415a-a519-a36eb00c5d3f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222597, "uuid": "01ade43e-1a16-4343-97dd-240acb724ca7", "value": "3072:D6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:DoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222597, "uuid": "2b583063-c359-473d-b573-0a12977a655b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222597, "uuid": "1336beb2-6e36-4302-bab8-10adca68bc7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222597, "uuid": "f786d662-eb0a-4d3d-98ff-bb85ba1794e8", "value": "2e69efca11af096cdfa2285cceac56868afbf2720145f550af9f8061e4ce5ec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184c40b4-922e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617201223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201223, "uuid": "659b8081-8ac9-461a-9020-46487e6ec298", "comment": "Malware payload (Dridex)", "value": "6aab6b6b9ac07f33da6bbc301f9694f6", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201223, "uuid": "ca471b8a-d39e-4949-a9a8-a310ce16ee5a", "comment": "Malware payload (Dridex)", "value": "2e6a9b2c68fabcf47a2aee3ddd9fc8ca801202b87c4d5059b52de6e89c3b334f", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201223, "uuid": "8a84d27c-d500-46ee-b198-a65f5c7c230d", "comment": "Malware payload (Dridex)", "value": "76a84dbcc12623028d3553d2da2368728ef1bb60", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201223, "uuid": "c9f59cdf-f08b-489b-b56e-41b366d679ba", "comment": "Malware payload (Dridex)", "value": "3f88ead19780042386bfe3e024d300f338d11f46468cd83bcdfa5fd14ca0d281a2b71074e78280a2f30bf52a3832a71f", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201223, "uuid": "e553f4e4-8805-41da-aae5-6530aa406e5d", "value": "7384DF42EAD54431EB726F3808738B514BEF79D18E308CABA29C205D1F676D0567CB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201223, "uuid": "631427f9-ac70-4fb6-a1d6-8ed2875c92f4", "value": "f80d389dfa6eb310b9592775bddbb2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201223, "uuid": "bb04b92c-39ba-4177-a8e8-7b5b577ed404", "value": "6144:cCyziBGu+B0VlPM+iHlDx7YVUggVSkMObhe+UqN2oCh5pGGN+zT:LYiB06/iHlDx7YG7RTIZQFi5pNuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617201223, "uuid": "b52f2866-8cef-4217-be94-5605ca4b2266", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617201223, "uuid": "1bc37b7a-1996-4fb8-bea8-2998d48fca69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201223, "uuid": "0a3b17bc-bb1d-469f-89c0-cd5c0db66c85", "value": "2e6a9b2c68fabcf47a2aee3ddd9fc8ca801202b87c4d5059b52de6e89c3b334f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4824a8f5-91d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161360, "uuid": "20eaf2d4-9db9-4716-aeba-75f88d371303", "comment": "Malware payload (IcedID)", "value": "af4ec72c6b3af771bb133b14886724cc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161360, "uuid": "7873913d-dddf-4aaa-baa6-f78d36124419", "comment": "Malware payload (IcedID)", "value": "2e7e41708eab2cb298b0f32b99594f15895c0f1bf62aa3aa2d5ca58ed3762b7f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161360, "uuid": "b9956f42-f261-48bb-9cd4-94001aecf716", "comment": "Malware payload (IcedID)", "value": "b75a5b63e217fbcb964803689dd65716d14d94f5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161360, "uuid": "35d3e15e-8e26-4588-8fc9-74c0e3c792f0", "comment": "Malware payload (IcedID)", "value": "18b23edcb6cf8a5f44984a64d3fad95a8cb4383eda28290f96e0d59344c80e3346846901627f0f7fcdfb297b819d1573", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161360, "uuid": "2fab665f-21b9-4340-bf53-23fd21485adf", "value": "2DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161360, "uuid": "0494f61f-7bc2-4718-a81b-32d8ad911deb", "value": "3072:Y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:YzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161360, "uuid": "83eab4f2-dcb2-4948-b572-c62a7dae885e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161360, "uuid": "1c2395f8-a9a4-479a-bab2-3c3833e64936", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161360, "uuid": "ba0cb855-ad28-4501-98fe-3ada799ee87b", "value": "document-1355434274.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2687e363-9233-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617203395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203395, "uuid": "0acffb20-119e-45bd-9d36-07c24df64132", "comment": "Malware payload (IcedID)", "value": "2de95747397694bd6f1622f8530b1a10", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203395, "uuid": "ce561f3c-71ab-436f-b0ce-513c2b20653c", "comment": "Malware payload (IcedID)", "value": "2e8991853eb85e2da8fd99c3af4fcd9939671d3ce8a6592c1958339693b8a52c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203395, "uuid": "582a00f3-343f-42df-83eb-34df2dcc8e2b", "comment": "Malware payload (IcedID)", "value": "932e58b926c41d060490116e7d38823eefa6f427", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203395, "uuid": "c0acbb13-1905-48d0-84e3-4e544b0f1102", "comment": "Malware payload (IcedID)", "value": "d16efd9d4d676d330b5065fbc6c72658d4866bd360c1baa4638bacccdf7e1985b915f23af3e734c1b6a50ea1808aa927", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203395, "uuid": "e115988f-921a-4ad1-8e50-e2fa819a6f1b", "value": "01B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203395, "uuid": "ee3fce13-11c3-47d5-878a-56fce1b1c90a", "value": "3072:U2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:UqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203395, "uuid": "1fd36e60-aea6-42ac-9617-dab6462a2ba2", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203395, "uuid": "e4384a1e-aa88-42bf-b452-01bbb2391b25", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203395, "uuid": "3aa101ce-37d3-48ad-a50b-3b0aa8a58644", "value": "document-647030388.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8c1c8a-91fc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617179967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179967, "uuid": "7c03b0b4-e6c1-4dcd-be68-5046953243f0", "comment": "Malware payload", "value": "1d26f52d9e82e1ee81bffa05cb2f15f8", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179967, "uuid": "79ca2300-362d-4333-89e7-244a279f80d7", "comment": "Malware payload", "value": "2ec9acad3b62e878363373e00d4b5e2d7db85644596ba8c197610cf548cf96c4", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179967, "uuid": "b9f6a51b-e866-4ab2-b7b9-0ee6d5f3bce1", "comment": "Malware payload", "value": "357c80c59d0c1da34146911151cbe33f8fd94035", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179967, "uuid": "4bc35bf2-f956-40a0-9427-0c3b87e2dca4", "comment": "Malware payload", "value": "68d6bedf7cf5f3174deb392b4dcce1380fe5d3db4391f3b94c4699de08c704a13025db98afd1f8afbd99a890ff63c9de", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false }, { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179967, "uuid": "8fc907c7-d041-4dff-8b68-7638c6b330e3", "value": "9A341365C001FF27C2B2697090E0F2C4AEAF9581D1ADA7527265D3CD848589392EEFB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179967, "uuid": "95e44f8e-3268-4da2-b785-8e7024f76031", "value": "6144:lu7amYwmgq61o1MEsW6awIzODLmR7SytCm:goUq61I6jIiDLmR7Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617179967, "uuid": "fd1612bd-eb77-439e-b7f3-ec9924729b72", "value": 246510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617179967, "uuid": "263d5909-71cd-49e4-ad00-d7839ba088e3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179967, "uuid": "d6e749a5-8313-493e-b9d2-f6b268022160", "value": "scan-100218.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838f006e-91e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617171339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171339, "uuid": "89016400-b795-438d-846f-491768513c1d", "comment": "Malware payload (Formbook)", "value": "26a670d0eb62d6e930c5da2534c5f6bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171339, "uuid": "681d4674-4853-4fad-927a-249ddc989893", "comment": "Malware payload (Formbook)", "value": "2ed93888e37b849a2afdb770d28ef797c0e6eaa467d1b578be6b3d93cd2d6849", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171339, "uuid": "fe227eec-1f66-4fd5-825d-9aa469f27e6e", "comment": "Malware payload (Formbook)", "value": "75a669ab6f26f99d39dcb5a478e9c6ac3e4ce74b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171339, "uuid": "34236d13-803e-4bcb-a6ed-5ff88d0d624b", "comment": "Malware payload (Formbook)", "value": "0b6b5fd48269ccb07ee28b3fa9b3d9df80ee295014efbdd7e8914fe4d02fa9a7d9f03f38ffd67cdae5438238a9ad479d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171339, "uuid": "dcce5ca2-af18-4771-8c3f-f0661b632dcd", "value": "B2D5337DABDB8F2AC40B09F5E09F8D2984636D1678840C40365CB6313737277AE97A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171339, "uuid": "6a45683b-21f8-4f6d-953c-ae94c2acc76e", "value": "49152:ox+OwZAyxcGLAS1nWLBZEwV2Xjg03QceWLRQv7Y0VZnZ7eyGxV7dS:Y+bxc81WLbEwej3eWLRQv79VZZ7z6fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171339, "uuid": "5b325cf4-7d09-42dd-b5fc-6f9aa826d491", "value": 2775040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171339, "uuid": "444d465a-61be-4972-9209-6cbb74230d5d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171339, "uuid": "ade26cd7-5b75-4212-a6d1-7942059a71c0", "value": "Original Invoice-COAU7230734290.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702459b3-91d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160998, "uuid": "dacbc256-ca86-4df7-8021-9c5de5bba7d8", "comment": "Malware payload (IcedID)", "value": "9ae3758704d426536eff808046df48af", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160998, "uuid": "4df85a72-829b-493c-aa66-0970b2d9fb52", "comment": "Malware payload (IcedID)", "value": "2effbfb88a2c2820fc490d9f87a5278ec3236fdef9bd48bd61ab62d2e416f9eb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160998, "uuid": "d5750a05-3a40-45a6-bd18-7ebba2fb7b3a", "comment": "Malware payload (IcedID)", "value": "5e4e6f7d19f103f6441c8379fe8036f5cda7a301", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160998, "uuid": "959e266d-bd92-43d0-9e72-506611b0e51d", "comment": "Malware payload (IcedID)", "value": "a4a3d5af2d80796445138038fecb353aac5de2523745b18f09e9bcfcca3efa7d61f515054c766f7849b83540e6ff8624", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160998, "uuid": "833ebacb-dafa-4e57-b964-39c4bd6b5721", "value": "5AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160998, "uuid": "bc413d2f-cb0d-4792-91c4-9658055fee40", "value": "3072:e2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ezxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160998, "uuid": "2438e623-fe76-438e-b95a-c4cb4e2f7146", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160998, "uuid": "73fbb8e9-8279-4505-b30d-373f9f711c91", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160998, "uuid": "84028c62-621d-4382-8eb1-ebdc2588b591", "value": "document-453432369.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c9558b-926b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617227528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227528, "uuid": "d2b01f1c-9e35-47e3-a896-96563dfc1605", "comment": "Malware payload", "value": "d9a8fda01e19de41b5b99ffbef490ab8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227528, "uuid": "425c7c0a-7e6e-46ee-bcca-ef5d4f4b4bf5", "comment": "Malware payload", "value": "2f12f592f5fc8ece206baf4e6470890a44887ee339bcbaff08438ee89bc8a041", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227528, "uuid": "f093ae26-88d2-4ad4-aab0-04de725255b7", "comment": "Malware payload", "value": "5bad305fc9199b81dd52a42d0055d38f07756749", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227528, "uuid": "456cd6dc-41b5-4893-be35-7e2f13c87691", "comment": "Malware payload", "value": "09d815d87a66be211ec153ecff60e6ab7ab64e61c65c9094cb54e5432b7f4a0b8bf9f4e84560796d1dae5435c7d0787b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227528, "uuid": "72aa3cf1-c5ed-4c83-9482-447e4656d7c8", "value": "22248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227528, "uuid": "0b7c9337-51fd-4616-b0ce-ac78d74b8464", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227528, "uuid": "72e6745c-75ba-4c1d-b3ec-9de72dfe7d58", "value": "3072:+6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:+oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617227528, "uuid": "27fc39cb-dbae-4192-a7fe-53bab71564c7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617227528, "uuid": "c26b5c81-82a8-4459-9a00-dd0dd2609683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227528, "uuid": "41321cd3-2ed7-4c6c-adef-60bcce8364ce", "value": "2f12f592f5fc8ece206baf4e6470890a44887ee339bcbaff08438ee89bc8a041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40620e52-91d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161347, "uuid": "0b251d7c-48dc-4b0a-bb67-4b248c16197d", "comment": "Malware payload (IcedID)", "value": "a2e136258d449e4b0a9f73b09e209d8f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161347, "uuid": "35d8a339-d788-4dd8-be55-7b9d875f2b79", "comment": "Malware payload (IcedID)", "value": "2f55b3203831d7ae1e2f7640eb168e0059120a50a926896a8e029208c58368e8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161347, "uuid": "0fff86f1-8942-4097-a3ca-4620a92555e5", "comment": "Malware payload (IcedID)", "value": "4c35ec1abde22e622bcd160577883511cee3d975", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161347, "uuid": "450feebf-cfd8-45f0-8c45-bdd2b36b5c28", "comment": "Malware payload (IcedID)", "value": "9a6d61949e8af8af741144b20ea4ccb601f3f95b9d0924f895b8f8cdbbc89181f41e3a53c153caf2d2cb4c9614a87eb1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161347, "uuid": "12b8aa61-c864-4158-b717-3c0ff7c18796", "value": "54B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161347, "uuid": "82f1e46b-40de-4f09-8033-ca81c8f892e4", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161347, "uuid": "2a676a53-99a8-4961-8164-151a55b8c246", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161347, "uuid": "d21b443e-5a37-466d-9320-f4fcc8793799", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161347, "uuid": "d6d41c79-4d54-4a12-943e-98420810b7ef", "value": "document-1706683968.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487f7363-9278-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617233087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617233087, "uuid": "8dff8a23-a361-4d30-9b1c-707b1b038456", "comment": "Malware payload", "value": "a422cde63ff45a3af89e5c152d700415", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617233087, "uuid": "19790295-570e-4e91-93fb-94d0d48c1bde", "comment": "Malware payload", "value": "2f56ec13694d278c8f443a406ec459217297deab34ac1e8f49a83291fb413ab8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617233087, "uuid": "51025004-d3f6-464f-b7dc-9a2e09a552bb", "comment": "Malware payload", "value": "14e43d255663168b1a3c78ff39a0360b4c7758b2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617233087, "uuid": "6c48e52c-1625-43a1-aa81-d7f3df42e877", "comment": "Malware payload", "value": "8f2a68c8200c4321aff363c9acaf4fcb4415fb790fb9ee094384e47259e84a5a63940cd64a6a98567509b3bc43937a68", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617233087, "uuid": "e15bd41b-d5fb-42df-8283-a7a9f7f02768", "value": "6F14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617233087, "uuid": "2ab9d5ee-5c34-4efa-b508-8619061e25b0", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617233087, "uuid": "d728f693-e8b1-4ef3-a50b-3a5b71f8c4eb", "value": "3072:C1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:6i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617233087, "uuid": "4413e3cb-5a5f-4d29-9421-e9f30074f14a", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617233087, "uuid": "44988db9-683c-4223-bf58-6171cea4c5e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617233087, "uuid": "96b81d80-19fe-452a-bd55-a8f9e99b48d2", "value": "2f56ec13694d278c8f443a406ec459217297deab34ac1e8f49a83291fb413ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78938011-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223719, "uuid": "02355074-7fb4-4fde-8bc6-e82cbf081509", "comment": "Malware payload (Dridex)", "value": "62903639925ea00b31925b445654a539", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223719, "uuid": "4781ed68-d1cc-4955-8fae-aca5bf7b40c2", "comment": "Malware payload (Dridex)", "value": "2f593b4353111b7f1ec331429be98e38930c1e9380b419758ce63c0dffd518be", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223719, "uuid": "1c5d95db-b150-4a2e-aef8-8ed8e3beb62d", "comment": "Malware payload (Dridex)", "value": "4fedfda3341d8423b1371a48d9d36f2d525d2d5a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223719, "uuid": "7fc6e690-f9f6-40a9-b84d-9e82e45e3547", "comment": "Malware payload (Dridex)", "value": "9f7645bcc8a2480f6b1095558d23fb43a611e94d80ce8429ce39bbf644317c1ef3c45df3e929c9a4a3e639464d23df4d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223719, "uuid": "46854f95-97d3-4a92-9e2c-9f394122065f", "value": "A3248C5FE339E486FAE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223719, "uuid": "a8c38d71-cb58-48c8-9422-ebfdbf771c02", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223719, "uuid": "b09bb91c-dfe8-4480-bf18-b02ef805d6fb", "value": "3072:w6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:woMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223719, "uuid": "a2b54977-b687-427a-a3b3-6856b241b208", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223719, "uuid": "ea0cb297-f1de-417d-b207-7d72f61412b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223719, "uuid": "f93ca402-4ac0-44be-8ca1-262e9e2c2300", "value": "2f593b4353111b7f1ec331429be98e38930c1e9380b419758ce63c0dffd518be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efe4b73-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204697, "uuid": "442fa5d2-5baf-44e9-8437-c882529e03fe", "comment": "Malware payload (IcedID)", "value": "dd41f6b73e7ee8f705bb7b3712f92199", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204697, "uuid": "c7763e5e-6be3-4fd2-b4e6-96cf5cebbb3c", "comment": "Malware payload (IcedID)", "value": "2f9308688d2a28c17c69c0f2168d4dff03fc7e41004d101aa0ad5f5eb72c0418", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204697, "uuid": "a6bb1dee-5c06-4f21-a9c0-c3dbf7742a79", "comment": "Malware payload (IcedID)", "value": "116d41cb9cc91521f133c04f87a938ac0b456f1c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204697, "uuid": "e904e3ae-5fc9-4774-af39-9c2c51e6de5e", "comment": "Malware payload (IcedID)", "value": "017ff468ac9e4c794cc4cdcb4239ec5640521cf37f0c344470b6c4ab8b9ba13d02325e820c307a107259a92f8fe50cb7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204697, "uuid": "e11b5cad-2068-4785-9525-7781ffdd81de", "value": "4AB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204697, "uuid": "fca63ccb-cc64-4902-92e2-91351954a521", "value": "3072:s2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:sqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204697, "uuid": "81326326-49e2-4ef6-8eb9-ce916c8c9ee2", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204697, "uuid": "6f35f88f-91a1-4db3-9f2a-5d9cd36527fe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204697, "uuid": "8a545c33-80a2-4b5e-be7e-10cc640d1c41", "value": "document-1475007806.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c353fed-922e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617201257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201257, "uuid": "58c0554c-b78c-4175-83b5-b8513c76af7f", "comment": "Malware payload (Dridex)", "value": "df5d80b77f4c8cb272aff888d554a000", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201257, "uuid": "a506941b-f241-4f11-a6ae-e8c2611c77a6", "comment": "Malware payload (Dridex)", "value": "2f956a58f051e34a280d84a36e8589fea9a9b52d3973ce7c4af5961b8d4e1d96", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201257, "uuid": "a1cc9716-2c78-41eb-ae31-fae259dacfca", "comment": "Malware payload (Dridex)", "value": "7180b2fb5396a12e3d40b00c43ef8934c5754f87", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201257, "uuid": "7753fb88-c1a4-47da-853a-1ecd6a948c2c", "comment": "Malware payload (Dridex)", "value": "fb4f95ed80912b931d6c92f8ae12b2c093863cf827b1873a7face1ff75b693ac5901fb4ac5e4a0b5f081fe14b79ba1d5", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201257, "uuid": "f1a77dfc-be1b-461d-8e1c-10030c44d611", "value": "2B84DF42EAD54431EB726F3808738B514BEF79D18E308CABA29C205D1F676D0567CB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201257, "uuid": "a1a3ad9a-4e45-4049-b5dc-089b60fecff2", "value": "f80d389dfa6eb310b9592775bddbb2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201257, "uuid": "647e51d2-556c-4825-a199-27b095558106", "value": "6144:BCyzitGu+B0VlPM+iHlDx7YVUggVSkMObhe+UqN2oCh5pGCN+zT:EYit06/iHlDx7YG7RTIZQFi5pRuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617201257, "uuid": "4e212506-e05f-428a-9ff7-8dc371f9f6c1", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617201257, "uuid": "63e54e9b-ae7c-4aa2-b725-904e3226f167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201257, "uuid": "07919d65-09b7-4310-ad79-b99920803ae7", "value": "2f956a58f051e34a280d84a36e8589fea9a9b52d3973ce7c4af5961b8d4e1d96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042b682a-926b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617227389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227389, "uuid": "076da271-11da-41e6-bf3e-cd2d05e78ca8", "comment": "Malware payload", "value": "34de50f22d69f142e516055590556a14", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227389, "uuid": "31855be8-7d69-4146-a7f5-7835f28f652c", "comment": "Malware payload", "value": "2fb5766af3d68c210e62518263b2f29ca4c50100c99b6979c3d0e19f05af6a39", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227389, "uuid": "759379b6-fc38-4f41-a3a5-c3f7e6d55cbe", "comment": "Malware payload", "value": "23df3df9c592d134d638f6375bb6be8088a06254", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227389, "uuid": "6179832f-7d9d-4dd1-8d39-f7c9b3ea0362", "comment": "Malware payload", "value": "16fab7c6a697d2406fef747973a8c01088ef233e49ca43ddd50922068689306e374f139a831b37ce01f9e4006ff6f830", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227389, "uuid": "630cda2a-9f78-4e46-b34a-7e1c481ab189", "value": "6E21FC382AC381608BD7C305BE0B852395ADA3C77280EFCB25E070A050EF446CB71BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227389, "uuid": "acfba4db-36a6-444d-b1e8-377adc4d45f8", "value": "24:AD62diGuVPICP5rXmDTjYZM4AxRxV2FIb3pArWdKBhEOGX0Y5TaXTTaXTT1a4ePU:m7uVBkjaIb3UWQrEtkYza4ZHKHpNzdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617227389, "uuid": "13669855-07ea-4d76-8567-74a3e47bf448", "value": 1119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617227389, "uuid": "f68879a5-0af4-477b-9c8d-694fded58c4b", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227389, "uuid": "974c0319-7dcb-4704-812e-09cc89e3dbd2", "value": "2fb5766af3d68c210e62518263b2f29ca4c50100c99b6979c3d0e19f05af6a39.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05d98d9-9267-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226067, "uuid": "c97d12ae-bd74-407b-ac80-1358786d5751", "comment": "Malware payload", "value": "9f48ee1bf2e3c79672074916503d5c41", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226067, "uuid": "5ace8338-f808-46fa-a721-898f5d1fcd00", "comment": "Malware payload", "value": "2fcd7906884108f7a5b56b1469d9e4bb4ef9e0a7650688a4582dccbbfde53ade", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226067, "uuid": "0c19eb7e-2802-4b16-a8d5-886a92a01009", "comment": "Malware payload", "value": "78d3e803a2fd9b8d9670e6bcf827f235db3b9842", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226067, "uuid": "e58259ab-492f-4656-a7dc-8f7d1271f8ab", "comment": "Malware payload", "value": "17f84d59dab2953a339b0f98ee24eba7da7abbac6146a6bcd4f4a1d8254cc0019886f2aef496fbdf4d7dcda60b69a74a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226067, "uuid": "02bda0c3-6e98-4a52-8122-589d1f8b72ce", "value": "3D248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226067, "uuid": "bf9954da-9d5d-45d9-b0e7-d849b17bdb42", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226067, "uuid": "dd8f6764-63c0-4a65-9f4b-c8054b6163ac", "value": "3072:36TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:3oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226067, "uuid": "28e51d2d-f0b8-4f61-9cf6-4d76c02ad993", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226067, "uuid": "ca0b2b23-fc58-405c-a71c-532ae475254d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226067, "uuid": "6298fe1c-84ce-40b8-ae9a-2c3a395c736c", "value": "2fcd7906884108f7a5b56b1469d9e4bb4ef9e0a7650688a4582dccbbfde53ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc9c094-91d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161343, "uuid": "d5ea1822-c071-4e24-a251-701dbc86175b", "comment": "Malware payload (IcedID)", "value": "a4b4e9d99f1dd3e185dd0bdc157a5bae", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161343, "uuid": "ba676045-9d00-4a11-946a-e22672d6d1c2", "comment": "Malware payload (IcedID)", "value": "2fd471e0c9dbe439fd2d6e2bd85bf8d6e3852d051058bf6aa800749d547549d8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161343, "uuid": "d7a1e4f9-5199-4d66-8274-0b4dc133a5c1", "comment": "Malware payload (IcedID)", "value": "462553964082842897fb23aa05b2e1b76281ebbc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161343, "uuid": "613fc44a-a3b7-417b-aee4-7088a468682c", "comment": "Malware payload (IcedID)", "value": "88df7543419a7251b5a2c0017ee4524e024294c1e98d6afef52d1d720a208e274029b16e7a7ab7a2cab69fcc2cc72c3d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161343, "uuid": "8ed0aaae-a2bb-4f0c-882d-23d966f9955a", "value": "BFB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161343, "uuid": "32b3d6b8-c55e-4a9a-9d09-c1d21b8f611a", "value": "3072:82CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:8zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161343, "uuid": "723c6e25-c60f-44cd-bc91-ad635391fafe", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161343, "uuid": "475d8115-0eee-4d0b-b046-530c39b1d471", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161343, "uuid": "70433d0a-712d-4631-bab3-1f662ca322ee", "value": "document-530268537.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245166c1-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204680, "uuid": "817b66d9-7630-404b-8617-99b8cd8dc5e8", "comment": "Malware payload (IcedID)", "value": "6e16f949b93e65b390d80f8055751c55", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204680, "uuid": "39f68c27-0840-434d-9a30-12e3e293ca04", "comment": "Malware payload (IcedID)", "value": "2fdec89863898d06740597a2437d04c27d7033b09e8555f04fcfc875d89bc249", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204680, "uuid": "7f7c1b56-9f35-49d8-ad1d-02f8043ae67d", "comment": "Malware payload (IcedID)", "value": "4eded3bb28b807b27e4fc7b99a8a55dc24767665", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204680, "uuid": "cc5505ac-d200-44d7-a959-7ca661219adb", "comment": "Malware payload (IcedID)", "value": "f1fc3a2420cd7287016e1e7b906995149eec380aa227ddb7e81b5c83d9a4b42a75215418d63f05a79efeff4dede1a0b9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204680, "uuid": "02baec25-d715-4f0e-908f-670c152e527b", "value": "0FB3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204680, "uuid": "f9b165e7-0e15-4b36-8f41-d27930d1bc84", "value": "3072:u2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:uqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204680, "uuid": "7b3957fb-d59c-4030-a59e-b2766d27ab6e", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204680, "uuid": "05d53306-db59-4250-a505-2d2836fb3fca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204680, "uuid": "5f8424bf-cbe3-455c-a2b6-35ff12f9dc93", "value": "document-1039329114.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200028bb-921f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617194794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194794, "uuid": "ec5452a3-3885-4665-8207-33dd42bd2b84", "comment": "Malware payload (Dridex)", "value": "48c0a51d7e05e74f6ab6e344428aa64d", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194794, "uuid": "accf82d4-68f4-480d-806f-5ae0ec0579c9", "comment": "Malware payload (Dridex)", "value": "309c98cfae08598b25b5815a1191e156b61cb05472187a53e588ec48a6933142", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194794, "uuid": "57f4bce6-1e9b-43e3-850b-e892080dae27", "comment": "Malware payload (Dridex)", "value": "0f2395636934de06e93293898217a148c5b7da0c", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194794, "uuid": "fe519fc6-22bb-4862-a85c-7fa5bb70f651", "comment": "Malware payload (Dridex)", "value": "4aa22d05918b39f6759503a5fc0aa8be242303f0b703a2544b918f7502d0a9784313e5dffffe64deee462bd0cde76944", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194794, "uuid": "d94e5c6e-458c-4e72-940d-3f86958a6079", "value": "44C49E016962A039E8B386BE89FB564D46AEBD50073464DBB3CC985D1F6B6E17F30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194794, "uuid": "4c23698f-a4c4-48bc-b260-e84c3a4f7000", "value": "c481640479b1f140aa694701dbc594d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194794, "uuid": "134b2b45-664e-4619-bc97-c4df45be88cf", "value": "12288:kJfvOjRSY7eIDiMPhdLXhnkSx7lCUjg6DlHk+KAwV:eudrBraynDVk+SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617194794, "uuid": "ff5cc45c-c07a-4093-86bd-a68b432041fb", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617194794, "uuid": "c21a63c9-b9bd-4b47-80ea-96482d072d3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194794, "uuid": "b12e8038-8119-419b-a855-a64404f85bbb", "value": "309c98cfae08598b25b5815a1191e156b61cb05472187a53e588ec48a6933142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7dd459-922c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617200504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200504, "uuid": "dd3d3041-ffd6-4895-b95d-339ace830ad6", "comment": "Malware payload (IcedID)", "value": "2624da46a0f309c72b5c6767de14782b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200504, "uuid": "1062e62e-edd8-47fb-bc06-07e1a0d88c41", "comment": "Malware payload (IcedID)", "value": "30fd1067c91deb081444184b313d6e1fe6e8ddfaaf43006ded099ae27e740c8c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200504, "uuid": "38be3f8b-d76c-4b4a-8f94-3222c1218773", "comment": "Malware payload (IcedID)", "value": "04ff411e9c8751bee3684c6f8ac2bd9da7d78450", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200504, "uuid": "2a27c792-9d11-4f57-9ea5-3d8d07253fb2", "comment": "Malware payload (IcedID)", "value": "89d317586f0af816a5b55a545764a4b150b0934cfb66cfc923a58d31499ac2c3b9d527e41a532f093291098a36ef454e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200504, "uuid": "89c6ccae-1906-44a2-8b8e-f22195bc306d", "value": "51B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200504, "uuid": "8b872a0f-211b-41b9-9e30-0ca72110942b", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200504, "uuid": "2e8f4fdf-5ebb-4846-9496-44fda78547c4", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200504, "uuid": "dcfcd160-bbcd-41fb-bb04-81241447603b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200504, "uuid": "14429c58-1ccc-43ca-86cd-c4a075ba95be", "value": "document-880880332.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be8ca80-9220-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617195378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195378, "uuid": "2cdefc80-9dd5-4941-b936-e17bf674a562", "comment": "Malware payload (RedLineStealer)", "value": "275d2ffdc7bfd464f9759a6d0a5c0c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195378, "uuid": "7e7d89b1-d5ed-444d-87a8-d8aab9e807dd", "comment": "Malware payload (RedLineStealer)", "value": "310339bcc4c81ba2d5bd40e292b4855cf8c7d6345db36d5ab65c9bcea4dad35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195378, "uuid": "490344af-3f0d-4653-8adc-1485102a6fce", "comment": "Malware payload (RedLineStealer)", "value": "28afed674677c10a874db25dcf64fc64952af4f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195378, "uuid": "d05ed584-7bfa-47bb-a92e-3a39f6b6eefe", "comment": "Malware payload (RedLineStealer)", "value": "1388abe6ac19322f885791c6e307cfea3e6f8d31a5b5b739a052fb2cbcc76a0b24a9f311628aebe33dff86ef6f56490c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195378, "uuid": "bfdc36fe-64ea-4881-bffa-b8bd8672327f", "value": "3364E000B6E5C073D59649340821D2A55A36FCB15F399ACB3BD43F7A6A762D18B3B383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195378, "uuid": "135d4662-249b-4b20-a923-f25c22fe5108", "value": "baf6552e1c7923d039841ba11b7a0d4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195378, "uuid": "e0eb03be-3f2e-4bc6-9a12-2d764cd7ee36", "value": "6144:IdCcqcZoTLWar9WiKImOQvIaVmxDYrSv9d5nJQhw518xT:PcqSoTvr92V4xe2dk/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195378, "uuid": "0d284816-1f65-41b5-a610-84ea6ffdd962", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195378, "uuid": "77d2d59d-e052-4aaf-8873-f9603ae84ed9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195378, "uuid": "75720fab-ccd4-48b2-90b2-3ad743660c53", "value": "275d2ffdc7bfd464f9759a6d0a5c0c7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454f693e-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617213325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213325, "uuid": "9291a02d-0582-45c3-8248-4847f1cea9d1", "comment": "Malware payload (IcedID)", "value": "5177446bc45ae3cfc6b66365ed59edc8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213325, "uuid": "83860345-5586-47ae-bd48-80ada5da9362", "comment": "Malware payload (IcedID)", "value": "316896f1eed62bb6c7ae321a579763a3dcf0591894a4ba545ec46a0017d3f0f0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213325, "uuid": "49f1453f-8a2e-4d94-a9b4-e76bc7044176", "comment": "Malware payload (IcedID)", "value": "7609f99ccbf63947278babce53aba42a68db8b22", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213325, "uuid": "640a34e1-4091-4b3b-a5bc-0d70aaa93a34", "comment": "Malware payload (IcedID)", "value": "907cdd4db9ed0157ddf1b96ad53eea0ae77e2693022c4018226e70e8b7f93acb2835ceaa7a2f45d73a0c05bb5acb5e21", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213325, "uuid": "9696c8f8-a96a-4f1b-8715-fbb53b2e0190", "value": "CAB3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213325, "uuid": "a51758d6-63ed-438a-a349-9ed4957e3ea3", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213325, "uuid": "fb70a979-06d0-4bc4-afdc-c0c5d98847c3", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213325, "uuid": "8ba97fb1-d44e-4798-a04d-96aa0a35c5bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213325, "uuid": "95aa604b-9fda-4a44-a2b8-604071001291", "value": "document-1757223404.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c152ad2d-91d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162852, "uuid": "5465ca8d-beaa-4ac5-88fa-5a014611ec18", "comment": "Malware payload (IcedID)", "value": "e12c4d424c66b2a22492cf94a29f8bdc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162852, "uuid": "41b7b2b6-b800-4eb9-9280-b080414adc4e", "comment": "Malware payload (IcedID)", "value": "319b6112cbe36b7602b84f77c55d1efbca610f1cc30686c151cc30a5adb7a785", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162852, "uuid": "13e01137-62a5-4680-a495-6fb237862d97", "comment": "Malware payload (IcedID)", "value": "af43db2e5ec2505736e0a391527b3d58cad70c15", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162852, "uuid": "b1939ed2-6bd9-49f8-8ca0-561b9b57ac07", "comment": "Malware payload (IcedID)", "value": "ba1b71ab8271bdccee7e37acba2171fb16c909e74360de66bd4eef1d8fed2cd8772f4b77a0e38a2af7248e151537a301", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162852, "uuid": "9c9bd78b-d313-4005-a20c-4d3bbfdb426d", "value": "40B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162852, "uuid": "89e300ad-356e-444f-b0ac-a6e180405935", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162852, "uuid": "4fe2c47b-130b-4635-9dc6-50db6edd98ec", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162852, "uuid": "1492dc1e-8edf-46aa-9eef-bc1b0b315670", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162852, "uuid": "60cbdad5-37df-4436-814d-0a0f6f0b7cb9", "value": "document-963007805.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37e563a-9220-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617195524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195524, "uuid": "6b9f936c-5b73-4e44-b7e6-bb759b78ee22", "comment": "Malware payload (AgentTesla)", "value": "603408bca69cade70664ba1789fcaaba", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195524, "uuid": "e72241c4-c739-4b6a-90cf-2121fe13f1ae", "comment": "Malware payload (AgentTesla)", "value": "31c8fad8b1d519328a073534d6ee5be43e9c47e2e6a8d258bc7ae252caeb6755", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195524, "uuid": "e1fc278f-244e-4ebc-a2b6-dd045457486d", "comment": "Malware payload (AgentTesla)", "value": "506962a5b48aa8bad581dbee83bbd7a06365ff52", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195524, "uuid": "68ee8ba1-c95c-45e5-8ca0-0e2d2dfc630d", "comment": "Malware payload (AgentTesla)", "value": "937ee9959cec5e11f702e02efa18f1c5dc5e36b5b5f618f42a44e517dbabd9795ea0a170c01ded3c931989882ecaa447", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195524, "uuid": "6cc2e1a5-8f89-45db-bf2f-bdca8a791876", "value": "3322D02BF5B062D5F12A3272DCDB9F1D2B2E24BB245EF7463844885B61D14ECE8840BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195524, "uuid": "1ab1dfbc-2774-4915-a6ba-8ace674684a1", "value": "192:12lxGnEWSX2h2nlaFnysRmZgyfmfU8OXKUX8ptVKb1H9SDWyMNlLU1wXge:QqSPnIndHfUdXKUMFKbt9SNMNlnge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195524, "uuid": "181fb0c1-5f4d-464f-b15c-13ae7cddc91b", "value": 10793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195524, "uuid": "319ce940-e088-4869-8846-36703b859c02", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195524, "uuid": "746003e8-a2d8-418e-8a09-96b5c106a7f6", "value": "Inv-254345.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4bee27-91c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157935, "uuid": "1cfca3d0-d761-4ac3-97c5-01da0efe6c30", "comment": "Malware payload (IcedID)", "value": "372ca8a5e0fa432545fc372302062c94", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157935, "uuid": "6981e884-3706-40c0-bd66-39f6cbd9a2ad", "comment": "Malware payload (IcedID)", "value": "31f2d2a281d259a20442f320117de6d89ca7265cb6e64e6d45df21acef871914", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157935, "uuid": "6f24399f-cbb2-43b6-a785-039ae4c5c0d6", "comment": "Malware payload (IcedID)", "value": "6b98001f565e5993d09ce7384da78f5544f3d27c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157935, "uuid": "3fe3dd86-500a-45fe-8411-ba59268d6b47", "comment": "Malware payload (IcedID)", "value": "b6842cde3f4a23cd2552529511d2d2ea7369f40f61656d11a446d9b1ec636214b466a2d0388cc16a0e559b8ad7622e0e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157935, "uuid": "e32c32f1-7635-4ddc-8740-2971ce18e360", "value": "8EB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157935, "uuid": "a516917e-e4b3-4dfa-a5ec-aa329e2715cf", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157935, "uuid": "1bbb33d9-6c02-41d2-af18-ce68b726ae5a", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157935, "uuid": "e05d22b8-1eae-44c8-b32f-eb68a1457c0d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157935, "uuid": "9b932fcc-1270-4b8d-81c7-551624ddc903", "value": "document-502167278.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f8f869-9235-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204364, "uuid": "83a2f995-0d9a-4dc0-b978-f11dffd999c8", "comment": "Malware payload (IcedID)", "value": "5130961a15eb18a58dc74e2d0877598b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204364, "uuid": "84843c06-6072-4244-8415-03498657c119", "comment": "Malware payload (IcedID)", "value": "31f55b038f91ec12464045507d24ff1eebfbb0e7e3a7b8fde14861c89e5df570", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204364, "uuid": "ab2a19fa-b8e5-403b-a0e5-010abf61d80a", "comment": "Malware payload (IcedID)", "value": "4591fe7c73717790cfaafec70876ef3ec9159bb9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204364, "uuid": "b7cdb96f-89a5-4152-a0d3-9b140863b51e", "comment": "Malware payload (IcedID)", "value": "286588070af56a047f7373cef5ead02a90be2004a4f86763059706c18ac83b2e8de60ac97ee495d211b24426c4c48ab4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204364, "uuid": "c3973d2e-7ddd-47ca-808e-215c91d9b2b4", "value": "50B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204364, "uuid": "c3f95990-4e8f-4790-8591-66cd90418aa7", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204364, "uuid": "7f53a93e-83a8-40d7-9aa1-48a7fa93544a", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204364, "uuid": "6b539f50-646d-4e61-84de-c7bc75d8b069", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204364, "uuid": "45af0988-9bcc-46fe-8c98-f9055cb0e48c", "value": "document-1600184074.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde6f44b-926d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228613, "uuid": "f6befe48-4085-48ce-b10b-2ed574d3fddb", "comment": "Malware payload", "value": "3f2cb65dc54afb042b2063cdcb8a3983", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228613, "uuid": "175fcab1-d351-4265-92ec-c9c64d16ad40", "comment": "Malware payload", "value": "31f6dbee56030df62a593e0a7ed450dff7f0c32148db50582114689964d729ca", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228613, "uuid": "bf700eb1-a7ed-49d9-b40c-be4c2d3b92a4", "comment": "Malware payload", "value": "56c338686803bb6b2955bbbc6e0fb005b3e9a481", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228613, "uuid": "9e983fe2-cb1a-4e17-9708-04ed5e92b0fc", "comment": "Malware payload", "value": "8dba0b8608cea85a20b4632208b8c971a46132ba1d9ed17a95d339f4ae85e359658efc7770eb8caad1dbf21a64e3800c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228613, "uuid": "b0fc7a29-6eaf-4967-bffa-3d1dffab221b", "value": "06248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228613, "uuid": "335a8ec8-1602-4c2e-98a0-66a9b9cb5bed", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228613, "uuid": "454ce735-a6d3-4f68-aacb-e1ff4cde4e05", "value": "3072:t6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:toMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228613, "uuid": "562d6b41-5011-41de-8045-70046e37f4fd", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228613, "uuid": "62f3815f-4090-4393-845e-43cf5f32f1d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228613, "uuid": "432c45c4-7f2d-4c7b-bffd-53e57b22e5e8", "value": "31f6dbee56030df62a593e0a7ed450dff7f0c32148db50582114689964d729ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db9f1d8-91fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617179784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179784, "uuid": "cb767f6c-b439-45a1-89fd-2d9e97181265", "comment": "Malware payload (Loki)", "value": "be9f8e378141e565df399024d8fe2bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179784, "uuid": "703fdef6-11e0-4d2d-a62f-d4dec2b3d4a5", "comment": "Malware payload (Loki)", "value": "324a4dbff1b19e43b9d92edde3a316e391a8d1e7ed685fb8633984b4f1b5ac6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179784, "uuid": "9f5b1510-8e83-4d4b-b45f-ab08797f1443", "comment": "Malware payload (Loki)", "value": "cb2d110a00a427bda2bf6313c4f67e30aa32ff1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179784, "uuid": "183d516e-912b-49b5-9486-9a57cc46b40c", "comment": "Malware payload (Loki)", "value": "152479e9785e4fb7ffdfa156948edcb2018cf4aed6fd5929d0b55aa74b78c33c5f74c232170c6a54eef70cdce6009e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179784, "uuid": "38f9abc0-29b9-4a47-92af-0e15908dd33c", "value": "E6F3026BB6E000D7E918463011B7D722F37BB7042963181F2BB41FE63478583AB566AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179784, "uuid": "05ece73d-421f-46a9-9353-2db8efebed64", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179784, "uuid": "9d75f971-a2fc-4b6d-929e-6d07e92ef48d", "value": "3072:nTs3BxJNmJeagxE74pnLLMxMWS46cbR5WVcZSpF9:nAPsgx+6n3+ZSfc/WoSpF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617179784, "uuid": "a3904ecd-6e4f-4d6b-a484-7fcc0611da7e", "value": 163170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617179784, "uuid": "70fefc8c-818a-4794-b743-d75d0d87bc99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179784, "uuid": "4eac7ac1-8d90-4bb4-877e-759ad2d257c5", "value": "be9f8e378141e565df399024d8fe2bd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a12a83-923d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617207710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207710, "uuid": "79de3837-b24f-404c-931e-4721d7f5b08b", "comment": "Malware payload (Dridex)", "value": "806d6fea10eb7e72666e25f0bc43d8f2", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207710, "uuid": "1ecd136f-2e69-4e65-99af-30bd2f3a7597", "comment": "Malware payload (Dridex)", "value": "32733ed8cd439e049bff41a12686f66ddccf558a7ab68f4bfc014ec66bd0725b", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207710, "uuid": "9588b3aa-7e6a-4fa9-abf9-e6dbf244b251", "comment": "Malware payload (Dridex)", "value": "80ce5cb7c02db4b113f49491cc0417dfd0fc813b", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207710, "uuid": "c8cc0cb1-881c-4313-9ec9-ee02fda47dba", "comment": "Malware payload (Dridex)", "value": "87dc14c9a136b9ebbf2f4548da61372e45af33ecd29bfc14e88895a08b932416f1299c3d01f4c16a173b83812b6b482d", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207710, "uuid": "359f841e-638b-45a7-abaf-1b15fcdafc51", "value": "CF84DF42EAD54431EB726F3808738B514BEF79D18E308CABA29C205D1F676D0567CB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207710, "uuid": "948f5c3a-c21f-4a42-86c1-f25a2f75282f", "value": "f80d389dfa6eb310b9592775bddbb2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207710, "uuid": "b28725d5-0ef6-4f18-84d2-e9d60bfc9e5b", "value": "6144:+CyzitGu+B0VlPM+iHlDx7YVUggVSkMObhe+UqN2oCh5pGWN+zT:VYit06/iHlDx7YG7RTIZQFi5p9uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207710, "uuid": "4b74b954-abbe-49e2-8a7c-71f5bb87ec70", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207710, "uuid": "f74ff8ba-6d62-48d6-bf8a-a040d89bfde2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207710, "uuid": "46724ec8-8857-46d3-a657-35132e950df6", "value": "32733ed8cd439e049bff41a12686f66ddccf558a7ab68f4bfc014ec66bd0725b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501f477d-91ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1617173400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173400, "uuid": "08fde023-39dd-4e55-9a01-2f9ac7b07986", "comment": "Malware payload (CobaltStrike)", "value": "e5027a6ec49ac36e190257babc227609", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "PRESTO Co. s.r.o.", "colour": "#7C890F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173400, "uuid": "b70ca8cd-77df-42de-80de-3b50162aea7e", "comment": "Malware payload (CobaltStrike)", "value": "32a8d650cdb03abcc979011c25a18411afc65a7e8012e8c1a6cb4125ba6d83aa", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "PRESTO Co. s.r.o.", "colour": "#7C890F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173400, "uuid": "2607c459-3318-4b3d-a0d3-2df26c418041", "comment": "Malware payload (CobaltStrike)", "value": "80247194c0e3d01023c1db32ecd7d3d93cf420fb", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "PRESTO Co. s.r.o.", "colour": "#7C890F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173400, "uuid": "c795cde2-1d90-499e-94e7-89c28c48dfac", "comment": "Malware payload (CobaltStrike)", "value": "9ea21e5904d502fa8ff6242c263ddee0129421e2e0eb9ece2302335b3d48b4d486a00c2ead67758c6c75439f7615bf20", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "PRESTO Co. s.r.o.", "colour": "#7C890F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173400, "uuid": "38901093-cd04-4b1d-b9bc-486c33f1a57c", "value": "2E255B00E651903AF9F300FBC7F7447CAE38AB20131915DB53C479A9AB669E17D3692B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173400, "uuid": "9a5b44a7-0f07-406a-8d91-b445bd8a7915", "value": "67e85dd8f7be0d95a14ed0b7fc31926f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173400, "uuid": "9548dbbe-c396-4224-aa52-3b83f0338195", "value": "24576:mnE4U8/w2SciNq8B+BbfXBlO6n7vUhz3w4Gz46+CiPK/Ta1y:mjU52hKNIBzXDn7vU3WpJSK/Ta1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173400, "uuid": "dc7a364a-fbdf-4efe-b57b-9895314a27f2", "value": 968728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173400, "uuid": "c0e433cd-ae25-4bc1-a026-971a4c03419f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173400, "uuid": "aa67651d-682c-4ec4-b576-03f35f74d7c7", "value": "32a8d650cdb03abcc979011c25a18411afc65a7e8012e8c1a6cb4125ba6d83aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1791ba-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204988, "uuid": "017e6040-1b10-4e34-ae46-2e90f029d6f1", "comment": "Malware payload (IcedID)", "value": "6aacf4c21f5bf9e78bef24beed38cadd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204988, "uuid": "071cb2c5-741e-48cf-881b-009d5fa25ea2", "comment": "Malware payload (IcedID)", "value": "32eebf8650297dbc32d66afe8f694e4721770d9eeea24316434fac41c1296ac7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204988, "uuid": "c4ae7d9b-7e9d-4363-86d1-bec6cee5048a", "comment": "Malware payload (IcedID)", "value": "12b361b57b12961382f4d6e930c3451b5faf3826", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204988, "uuid": "270709e3-14a0-4e32-b23d-5f1338402301", "comment": "Malware payload (IcedID)", "value": "068bfdccc12f720b1306f62305bb3e078cb055a0c5dc8d19becdf7c8c93c1e44da1449b2529cd39d59dceabe283784a6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204988, "uuid": "5d9792d7-b634-4e93-9b56-56149fe79a41", "value": "A9B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204988, "uuid": "b91e4928-5be9-4689-af68-034f8c20dea0", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204988, "uuid": "74f1fe85-ec43-4d7d-bc7e-1dca0a235902", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204988, "uuid": "9c6efef7-cf2d-4750-8d37-66a1f53af3f9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204988, "uuid": "b5f90dc0-954e-4ac0-9f6d-c2b8c024a381", "value": "document-1922521742.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ad7852-91ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617173433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173433, "uuid": "5ea2cf92-5c33-4bb2-ad95-2d09d3fab768", "comment": "Malware payload (Dridex)", "value": "3ace0354803c772e1cf3ef45a1dcdcda", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173433, "uuid": "f2d7c88b-d77d-4242-9958-94ee545c658d", "comment": "Malware payload (Dridex)", "value": "32f2b6523ec3115f60e94bbf42be92b3501b8d013dc67d66ebd88797db92a8f2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173433, "uuid": "7dd08f28-f9fd-4213-b9af-0722f7a59a50", "comment": "Malware payload (Dridex)", "value": "b3752e565c83d6c0307e344d63655801b18d6941", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173433, "uuid": "983d8cb8-58b3-4690-88c7-c3dbeca03509", "comment": "Malware payload (Dridex)", "value": "0f80740467af0a5f436ec8f27b1352fb542a4be363f38f281517e58633bdbe8d54451a61d030f4a76dea61717d010060", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173433, "uuid": "1f186462-2ed2-4ad2-8467-8a658dc6b6ca", "value": "3214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173433, "uuid": "e0bbe310-e3f5-4fdb-9704-0ef8184765d6", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173433, "uuid": "40474ad8-0afd-47f2-9087-0c2df8015713", "value": "3072:81i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:4i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173433, "uuid": "bc424267-4d39-4152-b4b7-d06ca3039909", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173433, "uuid": "6584afab-a21e-41aa-a494-2871876c04ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173433, "uuid": "5edd6813-175b-4547-9138-bc5d975892ae", "value": "32f2b6523ec3115f60e94bbf42be92b3501b8d013dc67d66ebd88797db92a8f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcfe341-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212993, "uuid": "ec2f765f-16fb-4b65-9753-1d69611140d4", "comment": "Malware payload (Dridex)", "value": "662b6f9e6ccb58fa8274c6cd4792d438", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212993, "uuid": "a6333e9a-55c9-4fa7-8265-99832e559bff", "comment": "Malware payload (Dridex)", "value": "33016a9feeacb73def0dbf25671bd1107a648679989aca69215c01e9e8302507", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212993, "uuid": "9327596d-7ad4-4406-a78e-53d489535cf8", "comment": "Malware payload (Dridex)", "value": "0e030e23cf0967b3dd2078ad3c460d2d8b7cd91c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212993, "uuid": "77d83a96-097e-45fd-abc1-7235b87728fc", "comment": "Malware payload (Dridex)", "value": "d2368274aaac38b5ede2f5a174fa1dc6dab722d42554dd4648876ad116f132f9550aea47e43238b512d29a66d3820000", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212993, "uuid": "50cd1705-5ddc-4c7e-a881-f115d10240e9", "value": "3D248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212993, "uuid": "1f749ea1-d757-4b2e-8aad-6cbe67de3a89", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212993, "uuid": "bf40aa54-f6e9-4c89-9067-20b0e6d1f31b", "value": "3072:n6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:noMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212993, "uuid": "b64b29e9-998a-4cd2-b24b-d489b4f9679e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212993, "uuid": "9951b7e3-bf6c-4d98-806e-57f0a8f4a965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212993, "uuid": "2832c2dd-d89e-4782-a446-e68ef90f66aa", "value": "33016a9feeacb73def0dbf25671bd1107a648679989aca69215c01e9e8302507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fb0dd8-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199285, "uuid": "905b7a31-d627-40e5-b3f3-1efe3d353f62", "comment": "Malware payload (IcedID)", "value": "195716ab8bd710b029cc40826e9b91cf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199285, "uuid": "95c90757-2e9a-489e-8a03-9a4ece225494", "comment": "Malware payload (IcedID)", "value": "332ea3426db33faf224629853d50d8676ca2f86f57bddb06af302ed7d47543fc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199285, "uuid": "9555570c-72db-4bcf-9f9f-c2d3c708c76b", "comment": "Malware payload (IcedID)", "value": "848c1f63e45d495a0186cbfe33df7f43f57800d6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199285, "uuid": "714e3cc7-85b7-4461-a655-deb1869e01e0", "comment": "Malware payload (IcedID)", "value": "ede875a8c8fbb6e119b83a9ef692f945f010daa9ee9746dd15e2a61a6fd5702057e00ad5f4071524caaaccd437f97861", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199285, "uuid": "234e9923-6095-4a69-96c4-613d07e245d9", "value": "BFB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199285, "uuid": "87176aad-4349-45ba-9cd0-c838892cfa58", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199285, "uuid": "28b985a3-d3b2-4566-8e7d-f347efc8ca6d", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199285, "uuid": "3fb74428-c6af-48d1-8879-606b1f6b4205", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199285, "uuid": "c25d71ce-90ad-4c96-b6f4-c2d415572847", "value": "document-1787207408.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f956f916-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213197, "uuid": "28637961-c6d8-4d63-8d3b-98514d430ed3", "comment": "Malware payload (Dridex)", "value": "2d0ea58e049b5abb068baf178b9fad1f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213197, "uuid": "535aa934-060e-46fc-84a2-571528eadfb5", "comment": "Malware payload (Dridex)", "value": "3353a0329664c2298781a6ec40d73b42372b2c94bb44da3b9d8c77af3eae87a5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213197, "uuid": "d30ed5e2-c78e-4dd2-a50f-726842a802dd", "comment": "Malware payload (Dridex)", "value": "a545894836c77d3150719adb7167826b24c317d1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213197, "uuid": "359f30f7-4578-4f2d-8e11-f341e68dff6c", "comment": "Malware payload (Dridex)", "value": "54e3c97690a65791cb8cc31a1f655712448d4bf77127a0e6713dd275de4ed5540ff15737aeb3415852d4c6754ba775d3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213197, "uuid": "856ebceb-51d8-4f4d-9327-468c7801db1a", "value": "21248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213197, "uuid": "8b36b9fc-3d50-4ddb-ac7a-814b477324ea", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213197, "uuid": "e32064fa-8a13-4b2a-acc7-ff3177ea3f09", "value": "3072:b6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:boMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213197, "uuid": "4567bafa-c803-4662-a709-ccea05eba2df", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213197, "uuid": "fb862b55-c5df-49c4-9505-29f020922e08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213197, "uuid": "eff46d12-4313-40c7-8e4d-48a2426a5c15", "value": "3353a0329664c2298781a6ec40d73b42372b2c94bb44da3b9d8c77af3eae87a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a4dfc1-9206-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617184044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617184044, "uuid": "1917a804-dd0b-4579-b2ac-97d3eabd1c24", "comment": "Malware payload (AgentTesla)", "value": "e87375811878d6b10e3fd6f7777000af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617184044, "uuid": "e848387b-3dbf-4a07-a1d5-623c47e62aeb", "comment": "Malware payload (AgentTesla)", "value": "33559948a9e24a08a1ebfb802e793fe550e68bcb8998ae1560208ac99ebbd136", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617184044, "uuid": "27ea4af4-ae90-45ba-b97c-930d0f6f6351", "comment": "Malware payload (AgentTesla)", "value": "3561637dbd6e8020e96c9594625df5fd8c343e1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617184044, "uuid": "891f82f5-7daa-4827-89af-58aaeb2d260d", "comment": "Malware payload (AgentTesla)", "value": "5fabd619fbdae0bed63bd8e9b1d0cb1d8404237ca3f2bdeac73545adc9e92b03881375a85a20c1f50651512bd23c944a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617184044, "uuid": "a803c263-ee86-43c4-9757-517185b993d8", "value": "29D402F02E06DBD4D63856FE7118601116B9EBF384034F88CA58F9B63479E8D4DEA687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617184044, "uuid": "18ae9d6d-8280-42f8-9963-c6a6053bf0cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617184044, "uuid": "5f687ca6-ebf3-4503-babb-917530974f5c", "value": "12288:KZuuJRiUkeopkCA5DMmRQbxZfN4ikJEp55dy6/y3:YuuJRuer9+mGbHtfvdyUy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617184044, "uuid": "cc24bd98-4b9f-4973-b04b-1723794f9f12", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617184044, "uuid": "0d611dd7-4b9b-4cda-9dec-16883d47c456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617184044, "uuid": "35a38bb1-812c-4971-af83-24fbe6ac5666", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e882f238-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216605, "uuid": "8c7bed81-797f-45f0-84f5-72311754d8f6", "comment": "Malware payload (Dridex)", "value": "725c07b42ed939400fa2e6bc3c61577f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216605, "uuid": "51440ef2-d35f-4a0c-a385-c88936fadf4b", "comment": "Malware payload (Dridex)", "value": "3357d0934350a9fcd4b2d52d86b63a3e6972c8b551bd174069b419aa6913fe4d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216605, "uuid": "cd346796-4c18-43a7-9795-f684b3a92a07", "comment": "Malware payload (Dridex)", "value": "6df5789ce5a15b8e86d47f4cca357623665d0f6f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216605, "uuid": "ad0e0385-9200-4a6f-a79f-56a1a24f87d1", "comment": "Malware payload (Dridex)", "value": "1729ab8e94635a9ddfa8c04c6dd6d81c36dfed0c8fa75f206143cecd11e953402cc9d159036dc416e9261bafa05c345d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216605, "uuid": "6379f69a-13d7-4df9-a51b-803268bcd329", "value": "4414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216605, "uuid": "35c3d1af-a447-4ab2-b591-b0fd5cd20f68", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216605, "uuid": "e396468d-8bae-4164-acf2-0720373868b6", "value": "3072:Jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:OpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216605, "uuid": "dd68b58a-214c-45cb-8941-e27dc3d5bb61", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216605, "uuid": "867cef17-22f8-4fc3-957e-4384168a2967", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216605, "uuid": "0fba9586-7cc8-4760-bd00-3e88cbe9faf3", "value": "3357d0934350a9fcd4b2d52d86b63a3e6972c8b551bd174069b419aa6913fe4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3070712a-9242-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209854, "uuid": "589ef9df-38bc-46d0-97f2-0b8c01f34c3c", "comment": "Malware payload (IcedID)", "value": "53cd839dfb29f4e56904913a35e3ffde", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209854, "uuid": "b3ab1406-f123-418b-b66e-18789768d833", "comment": "Malware payload (IcedID)", "value": "33a772f24217d95cdaddba2fe068490f2a8b556eb29f4a6d8417910e69477ce8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209854, "uuid": "05c5b77e-b9d3-4d7c-aa12-6a430a32275d", "comment": "Malware payload (IcedID)", "value": "d839e94475148b068b576aa86a86099653224ba9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209854, "uuid": "c8f5d061-17b8-4a30-9639-2c3baf3eb8e5", "comment": "Malware payload (IcedID)", "value": "dbb637f59339f94b564a3d2aa9386ebefae0b6b9b1985fb2b8e9ce67376934f1f57d3b84a92758fce9bff65317482cc6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209854, "uuid": "77b66f13-2fa1-4788-927a-8a7ab15450b3", "value": "D0B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209854, "uuid": "04d2985d-d28a-45f1-8533-bd4933b23842", "value": "3072:o2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:oqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209854, "uuid": "97cda177-def6-44d7-a676-308466b4768c", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209854, "uuid": "18b6b086-bb86-4bb0-beac-8e67d6785a1a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209854, "uuid": "dc36a5bf-12c5-4373-b2c7-322ea9f287c0", "value": "document-789534362.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112cac6e-920f-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617187897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187897, "uuid": "e9c0a4bb-419b-4796-89ec-e22600b793a4", "comment": "Malware payload (GuLoader)", "value": "2b96d5a21ce0c535e5558175f5157bc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187897, "uuid": "11765cde-0e0b-4733-8ece-d8682f3d9c82", "comment": "Malware payload (GuLoader)", "value": "33a9607ff9672894cd9bf3fd3ba21dde6a220de4601c2da9479a9e059764d35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187897, "uuid": "efefac1a-3b33-4dd6-b0fa-8dbec3ebf241", "comment": "Malware payload (GuLoader)", "value": "aafbb78f4c8fdba1354636f9a83affc3a55223c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187897, "uuid": "27e4916e-2a79-4486-94fc-e76e6c7f9f2f", "comment": "Malware payload (GuLoader)", "value": "558d1442a6dc2fe17c75baa851ee306ce7138da1808891b5f30de533c4b08f45db22fb002f51dda0d4b161e982d1bc49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187897, "uuid": "bdfe35dc-64bc-4d5d-955e-c71331226dc6", "value": "D5D34A5161403083E7864C334CB5B8B8386DBD44BA73AE2F2D0B76176579BD29DA0B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187897, "uuid": "69e2c47e-6b4c-4455-aafd-fb04ccb82d85", "value": "399e3e9a5cc2cd2a186a8a2e044492e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187897, "uuid": "bf0f8887-7087-476e-aa3b-1bf941a74e7a", "value": "1536:GLLlVJNiYwvn8qE4FnN8t/FAwBDffPz4gQkCt:GLLlZoU4FnN8dFAQX745kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617187897, "uuid": "f944b067-73fd-4b14-a975-e7e230f8c99c", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617187897, "uuid": "9cbd6ae4-965e-4bee-a481-db7c08da479e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187897, "uuid": "c947f683-33e8-4676-953e-c2df6ba18281", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0f91e1-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217279, "uuid": "8d99ee6b-d470-4c9d-82bb-a6a879aa4902", "comment": "Malware payload (Dridex)", "value": "65273c08dbf5ee6cd7e96e3c510993ec", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217279, "uuid": "1592d975-e62a-406c-9125-22f7d9a0f907", "comment": "Malware payload (Dridex)", "value": "33dd0e00d8557f7e4cb15cacc8d7262f512c88d7ec4699bc09492379f206a12e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217279, "uuid": "7e138efa-f605-4009-86ca-7375d8acf995", "comment": "Malware payload (Dridex)", "value": "ceb24955dde75529645dfe0eef2391a587d447bf", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217279, "uuid": "39507161-7622-46f9-bdaf-cf5f6ccbf13a", "comment": "Malware payload (Dridex)", "value": "41745472a45271dd239e7eba5b1358742d43e939dd9af9ae181df565165baba7b1e0cc3bff706876ff40de2024a2ac99", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217279, "uuid": "c7515557-6bed-4595-a1d1-9bfa7c47375f", "value": "AF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217279, "uuid": "196e61cb-1183-4c75-bbb0-87051cb769c7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217279, "uuid": "ebaa8a30-f49a-469c-8cc6-e116576e83cc", "value": "3072:+opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:hpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217279, "uuid": "9d839fb8-cc1f-40e3-9299-e33b4b59178b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217279, "uuid": "5baaebe5-c8ac-443f-a364-fe2b1e66b786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217279, "uuid": "ab0da9df-6fb1-4ede-a667-bc320b4e8011", "value": "33dd0e00d8557f7e4cb15cacc8d7262f512c88d7ec4699bc09492379f206a12e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd5f98c-9246-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617211648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211648, "uuid": "0faa5c25-7c8f-4025-b5e3-21828163e13c", "comment": "Malware payload (IcedID)", "value": "d9778949f0f6996c91c6c9567206f7d4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211648, "uuid": "675328b2-ad15-41ea-8c70-acb6843a84f8", "comment": "Malware payload (IcedID)", "value": "34026d9bd529807889854789d74f61db18897e3407eada1c3bb904a399fb10cc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211648, "uuid": "63e2344a-f09c-4ed3-9f36-716db5575fe9", "comment": "Malware payload (IcedID)", "value": "abb855b89675c718d9cdafd98ab0669ad22fcdf3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211648, "uuid": "ae4c28d7-0332-4f72-bbc5-c8600db13d78", "comment": "Malware payload (IcedID)", "value": "28540819e71b6fcd8023e25c4e449efff6097f6b7187ae2fe05323825e8e68ca49f0735c6d27d4a3443198f0743b7275", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211648, "uuid": "a1b1bef9-f1ac-492e-8818-8bbe6df97cea", "value": "99B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211648, "uuid": "b8223491-119c-4627-a8d9-7094066d8631", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617211648, "uuid": "a39454ca-c309-4b29-9972-94445c98da0b", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617211648, "uuid": "05b64bc6-db37-46c2-ba19-211e72f69da1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211648, "uuid": "4ae9c4b7-fa53-4932-a970-4383a54e2cea", "value": "document-2092739367.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb62eab8-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159487, "uuid": "651f903d-6377-4f27-ae90-e2ba17b1bcdb", "comment": "Malware payload (IcedID)", "value": "6076358f86338db8f5533c4ff0939075", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159487, "uuid": "2c4995dc-eb77-4799-a171-5a5f90faaaf8", "comment": "Malware payload (IcedID)", "value": "340b55b23cac00e5f36cc476c8d5a2fb7ded9fac58fe0cb32d1673ee6038a2c3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159487, "uuid": "b48e495b-b132-41a5-adda-08c2d0fc1620", "comment": "Malware payload (IcedID)", "value": "f5195b81b5835f61206d173417f77211ea668c6e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159487, "uuid": "a1f559c1-b67b-4eec-b685-b03e5d506e02", "comment": "Malware payload (IcedID)", "value": "a1d23f97b77168394920aef4aea79eedb1ad1653b8dbe08d0757d23343cebc564658ce105b357e83d1036dbb581e1fe1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159487, "uuid": "d8370d2f-e6f5-4280-a585-2a3ea8bcb569", "value": "8BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159487, "uuid": "f14817b5-dc9c-4018-bccf-e514d0380b55", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159487, "uuid": "d8a74ee6-5658-4323-8056-82eeda3cdc07", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159487, "uuid": "f177926d-1553-46dc-876e-4046b0999dff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159487, "uuid": "3b560022-7309-4839-9530-6d8f0c6cb9dc", "value": "document-289627274.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f665b2-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617213328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213328, "uuid": "b29ec3b1-dfba-4340-905d-d3b5ff37230c", "comment": "Malware payload (IcedID)", "value": "046a363ef9f57a68b41ebae6ffef7739", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213328, "uuid": "17234811-c00a-4000-a944-f7912ce9cb84", "comment": "Malware payload (IcedID)", "value": "34a4816d377b04768620c12f255341a63d82b6b6cabebb7beb4f226b9baed6c3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213328, "uuid": "1a7b5471-94db-4ce4-9bc8-a5f78e248b11", "comment": "Malware payload (IcedID)", "value": "dcfb7e10d71a0e4076685b8ba76cce7eabc82c51", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213328, "uuid": "8d705d39-d4d1-4d13-8153-1786d8c7edfd", "comment": "Malware payload (IcedID)", "value": "790dabed04d4fd0d3cd34dc2856a889b21b757778d3b49a046754120890869a76c859142f48372917dbc822125bd2161", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213328, "uuid": "91fed7d3-18c0-474a-b9a0-7e9f37f7153f", "value": "A7B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213328, "uuid": "04d04faa-6638-4ea7-82d1-73c8cd78f0a8", "value": "3072:I2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:IqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213328, "uuid": "eeab4f1c-62d6-405a-8137-972c98a99c98", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213328, "uuid": "07e00aaa-6917-44bc-9454-7472370055ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213328, "uuid": "52f6be54-dabe-4d42-a29a-c37f9a6b9078", "value": "document-1875388213.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d6d8c6-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232519, "uuid": "ada675f6-c3dd-4111-b0f5-bb15b3c7b0ad", "comment": "Malware payload", "value": "da444d9bab70b479145fd77534a06240", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232519, "uuid": "95441792-5f2f-4c9f-9bea-6fe0e478f827", "comment": "Malware payload", "value": "351d89379274c334f5e16ab07c6864405be5f7f45921525efafa6cfef2924c05", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232519, "uuid": "20b3b8e4-c81c-4ec7-a167-4f1bf8771586", "comment": "Malware payload", "value": "b3dcc9ca1f3c636f3122a1dd434a64ba4ab16bd9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232519, "uuid": "b6d674bd-4408-413f-ba7f-99933b233bfe", "comment": "Malware payload", "value": "9aaeed3102351626711faa448dbd1015d6567366d3a50bbaae4d2a4cb7280af272e9929d09bed50f7bb7847406170915", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232519, "uuid": "524ff918-1691-429d-a29b-d5f6742c9cc3", "value": "6814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232519, "uuid": "58694690-65ee-4b91-9b93-71f326c1101e", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232519, "uuid": "06062555-54e9-49f9-b84c-221822a0e975", "value": "3072:Sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:lpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232519, "uuid": "a90f6cb7-59d1-45a1-bed1-ae4379fa1025", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232519, "uuid": "ce00ec23-a393-467f-8aa7-856c1e989063", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232519, "uuid": "84684e9e-d985-4c1d-8764-f31e04e8198c", "value": "351d89379274c334f5e16ab07c6864405be5f7f45921525efafa6cfef2924c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02349f1-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617199438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199438, "uuid": "510d8c95-21ca-4391-b754-533bb169ff13", "comment": "Malware payload (Dridex)", "value": "534691fe5b51d7bd045b06ebd1c8711a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199438, "uuid": "d062bdaf-d273-4e1e-b7fd-83fa89f1564a", "comment": "Malware payload (Dridex)", "value": "352640ebaa872a601f5320af5332b4cd1c3631704e3b8177ce05590bc21c6779", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199438, "uuid": "8487b31a-6090-40d2-b12a-3e01b7d010b2", "comment": "Malware payload (Dridex)", "value": "6db918863359be9c8dcbcd498b8ac81c4bf9471e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199438, "uuid": "a3376a95-b625-4241-826f-f462037f1aa9", "comment": "Malware payload (Dridex)", "value": "2d5ab9e3f4050033e26f763810789e7ec8d39f1b27d7d82302122740751189056a8c560cee86be1dbe9d39f24bbc74c0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199438, "uuid": "77af7975-c0d1-4478-a442-7208755d891b", "value": "C414AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199438, "uuid": "c035744d-f124-47fe-b4eb-41687e45ee51", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199438, "uuid": "1b72a14a-bd09-4544-9f3f-f503217b24a9", "value": "3072:e1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:2i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199438, "uuid": "1cdfc7b7-2c07-4ec0-8f35-65ab53fa0872", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199438, "uuid": "97a98d51-8dd2-4df1-bb26-97ab7e2d92d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199438, "uuid": "7d0cab9b-3393-4a3b-b249-7a17d600deb4", "value": "352640ebaa872a601f5320af5332b4cd1c3631704e3b8177ce05590bc21c6779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1678eec4-924b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213676, "uuid": "ffca55e2-d6b0-4e8b-828c-12fc538297a6", "comment": "Malware payload (Dridex)", "value": "099c0ee33dc8d2c30c553e119a0ec206", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213676, "uuid": "cc44d1ec-b635-4bf5-9a72-f8abfabdca5c", "comment": "Malware payload (Dridex)", "value": "353dd21651ce50fcbc44730434fed0db09ee6025d81ee274cf0827f9cbdbe0af", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213676, "uuid": "b91cfe62-0eec-4a2d-b3a3-99861451ae0b", "comment": "Malware payload (Dridex)", "value": "b748b152e4147370594c3f01eff94824c6de4929", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213676, "uuid": "d8d0e685-1e14-4c24-a60b-53d098e8a587", "comment": "Malware payload (Dridex)", "value": "10081fc746f8043212be61327c6f607eeb4e1ab5c788ccf4dbc5b8ca91c7539d6eaa591f42126c30c50cd46b6b149e2c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213676, "uuid": "ab80218d-5717-43e8-8a6b-0d84275f69c9", "value": "51248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213676, "uuid": "363bd8c6-678c-4c75-a8c2-1bad06f16fd0", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213676, "uuid": "ea07a64d-341f-4ee9-8f3e-2beac9bc7d3e", "value": "3072:X6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:XoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213676, "uuid": "6efe0333-746b-43c9-ba5b-2794467778d9", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213676, "uuid": "09a60ca6-9258-4290-b5ec-f77d51acdd9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213676, "uuid": "b2390f93-c40f-47cc-8efb-99775b860c31", "value": "353dd21651ce50fcbc44730434fed0db09ee6025d81ee274cf0827f9cbdbe0af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33a8c90-925b-11eb-abe1-42010a9c0039", "comment": "Malware payload (YoungLotus)", "timestamp": 1617220891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220891, "uuid": "4537188e-c766-4c7e-a00d-58ffacdd61a7", "comment": "Malware payload (YoungLotus)", "value": "9ba0849998b51bd23d32fd2c29414ded", "object_relation": "md5", "Tag": [ { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220891, "uuid": "8840f979-a91d-4339-96cc-d7fae1c86d38", "comment": "Malware payload (YoungLotus)", "value": "3541aae2111f4d292afeb914a9496298752c019425000212ba6f0e8cd7719542", "object_relation": "sha256", "Tag": [ { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220891, "uuid": "afcc57d1-fdc8-4ca7-a993-f3597af6a3ad", "comment": "Malware payload (YoungLotus)", "value": "bae5e3834e332024c402414f84487052d7f5a01f", "object_relation": "sha1", "Tag": [ { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220891, "uuid": "103ae171-4fac-4e3a-804b-5c9b7b264bdb", "comment": "Malware payload (YoungLotus)", "value": "a34e907bc24d375bacf4afd1e5d40f66f331de8188c6f34b9035508744605c2554a97ef473599786d93959007fcefa15", "object_relation": "sha3-384", "Tag": [ { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220891, "uuid": "1bcb1fad-714c-4b4e-a285-92996758f689", "value": "AC06E101B5D1C0B5D6C5293014A6E73A9BB99E111B35CFC3A394EF1D2E327E2AD3A136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220891, "uuid": "d420aedc-34d5-4227-b27b-41d19a98ce7d", "value": "6c1091d5f54010e91186d715de5e1e30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220891, "uuid": "5b0ba8a7-ea2e-4d18-8b05-0918f749e0f0", "value": "24576:DdhGVWohsfk1CnWi52LFvRrvwN1bucPiGzJEzOQN42LOURJjy:DKWkCnrwFv1YqcKG+SQN4Ejy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617220891, "uuid": "fe0013d7-f284-4562-8ca1-463eede2fb5c", "value": 3756132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617220891, "uuid": "83ccfdec-efbf-412d-9ba1-eb970abefee3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220891, "uuid": "671ba618-974a-4af2-8dbe-4ff9428803e4", "value": "\u3010Grab_\u6253\u8f66\u8f6f\u4ef6\u91cd\u65b0\u5f00\u542f\u3011_\u76ee\u524d_Grab_Car_\u5df2\u7ecf\u6253\u5f00_\u3001_\u4f46\u4e0d\u63a5\u53d7\u73b0\u91d1\u652f\u4ed8\u3002\u610f\u5473\u7740\u63d0\u4ea4\u8ba2\u5355\u540e\u9700\u8981\u9a6c\u4e0a\u5728\u7ebf\u652f\u4ed8\u3002\u8d26\u6237\u9700\u8981\u63d0\u524d\u5145\u503c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0daf05c-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216941, "uuid": "996f8bcf-b1b1-4390-a697-95ad6604da4e", "comment": "Malware payload (Dridex)", "value": "09303351a0d71069ce6388c6cc08fbae", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216941, "uuid": "4edddd28-edcb-4db5-b8de-4fe0000dd94a", "comment": "Malware payload (Dridex)", "value": "356b7b0378bbf8ce95cf06e0b220cf306f1ef47d2f34cabbacee2f1737d730c7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216941, "uuid": "11019dde-e2d7-451c-8e22-e316c96737e7", "comment": "Malware payload (Dridex)", "value": "b738b61bcdb9f9eaee13b0d316b4f03fe6a16036", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216941, "uuid": "4ca389f5-0888-4af2-a7e5-cfcb0636c0dd", "comment": "Malware payload (Dridex)", "value": "a5fc87cd07150d7b591b133c963e8c83f55c8c895c8a1ddaebbf55f5c326b9cb0a47bc5c49b8d606d500ff669874bccf", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216941, "uuid": "70ef8fa0-1d2e-43fb-a703-40a14de27eb3", "value": "FD14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216941, "uuid": "265218a8-a0cd-42aa-a832-e50402128fc2", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216941, "uuid": "699a2bc2-6f43-4855-89c0-e33eca9ed37f", "value": "3072:oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:fpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216941, "uuid": "2fe9cc77-2887-42c0-83d7-185b3799f335", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216941, "uuid": "e82da72f-a162-4c16-9f30-2a2857879167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216941, "uuid": "6b96b7a4-dd71-4e1d-aed0-2761aa1443c7", "value": "356b7b0378bbf8ce95cf06e0b220cf306f1ef47d2f34cabbacee2f1737d730c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a615eb-9265-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617225115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225115, "uuid": "50ccd646-8247-4ad5-aadc-e2b21b7c8cbb", "comment": "Malware payload (RedLineStealer)", "value": "308e2427c81e0beeedc8e5c8041f9751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225115, "uuid": "a56f5f38-85b4-451f-9e5e-504fc111afad", "comment": "Malware payload (RedLineStealer)", "value": "356dfb0e61e72430440e956c498018a82328fc6514a7dedce593e6fe520a1e3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225115, "uuid": "aee63f7f-7e6e-42bb-be71-76ccffaf6199", "comment": "Malware payload (RedLineStealer)", "value": "8594ff796745885ef9c49b50ed97396b674b9ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225115, "uuid": "0bed8052-0e32-49b3-9382-e5c10e7a5838", "comment": "Malware payload (RedLineStealer)", "value": "e85baa93ec612dbab3db07b79f45b5908884e8c1c2c5ea4e16fc1939cbcfdb8759640434e3f4298f24856502913cb4da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225115, "uuid": "c2d84ea4-8ecd-4db8-9362-e5b39dc6d754", "value": "5905E5E56E849EC0D962F2F0B04A87614B751D48B88887CD49F93D7E4A751ABFC1A03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225115, "uuid": "22401b86-5fa1-40ed-a098-cbfda96c7f32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225115, "uuid": "a36d8be6-fc63-4d89-bbe2-dd7bc4110b31", "value": "12288:Zr7t8O1sq/CF4bHjgZVDa4/x7SSR0o6y2/7d8:ZvR1R/CFlZV24/x7SSR0o6y2jd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617225115, "uuid": "b463f58f-9266-41e5-a0a0-2ba625a58c92", "value": 856056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617225115, "uuid": "5afb1729-886a-4c03-9292-f0e71fd9300b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225115, "uuid": "f95b41b8-042d-4edb-a2bb-ea8051ec3fba", "value": "308e2427c81e0beeedc8e5c8041f9751.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcac3f91-9239-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617206277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206277, "uuid": "d416f196-3f75-4055-9681-26f569ecf979", "comment": "Malware payload (IcedID)", "value": "da303ff25b7acbdb98f2436c940505ca", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206277, "uuid": "d6b77e26-6d2f-48d6-8e27-d3c6bc909880", "comment": "Malware payload (IcedID)", "value": "3580598557f833d54d87725b9b44cda3ccbbf57a26e4335752eb3899649376cc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206277, "uuid": "1f6de10e-db98-4076-914e-877a120da48f", "comment": "Malware payload (IcedID)", "value": "5b36ec15d29dff15ee6c977b68bf35d8440eb310", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206277, "uuid": "784d01cd-1f34-4d2d-9445-4edbd356ea40", "comment": "Malware payload (IcedID)", "value": "379d243e6e71126f75dcb75067d16034b25df3d9c9edf5778f74e10b4e9876bde5816db5fe16cb5e2282f4a5aa5d03ad", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206277, "uuid": "45de8780-22ef-4b5a-a4f7-c2219ad6bd77", "value": "C1B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206277, "uuid": "895785f8-9e53-4ae4-8795-d50b7972085d", "value": "3072:g2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:gqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617206277, "uuid": "77831918-e91f-47a9-9d6b-f6166d9b6ba2", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617206277, "uuid": "f2ca459f-79d7-4a95-b0e8-feb603d9e35b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206277, "uuid": "391bdbab-0698-4764-91aa-f1ea5970435f", "value": "document-1756426206.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee487d01-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218762, "uuid": "a654ff6e-5371-4b69-b411-14dd7256eca3", "comment": "Malware payload (Dridex)", "value": "977bdaa8b6199ff8080bf68512ac6ebd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218762, "uuid": "6e1fb3d2-c616-472b-b60b-389e063137cf", "comment": "Malware payload (Dridex)", "value": "3584e9c37ccbe2da826338e1c1a1bd19c9bd34b33a1d67d1afc2666bc3c5d9e1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218762, "uuid": "a2a85ab1-aa20-462e-b81c-f7f36ea97b43", "comment": "Malware payload (Dridex)", "value": "250f18d32806b6436417ad6fcb364cb983e2cb29", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218762, "uuid": "b24b991e-c38c-41ec-9767-dcf5d350c725", "comment": "Malware payload (Dridex)", "value": "12faf894c235e2b5624a9f811c0236c6d19a4f91483dc76d453865a21e49436a264cf9fb2943a701332198eb766e4248", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218762, "uuid": "9f80e48c-33a2-4069-b255-2d35d89c4964", "value": "1214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218762, "uuid": "4deabb61-5e10-4051-9597-666ce82cd218", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218762, "uuid": "cb476a89-db74-405c-a45f-8b75dbbfa1bc", "value": "3072:Gopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ZpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218762, "uuid": "c25f249a-07cc-454b-8d14-1270494f7bc1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218762, "uuid": "bd4b018f-a4bb-4c1f-a838-1251550a1fa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218762, "uuid": "4da037df-85bf-4f59-875f-b02c531f1dbf", "value": "3584e9c37ccbe2da826338e1c1a1bd19c9bd34b33a1d67d1afc2666bc3c5d9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31756c04-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223599, "uuid": "ddb64c92-c1dc-4620-aa4b-8f1deff6a423", "comment": "Malware payload (Dridex)", "value": "9d8b08b42c002cfae527ffd18b452efa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223599, "uuid": "e12595f8-f5d3-440f-98af-b2b8932007a8", "comment": "Malware payload (Dridex)", "value": "35d87c502866e81ec0e935d182bbc7bcf4537dbd8f7fe2d45feea5002f89f332", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223599, "uuid": "7041bbf2-b224-437f-a27c-4bc502cec615", "comment": "Malware payload (Dridex)", "value": "35accd9b364a56b6300781209bc0cdc1a4a94b9f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223599, "uuid": "4b15ddee-6b13-4162-9c22-3da558e59549", "comment": "Malware payload (Dridex)", "value": "0b30d0a58423f4f373413b706087159776cfb55316e73820b977bb55671316cbc9d69820723a0755f18554db254b555b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223599, "uuid": "dda94dbd-045c-4b0e-9faf-8ad0e00abfd3", "value": "75248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223599, "uuid": "3f91e627-7b17-4377-abc6-c396840ae5b8", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223599, "uuid": "9830d41a-c224-412a-84cd-fcd823a7549f", "value": "3072:L6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:LoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223599, "uuid": "70f02663-5483-4773-977c-d9c018262154", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223599, "uuid": "4fe273d6-bb61-4ac0-aea7-6776c875204f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223599, "uuid": "0b3183ce-2768-4795-ab32-717d8d1696c7", "value": "35d87c502866e81ec0e935d182bbc7bcf4537dbd8f7fe2d45feea5002f89f332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455268d3-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216761, "uuid": "4f288a18-4219-4d74-a5e8-5c45569f8867", "comment": "Malware payload (Dridex)", "value": "df8f27fa3bd97570a79f82d1c6205587", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216761, "uuid": "ef3f1c06-2be7-4221-9d18-7ab7317919a4", "comment": "Malware payload (Dridex)", "value": "3606e62d8206b652374a5726169614c850e899f5f097f36d0823dab939dcccc9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216761, "uuid": "7d69c0af-fb75-4473-831a-9548a3407edd", "comment": "Malware payload (Dridex)", "value": "2ad2afee23b0fcd371781cc6e60ca534e4037cf2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216761, "uuid": "f5c4cc21-df41-4157-85da-51ae2e69099a", "comment": "Malware payload (Dridex)", "value": "44e467a2740f10b2dbdafb8aa8c008ed37d8f47bb794925127a492ef3ba98f8f6f62447659f812402861aa6f4f731072", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216761, "uuid": "6ca6be96-a8ea-407c-a9b0-994b021d911a", "value": "8114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216761, "uuid": "a964ee93-354a-4f6f-835b-1237b186d0f2", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216761, "uuid": "161b1110-a225-4aa8-8c33-3db7a05697f9", "value": "3072:Fopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:qpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216761, "uuid": "006163d4-5bfb-4e4c-a011-561181f5e10e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216761, "uuid": "92e5c240-1cb8-4458-bc15-6fefb24b55ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216761, "uuid": "d98bca13-88ba-4039-8f6c-46604938a079", "value": "3606e62d8206b652374a5726169614c850e899f5f097f36d0823dab939dcccc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce071c3-9258-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219377, "uuid": "75599771-5a3b-49dd-8ba1-3df0084f1868", "comment": "Malware payload (Dridex)", "value": "345540b9f787e281f552f4cd2a3267a8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219377, "uuid": "e5a70b1b-b8b2-4ba2-a9f8-f7bd3cbb7a38", "comment": "Malware payload (Dridex)", "value": "36bc211b2395d04a899bd02c0a7a952525114fd27cca5229dc4b18f05e3eb3e6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219377, "uuid": "e3296105-610e-42d1-b249-110e493d9172", "comment": "Malware payload (Dridex)", "value": "b67848b79d2f187d3ca49975ffdf7c29b6a74f18", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219377, "uuid": "ca041997-7688-4d92-bd82-f6d17310f099", "comment": "Malware payload (Dridex)", "value": "aae4701b13abef5fa3a70c6525c0e9caa72b955269334ff9e782572aac4fb5f89f6224ced89777afdfc467dc594b1d74", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219377, "uuid": "15797316-b522-47a5-97dc-509dc45e8d77", "value": "A014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219377, "uuid": "13e36b19-6c3d-42ce-aa72-86d3e25d5ca7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219377, "uuid": "7f73ca47-af11-48c8-b2c5-26ffc202c63e", "value": "3072:Topj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:UpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219377, "uuid": "e71efc05-fb22-429b-98f7-97d05eb38443", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219377, "uuid": "83d56a11-a217-410a-aca8-bc21ac2879d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219377, "uuid": "077e997f-8c48-4cbc-8ab7-c524481aac3b", "value": "36bc211b2395d04a899bd02c0a7a952525114fd27cca5229dc4b18f05e3eb3e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d37382-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163477, "uuid": "ff06f805-8c93-43ce-9078-41bca8089eeb", "comment": "Malware payload (IcedID)", "value": "f95c458e15de49c19ac9dcc1ab6203bc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163477, "uuid": "58775447-d255-427a-9298-70c863ecd38f", "comment": "Malware payload (IcedID)", "value": "36ede5958dd8e579780bdeb0c06386ebec8fa77e166477ff93c139a79c1595b2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163477, "uuid": "c577eeb6-bd59-41e9-b829-d444cb9a95eb", "comment": "Malware payload (IcedID)", "value": "400f6313721d10ea43ba4582a4ed730c79d4d9a5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163477, "uuid": "ff5fa74d-b64f-4ad5-a1d3-25cde2e54fb9", "comment": "Malware payload (IcedID)", "value": "07bb6385527eba3a47fefc5167723362c7292fdbd5b99ca23409dbe9ac897b38c2bad0c988aa5e27f79720b1dc623406", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163477, "uuid": "e7c35af8-1dff-4d23-81ce-a3c5531d7a96", "value": "0AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163477, "uuid": "cad3906e-14ad-46e1-b6ba-9688e8fdf4fc", "value": "3072:i2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:izxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163477, "uuid": "00b6bfad-f2cb-4d65-a321-4d68071a5237", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163477, "uuid": "170899ba-e5d0-4cbe-b22d-3f21f891c350", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163477, "uuid": "3780b5b4-3422-44af-973e-b6b8e75211e5", "value": "document-442653383.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9deb86b1-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199300, "uuid": "7db1fe71-c2fa-4e07-8e5d-238145bcd3b3", "comment": "Malware payload (IcedID)", "value": "40ca4827f96c0572f208460c073160ce", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199300, "uuid": "aee72b38-1d01-4b60-95fa-05aec1b928d8", "comment": "Malware payload (IcedID)", "value": "373b9e1690354515dbd580b69823c6b70a7b91e30826adc087f1c1b716f0c594", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199300, "uuid": "931b8682-6ba9-47ce-acbf-c810a77bb1f8", "comment": "Malware payload (IcedID)", "value": "79b4aec1d84359036008d032f799d286353818a8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199300, "uuid": "e7febfd1-1c09-4a23-837f-42a92f4d451b", "comment": "Malware payload (IcedID)", "value": "c66ccdd0975dc357b6b7a4366b89827880b226e40859cee4035c59e851f5080037115716b674ccfcf8cb343307544b52", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199300, "uuid": "a6405176-ce4a-4887-bd7a-fa7fd8711eb5", "value": "1EB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199300, "uuid": "40ff6227-c80f-4920-aeab-42210311a5c2", "value": "3072:U2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:UqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199300, "uuid": "c645e113-0d3a-4cd2-a715-8b1cdf492cb9", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199300, "uuid": "f288aa84-353a-47ad-85a5-ece1092bb2c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199300, "uuid": "90951d25-b4ab-432a-9c45-93eb98e25bd4", "value": "document-607095416.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b21be44-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617173955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173955, "uuid": "dac6527d-73c2-43d4-b45e-3f531eb245e7", "comment": "Malware payload", "value": "38acff60101106147d360375a3075352", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173955, "uuid": "59844bce-fd16-4c23-9102-398c7b74274f", "comment": "Malware payload", "value": "375e8e8a722d8971d6b70df4f918c23a985ce2586e230ae458f5d56b05ab661c", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173955, "uuid": "14384e12-17b2-4d81-8238-417fa769d87e", "comment": "Malware payload", "value": "504779f9a512a39944bee65b491693d0cb9520a2", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173955, "uuid": "52887f10-7e45-4daf-bf11-95dc4e7e7f7b", "comment": "Malware payload", "value": "aadcdfbdcbfd34e4134fcebf9027f3495a80fa4af9f216c24a2918e2ac57af1a9b423946829b520f7dcf95d84ca442c9", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173955, "uuid": "a39adbba-c5c8-424e-affa-2873130feeb0", "value": "0C1593AC306D609ECEB69530F9B41C919F8428320F17FE3B60972654AD5FB6AFE0D461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173955, "uuid": "510c96ef-2ac6-4f81-8f0e-3ca91211022d", "value": "12288:+D9C4aT1NWBFN40sk0emlyw2JX9M57ZKTxbwW9CupDPaTt6mXj8+20Hn0L2zBTAB:+D9C4aT1NyEVeBXu57A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173955, "uuid": "ef25a101-a672-4338-90cd-a41e4cbb825b", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173955, "uuid": "8f61d497-40eb-4cef-8cff-7d7ecf426aeb", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173955, "uuid": "30a1c392-1664-46fd-82f7-845c04fb39e7", "value": "Document.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9353d4aa-923a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617206584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206584, "uuid": "3f28b703-2422-4d5f-a77c-22668548b1c9", "comment": "Malware payload (IcedID)", "value": "ca503e4a747dfc3b78a3ff0866f9741c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206584, "uuid": "38e6f785-6036-48a0-acad-d5d962285d89", "comment": "Malware payload (IcedID)", "value": "37626ebbadde5084482e489eb4d2305994cda69e622a7e03a9956499986809b6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206584, "uuid": "b4906b14-57f3-49e3-8179-928adfaca925", "comment": "Malware payload (IcedID)", "value": "3442ba83be7e9ba17e8777c1e73ed04700946332", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206584, "uuid": "ab6950b5-a52c-4aa9-93f2-e1c3bc61fe61", "comment": "Malware payload (IcedID)", "value": "d50dbda0e936a0db94e87cbb225248695c98a4e2f779af7ecb661642e4978bfb87643d44127589bc768d972082567bd1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206584, "uuid": "131d3b15-79bb-461c-a81f-46ff085b8ac7", "value": "70B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206584, "uuid": "90d10d2e-9bed-4ab6-b5a0-ecdfeae85626", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617206584, "uuid": "ebb3d20f-f90e-403b-85fa-eca3b61c0c12", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617206584, "uuid": "55093b96-1a6a-4323-ab15-61e21d64187b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206584, "uuid": "c6093077-50f2-4264-8227-2250cd081144", "value": "document-91608779.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7816765c-926f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617229301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229301, "uuid": "ce4c9749-8a3f-4142-8f03-8eadd8bcd2cf", "comment": "Malware payload", "value": "8cbf0bfc945976a4382ab4d971de8353", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229301, "uuid": "231ddc6e-2757-42bb-a833-ab73a8565d1b", "comment": "Malware payload", "value": "379035a5eb17a3347a7b6619b05e128e94da622220b04919301270f90a87bdf1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229301, "uuid": "2742a96c-3113-4e51-b97c-21d3d95270b7", "comment": "Malware payload", "value": "564c8b32092cbd073dd3d485cc9fdd40714b80e0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229301, "uuid": "f15e9a98-c44f-408d-8231-14b0b255112d", "comment": "Malware payload", "value": "b0b53956db0c0c6a8b7472621bfcfed0134723fe8e74ed248d8644f4fe89a0944f54fad8815c3d977412eb504fa9038b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229301, "uuid": "6a68a854-135e-46e8-a3e0-def174042c3c", "value": "DF248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229301, "uuid": "c7b12b30-e5f7-4988-85c2-5a497513b002", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229301, "uuid": "47454d11-2325-4460-a6aa-3e07201fcb3c", "value": "3072:z6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:zoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229301, "uuid": "75ceaebf-611c-4b2b-89fe-3cd36db21fd7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229301, "uuid": "bbeea064-0865-4bb6-8653-5a5c0520e51e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229301, "uuid": "df7a250c-e0b5-43ab-9aa8-21b96fddb877", "value": "379035a5eb17a3347a7b6619b05e128e94da622220b04919301270f90a87bdf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e8dd4c-9259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219933, "uuid": "0a318969-b74f-45c7-bc34-d5093ba156bb", "comment": "Malware payload (Dridex)", "value": "eda004445196ef67332a6ffcf17830bf", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219933, "uuid": "79192316-4ef4-4641-9b69-0f9b505a46da", "comment": "Malware payload (Dridex)", "value": "379938452616a484867be93a703dd6d3211f7f5b15561f5f8b22438bd765163b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219933, "uuid": "e3ab6742-4ae5-4013-9266-701a7d9aa143", "comment": "Malware payload (Dridex)", "value": "d19d4ac067a62b6d32991f2b25866b2d1528618d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219933, "uuid": "d71a7a76-c4d4-44ee-a336-434a088aa927", "comment": "Malware payload (Dridex)", "value": "4b237e609c773d5babf8f4edbf1f686533bea91eb35694b2381e55757c043f805edd838b4ed7393fae2b08d80e040496", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219933, "uuid": "84ed4db5-e1bb-4f07-9f98-efb406458c02", "value": "5A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219933, "uuid": "31e42c43-b290-4a50-a697-d88ff4912803", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219933, "uuid": "23249430-43e0-4a4b-9edd-338adf30e0e1", "value": "3072:Kopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:tpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219933, "uuid": "fb754856-edfc-4580-82a0-d82869496fe3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219933, "uuid": "96fc80b5-049e-4572-8dba-b40b614e2fee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219933, "uuid": "e6bd1b7c-c805-4fc1-9a9f-dae229345285", "value": "379938452616a484867be93a703dd6d3211f7f5b15561f5f8b22438bd765163b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666ef647-927c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617234855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617234855, "uuid": "66631e29-dda3-40e1-8769-5f1c440f6006", "comment": "Malware payload", "value": "7e0ba37a617b41398a78cff217dae743", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617234855, "uuid": "75b6616b-3af7-4e86-8f7d-d746fef2a07c", "comment": "Malware payload", "value": "37bd6c3e57c7747af384cfdbedbe68aae83d1363a7eec23619ca9f21066be449", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617234855, "uuid": "4fcd13f4-1224-41ff-b3a6-024fcbf73cd3", "comment": "Malware payload", "value": "c6e02fe78a55209f919de5bbb0b8bdb2635e6ba2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617234855, "uuid": "82664921-338b-40c4-878d-99df28833465", "comment": "Malware payload", "value": "80b394523de4458f01166ef49a026cd9de5ff2cdcbbb44667beb08ed2124f72acb27dfee22e28bf1ebb75735b914ef23", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617234855, "uuid": "66f44bf9-e7fd-4b07-932d-3b516acd1f26", "value": "FE14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617234855, "uuid": "e4ac5ff2-fb29-43f3-9834-733277c1fbba", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617234855, "uuid": "bbf54c42-78f5-41b4-bec4-5537b540ed76", "value": "3072:3opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:4pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617234855, "uuid": "b6ab220d-4eac-472b-9a4a-9f997537b9f8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617234855, "uuid": "61306d2c-7047-40ae-9ce1-70ca61470872", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617234855, "uuid": "82484b71-780e-41b5-b418-ad7455b807ea", "value": "37bd6c3e57c7747af384cfdbedbe68aae83d1363a7eec23619ca9f21066be449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c32afa2-91e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617171380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171380, "uuid": "9dfe17d9-7ed1-4ddd-b4a0-0076c29d9e4b", "comment": "Malware payload (Formbook)", "value": "7881e82cbb357ec4dcd0160bfd02f461", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171380, "uuid": "b0a05b6f-c1ed-4287-a955-2ba0d922c149", "comment": "Malware payload (Formbook)", "value": "37c9398da466ea22afe86a614a1f74e3b0582fb65db5e83c5c12c36802781ba7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171380, "uuid": "1ddf2c3b-a41f-42a2-a585-0e6cbb150486", "comment": "Malware payload (Formbook)", "value": "0355472f9d10495a9a5d9d1c226e0f2e88f9893c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171380, "uuid": "20b47a68-3dd0-4969-84b0-cdbc14a07457", "comment": "Malware payload (Formbook)", "value": "411c243797d7851be257e88f0eda240ceee71d1e16fb1f9ec21f07d126ddb5befb57a79264fe6233e212b93c3ec75a44", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171380, "uuid": "8b6ac126-3995-4603-93dc-b38f5bcd70b8", "value": "B4C5332E65F2CB43C16B25B39D9FC1969BA9CD415B45AE17730C3AA8317E33201E258F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171380, "uuid": "99932b9b-556f-4421-91e4-6366f0bba87b", "value": "49152:uOae2h4nwWm8ianbHOdNh1OtrPvAAPHXOfqK4e//Xhd6xtsvwcihWf:GWm8iUbwrA1eX7vNoWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171380, "uuid": "029460b3-23f8-4e5d-98a2-50b2a2467324", "value": 2656768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171380, "uuid": "81c6abc5-ee6d-467e-881e-47f43833b4dc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171380, "uuid": "5310723f-1bc7-4dae-9857-1f6c951ef411", "value": "NEW ORDER CONFIRMATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac528f2-9257-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218864, "uuid": "2ffe402d-dd5d-4657-a9a8-7c55c6d4c413", "comment": "Malware payload (Dridex)", "value": "1476ada46bfdb11a2e9b67d388bfb0ea", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218864, "uuid": "519b68cc-f34a-4932-b30f-145e058feb2b", "comment": "Malware payload (Dridex)", "value": "380fcfbd883b8e21dbb021597b030a3ab5eebeb0d62fd05608c2f0a2fc0152b6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218864, "uuid": "5c13967f-c2b6-4f01-83bf-d9269f32d849", "comment": "Malware payload (Dridex)", "value": "03d47a048f345b9d501c3ec6af63d34887dfd177", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218864, "uuid": "10886db7-799e-4179-9bd4-68a2df80b417", "comment": "Malware payload (Dridex)", "value": "5b4e774e286505f2cdf5a3d46e24b89354affdd7050743a791f7fe4254acb1fc0d5d96c4c23284f9f4ffdfb5d3777582", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218864, "uuid": "e41051f7-a5b8-4a20-b120-72a25a006580", "value": "5A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218864, "uuid": "6ac695b5-c918-4fc9-8f87-2304e81f37e9", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218864, "uuid": "7dd9ef0f-3f1e-4099-849b-36c394492d4f", "value": "3072:Eopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:7pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218864, "uuid": "869de769-74bc-4166-8d21-1893268804e1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218864, "uuid": "1808124b-c637-441f-8855-98fb1bcc896f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218864, "uuid": "336db84d-8fcd-48a1-96d6-4354dced77ce", "value": "380fcfbd883b8e21dbb021597b030a3ab5eebeb0d62fd05608c2f0a2fc0152b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786c3c8b-91ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160153, "uuid": "5e5eb4c6-32c9-4a2f-aa4e-6d2c26d52732", "comment": "Malware payload (IcedID)", "value": "7cfad28385206b880f5f05f01d5a76f0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160153, "uuid": "7109eef0-8aae-4ee6-8dd3-073167c2fdd6", "comment": "Malware payload (IcedID)", "value": "38131814310b0359c6bf3d405b1185adb94e6d4a382a479d342d97708ff603e7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160153, "uuid": "4d78ed38-cbce-4d72-aad6-9a786c4b6d9d", "comment": "Malware payload (IcedID)", "value": "29c3118c39168c2c6ca49098f5e0ffb6c1e0cc0e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160153, "uuid": "042a1525-f1ab-4226-9d37-2ff72e5e5b20", "comment": "Malware payload (IcedID)", "value": "25e4859fe8b4b5eeb87762caf1ed649402b73fc7127a2bacfca4f16374a86a29d4bd72c1dd25f5ffd6022bc13dec335a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160153, "uuid": "4c110302-625b-447c-a133-b67b56948a17", "value": "4AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160153, "uuid": "75e48296-2e08-4df0-8938-b678a28c0d74", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160153, "uuid": "1d678948-56d2-4149-9961-3e266f5c4648", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160153, "uuid": "5db60923-0e4c-4111-a9d6-c73dee9c0982", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160153, "uuid": "e2d74b0d-c86e-4a9c-9f17-6332dec38545", "value": "document-69847490.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7207956f-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617158424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158424, "uuid": "d39eb41c-8eda-4b8f-9f5b-7d7d8a783216", "comment": "Malware payload (Dridex)", "value": "3493819d3364d552e3c4eebe730e2a41", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158424, "uuid": "9f18ecdc-0771-4776-bcbe-ea6c99146ce0", "comment": "Malware payload (Dridex)", "value": "38452b6cb35f66cf7f8bc76fd75067bfcbbd21c68583f18c33bb431a9a83748f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158424, "uuid": "c46a01e8-d57d-4df3-85be-721d778fbece", "comment": "Malware payload (Dridex)", "value": "7d355f36b88253ae25bbd95868f5b78c0d316a96", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158424, "uuid": "aeef127b-830b-4070-8281-8d952484ecfc", "comment": "Malware payload (Dridex)", "value": "cd7f5c87f0a3600f28f181a8075d2344db9040028f28db48a917f59ae5ea27043620fb722f439f955907c01bb1bcd8d1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158424, "uuid": "2ccc4b68-351a-4782-9738-1548afc29031", "value": "D614AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158424, "uuid": "e66d445b-c469-4f4b-a43d-4f92b2863bde", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158424, "uuid": "0c354976-0c1d-42e1-a61f-e33668115e7f", "value": "3072:S1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ki78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158424, "uuid": "1f850097-38f0-415c-932c-b0bfca9f4515", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158424, "uuid": "7c7d5bec-91f2-44fe-81da-f8807aab7a5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158424, "uuid": "dedad63c-d171-418f-bb9f-63f707b20428", "value": "38452b6cb35f66cf7f8bc76fd75067bfcbbd21c68583f18c33bb431a9a83748f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca14ccf-91cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159784, "uuid": "f17fe53a-529f-469e-963f-a397cd371edc", "comment": "Malware payload (IcedID)", "value": "723e365b934e7c35485925e33bb9f141", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159784, "uuid": "7b9a34e4-35d9-4e9a-9e83-25e88c854de3", "comment": "Malware payload (IcedID)", "value": "384e5e5056f2b18a97ccbd4247581547758108d7efc445e516010f175fd68ef7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159784, "uuid": "dff202f6-6eff-4e50-b337-3be9d48fbb94", "comment": "Malware payload (IcedID)", "value": "e86a3118ca0d372eb42d955f1075c98d8304395f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159784, "uuid": "87b29575-4ec5-435c-9b45-3e7efc858270", "comment": "Malware payload (IcedID)", "value": "d07167dd9c38b01f775f7d079d9d5d6ed50400c397241c3b9b8eb7f895f9a7c4db410e288a589d92854cd54369550e32", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159784, "uuid": "35d7d8d8-c036-4f6a-93b1-3b1a89d9c11b", "value": "BCB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159784, "uuid": "cc9e0580-d34a-4f24-800f-0004c5a6eeca", "value": "3072:M2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:MzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159784, "uuid": "f94495d8-2748-446a-9ee9-92bee909559d", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159784, "uuid": "aa9c32ce-bf51-458a-b965-8e5431347323", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159784, "uuid": "06bfe90c-549e-4b9f-8a8c-304f95ec823a", "value": "document-204853211.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95032ec0-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223766, "uuid": "b6e7b5d1-aab4-4b91-b226-48afa992cfa4", "comment": "Malware payload (Dridex)", "value": "a81ee43fec555a766c569ec4c9833449", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223766, "uuid": "ceb8b1a9-ea35-4797-b35a-4ebd85e62d06", "comment": "Malware payload (Dridex)", "value": "38519e75c33e46116e8e5af7fa190c52bcc1a895e4d4ffa2f9f584a867b71649", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223766, "uuid": "37149f2d-859e-4daf-bbe2-474681791bff", "comment": "Malware payload (Dridex)", "value": "9be544940232b7376aaaca7da3baa91542784cd9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223766, "uuid": "5838f3c1-5597-42a0-a9a4-c47940835968", "comment": "Malware payload (Dridex)", "value": "cf5c757986b117f6c02cf65cc6f14688aa88d3198ae692ce1d3a2d74df4dab1c35bd597f9c222d419ed814977708b326", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223766, "uuid": "575930c0-d23c-413a-958d-7db745d3aad1", "value": "3E248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223766, "uuid": "6ae8b043-0382-4d9c-aef2-30e35dbf77ef", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223766, "uuid": "09fd831c-c5e8-46cd-b867-8eb3a224c178", "value": "3072:Y6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:YoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223766, "uuid": "7d0da0d5-f7ff-40f5-b72f-253bd6b76414", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223766, "uuid": "b88d811a-aa6c-4ff9-8885-83edc35ee9be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223766, "uuid": "a234731c-469c-4d85-a197-abe0dc9f8de4", "value": "38519e75c33e46116e8e5af7fa190c52bcc1a895e4d4ffa2f9f584a867b71649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee12a73-9250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216213, "uuid": "aa02293f-2155-4d94-887b-a6d6477553a4", "comment": "Malware payload (Dridex)", "value": "40f2b8ecc911adbac7a69997270f3db7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216213, "uuid": "0aa8d9ee-1e32-46f2-9fed-79adf1319fb8", "comment": "Malware payload (Dridex)", "value": "3880837f6031f1bde315be8fcd579fb211bde9d248e94671ab3646d173f9d1cf", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216213, "uuid": "386e35a3-e4bb-4ba7-a2ec-da784ed6181b", "comment": "Malware payload (Dridex)", "value": "edba424ffd1b72b008920fbbd0a4bdca3d63c30e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216213, "uuid": "91d50a7d-bc43-4542-b3ad-6951c2d470d2", "comment": "Malware payload (Dridex)", "value": "2bb9aab5dd8cf9bfcd9ddebabe8c963e7bf522808ba3c056f995b8383990fadf312d6d4532a69d70072afdc6600b4d4f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216213, "uuid": "443ff239-71a5-45e3-8db6-3c729ca9c210", "value": "AC14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216213, "uuid": "08967d0d-d2bf-42bd-ba0c-3809744280b3", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216213, "uuid": "4a147d39-6e9a-4e78-9ca5-10f9b32bb70f", "value": "3072:yopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:FpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216213, "uuid": "ffe8b6fe-53cf-4f2d-aa4a-0ab6174e17ca", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216213, "uuid": "c96619ff-88bd-47af-bb90-8f0e7f9d009c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216213, "uuid": "1e50876e-6383-4fd2-bf85-aee7e8b17ea9", "value": "3880837f6031f1bde315be8fcd579fb211bde9d248e94671ab3646d173f9d1cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4508963b-9272-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230504, "uuid": "1e754f1f-c566-4d1c-b8ef-198547cc665b", "comment": "Malware payload", "value": "8ed0692172328f6cae0d0477059c58ac", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230504, "uuid": "6b6b3648-a844-460c-91c1-d07b4ae268ab", "comment": "Malware payload", "value": "38926450911aec73d25998651864869e7030daf169e448c22216e4216e5ffc02", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230504, "uuid": "8e482c27-e66c-43d5-8301-d51e12cb7ca9", "comment": "Malware payload", "value": "cca63f3dbc3b05b37f053d019b7b21a049876b06", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230504, "uuid": "8bc3ed1d-36be-4e2a-9f02-644cde20397f", "comment": "Malware payload", "value": "86f30af037a8188e5c24a3a4fb6edf737ba8f0fe237a8adb06a6eb26b0b96e7a691004785027dd93494b9cf3f5f148a7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230504, "uuid": "5f80586f-1d94-44af-895c-3cf25d1241c6", "value": "5E248C5FE339E486FAE3CAF44186A72296A39C92436F680DA0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230504, "uuid": "dbb4f7eb-7d8b-414f-979e-5e98587b51c6", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230504, "uuid": "7b81b9ad-d52e-4c0f-8184-4e09c20afe83", "value": "3072:66TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:6oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230504, "uuid": "d12e0293-ae1b-4dd4-bdc2-114186b1ce11", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230504, "uuid": "4b28966b-dbb6-4c49-8ded-da8a064e2ffb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230504, "uuid": "31683e4b-78b0-4f11-9cde-136c0cdcb0ce", "value": "38926450911aec73d25998651864869e7030daf169e448c22216e4216e5ffc02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5e4572-9268-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226518, "uuid": "7f6a3a87-0bc0-4331-aaa0-cacb84c6eeaa", "comment": "Malware payload", "value": "3c2484fc5d666ac701979a76dc725e24", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226518, "uuid": "ade45845-f72e-417a-8601-01fd99a35669", "comment": "Malware payload", "value": "389e48e8248f9a50cc2acc8d8f09cefb9887f4ae1292147c5469cc9036187a27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226518, "uuid": "34df33a5-78ed-44a3-af42-c0f4d325af2d", "comment": "Malware payload", "value": "ecb88867a2f1ac1936ab766ba65c317cf02d633d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226518, "uuid": "e817f362-736f-4e36-830c-4c05680895fb", "comment": "Malware payload", "value": "54c9b0d7dd0a693ac3400ad6863a0e160b1ab1653f84876038c88595c92b04c5f0ffd7e6d051743e4b4281cad34d5530", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226518, "uuid": "0cf15844-b3ba-4350-9f4b-6ad66cd34b13", "value": "BD66021E7343B02AD8E5317933A86AA514E13DB464244867BBC5BB283AF42FDD539733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226518, "uuid": "c080dab4-e7b0-46a9-8135-11750f17595a", "value": "e37a244b747471612d20617e8c98ec52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226518, "uuid": "d4a9f782-f626-41e6-b624-18d742b3bf34", "value": "196608:rJ6oO6enqxRroRYQTOoXa1EPhoNrn5ljOHJCmJ:rJ5O6enqxRr2YQTNXa1EpoNrn5F2JCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226518, "uuid": "aa5f15e9-1a89-4eca-b094-d3065ef12e86", "value": 7093760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226518, "uuid": "f3600db0-d2bf-4831-8fd7-2c8fc8d3c445", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226518, "uuid": "7a3f154d-580e-466e-8135-0bca2687d033", "value": "SecuriteInfo.com.Trojan.BPlug.3870.29073.6187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92311eda-923a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617206582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206582, "uuid": "f23cf2db-c6fd-4e9e-8de6-37ab8ca0697e", "comment": "Malware payload (IcedID)", "value": "11631753f892844f8b1ca6af514fd5be", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206582, "uuid": "6f551c87-2a61-436c-a1fd-06d620184d2a", "comment": "Malware payload (IcedID)", "value": "38a1c0d00759e98351e770ce10eb2ea19f51a1ef752a65328851ac64e95eaa85", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206582, "uuid": "3123f7de-aba7-48dd-8a91-821102caddec", "comment": "Malware payload (IcedID)", "value": "bf228b01b1af2f510925767cce0176b8f74dec47", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206582, "uuid": "cd979a9a-a018-4d11-92e1-ff62fc2ded7f", "comment": "Malware payload (IcedID)", "value": "41ea8fd47f6cf0a044b23f375eefddc5cbe1ece4c558adfd4b90b1c6f9a2882a88636bdc4cbb41d5ed06320a13c55834", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206582, "uuid": "c6f2e86d-f080-4d43-829e-904f56b9da66", "value": "3DB3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206582, "uuid": "c48c71bb-d7e0-4fbe-95ad-9260ef151996", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617206582, "uuid": "8adcb899-ef9d-4961-aba2-a3fbd2206e2c", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617206582, "uuid": "6f43efae-71be-4ad9-a5da-3d00c34539ac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206582, "uuid": "d8cccd9a-e7bc-4ec6-b4f2-1054fb693174", "value": "document-120695633.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86fd2fa-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200204, "uuid": "4e2c8259-5837-45fa-942a-eb575e1f1e63", "comment": "Malware payload", "value": "db8965ac6fab1faa94336f96f2316b44", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200204, "uuid": "0fcfc12e-b41a-40b0-bba1-4bbdbd75aa4f", "comment": "Malware payload", "value": "38c74ea1011f4c56e343fb1e20648eb9645f3b2b376d6ba7f4ae863ad87f2411", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200204, "uuid": "99b10fbd-ec16-439f-b624-afcebc1dcf34", "comment": "Malware payload", "value": "4c0badc586e8a457164149a5696f174062ac609f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200204, "uuid": "55822c5d-30fb-4b6b-a6e2-e77341351258", "comment": "Malware payload", "value": "9b5886af025501b0fb2d4f222e90ebdd7bd35d8270031dd866e8f6c62b9f7c4e2ab5461d95e2f505906f8aca6754ab98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200204, "uuid": "751b84b2-d4e4-486b-92a0-d8d76fb9c7f9", "value": "E0E2B632990B66261A7211BFB992456AFBB4D0A3C210B031FF4C855C0FFEA4D91B765E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200204, "uuid": "a0907f1b-8ffc-4b5f-9d5c-e61452ac2283", "value": "384:fgghU7R/jJQAaQs2LlZOF2mx31Oc7hiyVHT7WQZRhOQc6zvvtwxYyPRTT3X:fgaU7R/jJQArs2uYm9ntHWSOQRaSy5T7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200204, "uuid": "37c0353b-c800-43c4-8339-fdcdbe9cd60f", "value": 32044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200204, "uuid": "79de3c1b-04c6-476c-8c3a-dd69ef3e124b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200204, "uuid": "5914c09f-309d-493b-b7d7-9a98da02544c", "value": "38c74ea1011f4c56e343fb1e20648eb9645f3b2b376d6ba7f4ae863ad87f2411.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f42ea64-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217180, "uuid": "3b5b578a-e9bb-46ca-9141-60da1b89d3ca", "comment": "Malware payload (Dridex)", "value": "bf3e66d5610bd6f9a47318e7c0bb8ef6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217180, "uuid": "bee0b6db-135e-4622-af76-4d3aa60bbcd2", "comment": "Malware payload (Dridex)", "value": "39179a0ccdba053565403b57f0b696ca1c11b2f28e174837e3db57007f363c25", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217180, "uuid": "cb7a05a9-5985-4770-b6c6-861713550d5b", "comment": "Malware payload (Dridex)", "value": "ae053be3f29d5caa64b45ca2257c489ebe651db9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217180, "uuid": "2f8e3c60-4721-4891-aff7-14a0c5be6847", "comment": "Malware payload (Dridex)", "value": "7ef8a8c8fbeb52ba15703dbcad4d34fc4a4cc2503b641f4eef9b78013065b491c3757271dd8d47b78a256e47cdf71fee", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217180, "uuid": "882d1688-d754-4207-bed1-3a96bb041eac", "value": "9514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217180, "uuid": "c6d93dfc-9fe6-43f2-81fd-9a3c70122bd1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217180, "uuid": "14efea42-d619-414f-a6bc-43b7054c014b", "value": "3072:3opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:4pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217180, "uuid": "9d89e9e6-640a-4ff5-b593-4caefd5c3081", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217180, "uuid": "3caf49c8-7be0-4145-874d-5cd59c2af685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217180, "uuid": "3e12d0f6-6262-4360-84fb-9b4eb55ad3c1", "value": "39179a0ccdba053565403b57f0b696ca1c11b2f28e174837e3db57007f363c25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da566d93-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158599, "uuid": "b0aece8f-a241-4446-b73a-6e87d8926aef", "comment": "Malware payload (IcedID)", "value": "52cd720c6ba96dcf1218001b6065b5bf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158599, "uuid": "08fbc1c9-71a7-49a3-b49d-56d74378d355", "comment": "Malware payload (IcedID)", "value": "391eb07608b56d4a298f34ec15daccf2bb56bf0a7796437eb1fe38be80194455", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158599, "uuid": "c81fba7b-af8b-4d4b-8dda-a3ff67430b6b", "comment": "Malware payload (IcedID)", "value": "35673aee6d69c7dca9360ff794fa38a1a21e7534", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158599, "uuid": "4164f8bb-f104-433f-af52-f6e9f454fc52", "comment": "Malware payload (IcedID)", "value": "2d79b6e8ca3e0b112569f0cebdd68fce64c53ce447076858b2d8c7eaadcd43e42453d953b536692c21394bbb67b76d71", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158599, "uuid": "9961cc10-0070-40bd-89b4-e5753416f1be", "value": "AEB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158599, "uuid": "5b92d818-1504-4750-93a4-2613de0e7753", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158599, "uuid": "aee5c318-b98b-4710-b61a-be1046767bb0", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158599, "uuid": "520468ab-c576-4383-b044-77e3c18e65fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158599, "uuid": "bacd012e-8898-45e3-8072-42d07829c03b", "value": "document-548334873.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8150d8-922e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617201338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201338, "uuid": "34ae2751-5280-4fbd-a85a-da42d4292cb0", "comment": "Malware payload (IcedID)", "value": "228e9768730fd5aafd875752f301a92e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201338, "uuid": "525d461d-09e6-4bfa-9e69-dbb8cca5917e", "comment": "Malware payload (IcedID)", "value": "392224942b2eb4530378ac64afd9862dc34f43bdbf57822f3d7bc520d4ae22e0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201338, "uuid": "56d14c44-de6f-4acf-81fb-e246fc3c10c9", "comment": "Malware payload (IcedID)", "value": "4065c2c8481a596680b08343f1c1b77d8422ba3e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201338, "uuid": "aab89596-ae5b-4cf5-a963-5bf6c1570efe", "comment": "Malware payload (IcedID)", "value": "e61ea8e1efe85a2e14419517f58c68389d68b511b45f82d6f462dc893c134647168c6ddb694d5537d91bf4a2dc00064f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201338, "uuid": "0ba8d8e8-1b14-4aa6-a8d5-55e2ff8f2f02", "value": "51B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201338, "uuid": "2aefb083-2b85-4490-a76e-ac337d07ccd0", "value": "3072:82S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:8qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617201338, "uuid": "462d1ea9-6263-4727-bdbd-b75c9cddcf8d", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617201338, "uuid": "52933d1a-1ff1-4756-9dae-89ddf02b42c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201338, "uuid": "be1cdc02-8c3b-474f-8458-3904584ca6af", "value": "document-1116855665.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3712f12e-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230910, "uuid": "4e1ae792-1b89-436a-bfc1-ba50e6f89dfd", "comment": "Malware payload", "value": "7938dbe5b72e7b57af2779ec30842611", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230910, "uuid": "3f6f8eb2-d1ed-478a-877d-e0967d952b9c", "comment": "Malware payload", "value": "3953847e096ef817c4af52f4e0dac6f330ce7113be36d27d791bdd2efb6c3867", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230910, "uuid": "a9faddd7-c3e7-4424-a24d-05d938aa9a56", "comment": "Malware payload", "value": "fce9eb4cc324c194695f25b3a19eb2d7ca8f89e6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230910, "uuid": "452eea8b-fdd8-401b-a36d-ae07ec15124f", "comment": "Malware payload", "value": "dcd1f9a42e0c4e3f1b3b0b875f2fd0341200045f14ff21db9d561e0860f9e37b2cb6c6b708219465da14fde5fdb7376f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230910, "uuid": "5ee516fa-3c29-4bd2-9820-f479a2e5fcf6", "value": "2E248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230910, "uuid": "49243987-961b-4547-b581-a8d990da01bf", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230910, "uuid": "8410f03c-60f8-44dc-9f98-bf1125612a31", "value": "3072:F6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:FoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230910, "uuid": "59e70b2f-88cd-452d-ab8e-18df3c8f147f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230910, "uuid": "d1820441-85bd-47e7-9b53-e9a251efc532", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230910, "uuid": "065fba6b-0ab2-4e40-902b-60503af1a79f", "value": "3953847e096ef817c4af52f4e0dac6f330ce7113be36d27d791bdd2efb6c3867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c977d3-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212915, "uuid": "7c4afa8f-714d-4cb9-b091-f7ff28b15ef3", "comment": "Malware payload (Dridex)", "value": "041e153ccc1078946e631d7c77929b9c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212915, "uuid": "c50e8f82-1aa8-45e9-8c54-4301d616ef98", "comment": "Malware payload (Dridex)", "value": "39afdf61d05bf00b2d657343f5714481ea814b572df806dbcaaa8e7b675e68a7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212915, "uuid": "c66ef158-dd03-45de-9afa-febc1b4c8732", "comment": "Malware payload (Dridex)", "value": "d26028c5da3091f8dbd49ff6dc85a2d41927a9c0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212915, "uuid": "7c011881-2d0a-43dc-95be-b68109954191", "comment": "Malware payload (Dridex)", "value": "f21483d559f47b6d7b993e44451bb25526a6f6c2b474dfb6c71ef29d1da055b95e45e5b3762e5e2d78d1f970554f69ae", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212915, "uuid": "30a07059-005b-4ac4-bdfc-d45112043450", "value": "E7248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212915, "uuid": "200937aa-274c-40cf-8ff1-b490d9e47f7b", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212915, "uuid": "14755e40-29d8-4c90-a40b-624aa4fd3ca5", "value": "3072:C6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:CoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212915, "uuid": "cdc3b194-23e9-41ac-827d-b4361d78d60c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212915, "uuid": "d178fb32-9691-458a-aa50-19947d682523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212915, "uuid": "d5049f1b-4963-495e-b628-81bbc3ceddca", "value": "39afdf61d05bf00b2d657343f5714481ea814b572df806dbcaaa8e7b675e68a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3113c4bc-924f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617215438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215438, "uuid": "f3b59ebf-afbb-46d6-a7c8-1866e0ded7e8", "comment": "Malware payload", "value": "14debda095e73bf28425172b0188bd06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215438, "uuid": "5ba0a976-db6a-4a1a-9d09-c399dc89cead", "comment": "Malware payload", "value": "39b1498f3489f4391a355104db339e5bc9ae85527fa219de6955e76ec6966e92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215438, "uuid": "011ef01b-73db-4640-9c9c-e6a29c7a7cf6", "comment": "Malware payload", "value": "59de6eaacfbfbceb9064711895fb4f3823f52df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215438, "uuid": "bc4a23ee-83a1-41a8-ae74-b2172ab602cc", "comment": "Malware payload", "value": "f8dbc2b053decb4c073d5f981f4ba05643f14b5610d3f0299dbac78c344e703aa258edb9eadca832addd1761ffa5408f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215438, "uuid": "bbcc6d84-7d84-470c-8a3a-9559bce26589", "value": "138540605DAF376698B31F8C275128050D236D10FEA34763168AE5287E83D8AEF75E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215438, "uuid": "4a875730-a04d-495f-b077-37d28bd858ba", "value": "3072:xphodeAqjG5stwgS5hZE4s6lzF1S6s9ZGixBT+Ebh2EoOkE19pIFTuhGEInlmrIJ:CdJiGOtn6ZE4hxslrUm9TI4HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215438, "uuid": "775227f3-ad89-44a3-b9d5-8040c23228b2", "value": 1725975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215438, "uuid": "e3b755ca-b1d1-48cc-922c-7e317c4696db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215438, "uuid": "679b5603-2596-43ee-ad53-c5a05abad817", "value": "14debda095e73bf28425172b0188bd06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c10396-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222739, "uuid": "1faa867b-e081-4c2b-8c0b-1c72fb0b9b93", "comment": "Malware payload (Dridex)", "value": "1df6baed6130f4de61d3bcfde65f5e3a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222739, "uuid": "cc9e937f-6e77-4e66-a735-d3cecf907e3a", "comment": "Malware payload (Dridex)", "value": "39b2efb0115976e938e27f9343175d55afce29a1fe9774359521db5699190db2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222739, "uuid": "6e64c698-95f8-45f5-8760-ea60de0e6370", "comment": "Malware payload (Dridex)", "value": "1dac856bbab5e0d10b4da78bbba6783ab5c5cd63", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222739, "uuid": "5300bc03-593b-4830-945a-4ce0e972f298", "comment": "Malware payload (Dridex)", "value": "c311558a2ec4de038428542d08527af1284a881f48a0da11145fc04a64a4972273bd23db1bc20efc81fff725f5c875ab", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222739, "uuid": "38c15ed8-81bf-4330-bee3-dd7fa6bff7e3", "value": "23248C5FE339E486FAE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222739, "uuid": "4e66f407-3f65-4aec-8154-d302e3ef6399", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222739, "uuid": "85273a03-e196-449a-b63e-cddc9b4e48b1", "value": "3072:O6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:OoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222739, "uuid": "b1017558-26bd-4f9f-8538-4f997bd096d8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222739, "uuid": "821b98ee-a343-4153-ba82-0295ec8ccc06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222739, "uuid": "3bdfd632-c396-4e02-89ea-8314707aa23b", "value": "39b2efb0115976e938e27f9343175d55afce29a1fe9774359521db5699190db2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a1dda2-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222662, "uuid": "e1f453e7-93bc-40c2-aa58-86f986f35f02", "comment": "Malware payload (Dridex)", "value": "575a004bbb56304a3b4ae37f331bb4c6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222662, "uuid": "b07aa175-3083-4ded-b3fe-2e5176a18300", "comment": "Malware payload (Dridex)", "value": "3a09b8752868aeb6a9ad39c8fea93694f01095f7547e927e898c45541c088000", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222662, "uuid": "18d470a2-fc07-4229-bee4-e84663c6bdbc", "comment": "Malware payload (Dridex)", "value": "f26e6ec06dd31e324c7ae297a5133916de165dfa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222662, "uuid": "5dcde1dd-e792-46df-8b37-8e067a203615", "comment": "Malware payload (Dridex)", "value": "99a8229576c081f590852d27b332bed607cd88ca5a07aea87b01de8e9cdf3a4cad33f505e16d0429d85a9404bf48960f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222662, "uuid": "5e68ce3c-df01-40b5-986c-30f38ec39ae5", "value": "82248C5FE339F486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222662, "uuid": "a66fcf41-df61-4562-bd15-21e4c9b7816c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222662, "uuid": "e8c84071-3c80-405f-9321-15a5dc75e842", "value": "3072:k6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:koMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222662, "uuid": "4df75d66-17e7-4801-9384-311ad4587dd1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222662, "uuid": "add162bb-4723-4a86-9e57-8971c6f08941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222662, "uuid": "2b0915b2-b8cb-4c7d-8a25-fdedfa3ddf08", "value": "3a09b8752868aeb6a9ad39c8fea93694f01095f7547e927e898c45541c088000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d23923-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617195688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195688, "uuid": "80d34220-d808-48fb-a938-7f6630a175d3", "comment": "Malware payload (AgentTesla)", "value": "a3b69268023e9a5c63c6e3e8fcb92ae5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195688, "uuid": "d7823be6-292b-4795-815d-518ea552da82", "comment": "Malware payload (AgentTesla)", "value": "3a1abb4137e233c388549442065bb6329c2ac72bace2c89f95a3b13b3120d8b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195688, "uuid": "08a358ee-2d16-4f8a-a679-09aa751f132e", "comment": "Malware payload (AgentTesla)", "value": "fe06c0decec5060077e8f9aa5620556a75cd4a78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195688, "uuid": "39b1403d-f0d5-44c1-898f-18395719c6ee", "comment": "Malware payload (AgentTesla)", "value": "5f6f2832223fef900ce8140f2f302514abe3a29bc3cfc6caed42a2a7a05296621781d2560cc780cfdde85160eda5189a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195688, "uuid": "b2ebf904-e792-4030-bf08-5d98213a1b74", "value": "0B15F13127AA5B91C9BE8739A136114083F9E047E712DA7EBDB511DD4C22FC94B32663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195688, "uuid": "b3b649be-735b-4b06-b925-142eb553d926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195688, "uuid": "382effe0-42c4-47c5-8152-a9582bcc13cd", "value": "24576:MnQKHTsxF9SxF9XeT+N6FNsouSGJKiFw:erHTQQ0TTFN3uSri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195688, "uuid": "6411504e-dcca-43dc-b01c-a7b6c5616496", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195688, "uuid": "f57e5202-2916-47ce-b2bf-de16bcbeacad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195688, "uuid": "0897e327-afd7-4547-ac1c-5489cc10710d", "value": "RFQ9088QTY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96a7a18-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204983, "uuid": "48f0a62d-39c9-4270-8a9d-67234d6b0d57", "comment": "Malware payload (IcedID)", "value": "bc374efc1142d10a59f8e763edca4cc2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204983, "uuid": "5fec6792-036f-4134-b255-ee9160acc761", "comment": "Malware payload (IcedID)", "value": "3a2ceb2ffa07034d902d8774cf0d8d1e1a2b0a5ed4d19bb447b634805dd14231", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204983, "uuid": "970790e0-9a91-46f8-9f6f-9686f0f9d658", "comment": "Malware payload (IcedID)", "value": "93d561131bd6e5b9d364f58bd92caaf166228a05", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204983, "uuid": "fe7aa197-a112-48a2-83b9-e94c7d99b408", "comment": "Malware payload (IcedID)", "value": "5e07a152720207a8a25cd29a01c870b862f557033c747267d87767d7959d5ebf1bdee053b0534882ef33eff491d77122", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204983, "uuid": "11009983-ec63-4add-94e6-d8da966311cf", "value": "76B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204983, "uuid": "db6f5a59-e347-4d60-a077-96bf5c857915", "value": "3072:42S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:4qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204983, "uuid": "771b83f5-16f2-4307-bd64-9eda803fb7e4", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204983, "uuid": "41fbe4f3-1e97-4c67-8d71-c1bc1be69372", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204983, "uuid": "01a185a4-a506-476f-96e1-0b19a21d09f4", "value": "document-682880983.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aacda1a-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216797, "uuid": "4ebb106e-0f17-4cff-8436-92287d76f7fe", "comment": "Malware payload (Dridex)", "value": "0f3f6f810312159a3a6fed4249cf4830", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216797, "uuid": "d3ec1966-2c33-412b-a5aa-2aa671489eb8", "comment": "Malware payload (Dridex)", "value": "3a3fb495eb3ad1beb27d32ae50248fbac66216e5ec54cbf3a203062a339ddf72", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216797, "uuid": "d47c0be7-2562-4abf-958f-e92d34807a03", "comment": "Malware payload (Dridex)", "value": "fc1046529aa2faf66ca39691047e0141916a1a70", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216797, "uuid": "2f05d241-d446-4319-91d6-be3fc236fb14", "comment": "Malware payload (Dridex)", "value": "fce919ef616348ca9843106679e43b72e908904942282b429af5f11f5e1bcfa1eff03f9815fddd99578d8892b1d61ad5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216797, "uuid": "29d58388-0a1c-4218-9fd4-16d7b4b26069", "value": "D714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216797, "uuid": "f73d4baa-1011-4254-83c2-9aaa9d8d6ff6", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216797, "uuid": "9dbea5c2-6150-4d7a-8770-1a548742a496", "value": "3072:Ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:mpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216797, "uuid": "53a27db4-fb8e-4222-8c0c-f048735e887d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216797, "uuid": "e6dbe0c2-074e-4a38-88cf-5b025ccf676b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216797, "uuid": "070e2a40-a801-4f24-92e2-a403bf809231", "value": "3a3fb495eb3ad1beb27d32ae50248fbac66216e5ec54cbf3a203062a339ddf72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5844e7-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213365, "uuid": "15d35f2d-d6d1-4042-90ee-bce8fe73621c", "comment": "Malware payload (Dridex)", "value": "7f9ec624dd8899f8ead6825c48252bed", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213365, "uuid": "c18349da-89fc-4c9c-aae2-478809fbd58c", "comment": "Malware payload (Dridex)", "value": "3a586c691a0737ad39a033d343dcd8082fef3e8e8c4c56ff5312b3e6eade1e7d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213365, "uuid": "1af77737-b115-4df2-b5a1-f7fd99a6cb81", "comment": "Malware payload (Dridex)", "value": "06c44b38988eab6c26932b335da6c69eb87151c7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213365, "uuid": "248be718-c641-4dbc-a8b5-90cefa628718", "comment": "Malware payload (Dridex)", "value": "fe0053c725a02d1b15c312d09eca3a6eb2d5db302ca20146d9861492be44f1a53ba41d3a09e5ea1cf83238196eb397df", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213365, "uuid": "20321e29-2817-4bd5-91ec-59011f30086a", "value": "92248C5FE339E486FAE3CAF44186A72296A39C92436F680DA0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213365, "uuid": "f8a2fbde-f90d-4e98-a604-bed9e6c52e97", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213365, "uuid": "9bcb142c-dc9c-41d2-9a38-ae00f9b16bd6", "value": "3072:B6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:BoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213365, "uuid": "755b9604-5cf2-4f1b-95a3-55da87a2b117", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213365, "uuid": "bb6d0c02-3592-41ee-b982-b399bd1be1c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213365, "uuid": "91100547-b078-47a4-92ed-f71a8a24453d", "value": "3a586c691a0737ad39a033d343dcd8082fef3e8e8c4c56ff5312b3e6eade1e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3bbcf4-9224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617197098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197098, "uuid": "2c39e22d-8548-4c56-8abf-8dc234059f7e", "comment": "Malware payload (AgentTesla)", "value": "60488d1a7ee1cc425b6bbe93d4849b00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197098, "uuid": "6a3bef48-fdd1-42ff-a8e0-dabb190233a9", "comment": "Malware payload (AgentTesla)", "value": "3a59c88eb66362eb3494d88a7dc008e0124c82e985bf1e241ae54d8b6d006a4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197098, "uuid": "aa099b67-6a7b-4a53-a24d-e2f2abcc8aeb", "comment": "Malware payload (AgentTesla)", "value": "0ff5cad6bae5269701acf53c699a5f50f9d10cab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197098, "uuid": "04d252a9-0a6b-4c51-8964-78c198a6d0bf", "comment": "Malware payload (AgentTesla)", "value": "4ad87a5fb8d6bc9f263419c01ef7df2ff600cdc1bec303dd45a9d90b8113c9d44adab998859dfde77ed921b8c80c73af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197098, "uuid": "e60404c4-dc58-4c27-b246-ffe891f96602", "value": "45D401F42A02CBD8DA3C5AFFA555645207A9DFF640034F8C8A58F6B73526E4C4EE9243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197098, "uuid": "e3985459-fffd-4e31-bfc0-4d52b14bee59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197098, "uuid": "5711b952-f76c-437a-8997-61947ff71618", "value": "12288:QF9JrUNsYlhjQhLkT0PlahuIBn4PrD7z:ufkn9QhLkYgIIBErT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617197098, "uuid": "ac191b1d-b9cf-42cb-b9ea-e65937dc0821", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617197098, "uuid": "af0157d1-5708-4707-9edf-1c56517f8e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197098, "uuid": "f322a2e8-cd45-4309-8e6d-5e868536c375", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c45956-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213304, "uuid": "b9cc0a9c-b363-4c29-b5c2-03342852bfb4", "comment": "Malware payload (Dridex)", "value": "9c5d008e395f642170c92e8a6e1583f7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213304, "uuid": "9041e591-de8c-4548-8ece-88322cb4bfb4", "comment": "Malware payload (Dridex)", "value": "3a6c888a654ecec44f77544bf87c97f88b6416877dbc0c2c0c505ab8bcd8e63a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213304, "uuid": "d500dd80-f7b6-4d14-af1b-671e93e26625", "comment": "Malware payload (Dridex)", "value": "4d9a403923a6def0f1d2a897adb5a00fcc301302", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213304, "uuid": "727a55b6-d7ca-4d4b-b3e6-0f3d5a588b13", "comment": "Malware payload (Dridex)", "value": "a0050d9b716676631540a4b029a96b6df80cb4d086aa17b130cb4d2305995f875a2af4bb8fc097084b2589e301f65eb0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213304, "uuid": "1c48f272-8735-4c1a-ba74-5c77b9e66591", "value": "BE248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213304, "uuid": "69734c11-9e30-4866-bc56-9bc24f2f42a7", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213304, "uuid": "e0d91577-48b0-46a1-b7d2-2f5d4c744740", "value": "3072:s6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:soMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213304, "uuid": "3f03b5e7-4095-4b72-a19a-7df780287f21", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213304, "uuid": "83c68fee-675a-4f6a-96f8-2bad46b51f78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213304, "uuid": "e7226669-2faa-44e7-9074-a04002682c8a", "value": "3a6c888a654ecec44f77544bf87c97f88b6416877dbc0c2c0c505ab8bcd8e63a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ee62e2-9259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219903, "uuid": "ee4aa9ac-21e0-452e-a2b3-915f15b5b0de", "comment": "Malware payload (Dridex)", "value": "83097a1386da1c27448903ae1f7f51e4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219903, "uuid": "ad04abb0-5112-4c88-9c36-7800deafbde9", "comment": "Malware payload (Dridex)", "value": "3ac98c9a1dcdab9cd0a806b3b7a668bd19a3b6326eed84b95e1df2c4689731dc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219903, "uuid": "d82010bf-f3d8-45cb-bfe4-c14a5531e0d4", "comment": "Malware payload (Dridex)", "value": "7c6c0b8dd48eae0e25c87a5d23785a467a039825", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219903, "uuid": "5ef0ecb9-d19a-4995-bfec-2b5cae5f2380", "comment": "Malware payload (Dridex)", "value": "b10236eee2e59139b5fa9b57adbff08bc14b9448787516e756b77c38a1b5a60c045aa2a7d694e9c9560088468c608fe8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219903, "uuid": "e8c8dd92-11a3-4f19-9169-e165ddb473de", "value": "8714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219903, "uuid": "b060aa6c-936a-4490-81c3-095d6b8b64ca", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219903, "uuid": "431bbb96-989c-45e3-a7e3-6878a9103459", "value": "3072:Vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:6pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219903, "uuid": "ed70e121-ab81-401a-843a-3b6551cdd3f4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219903, "uuid": "63a91d9c-3c4d-4a0a-99ec-7f2f3170a29c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219903, "uuid": "041519e9-a0f6-40a1-ad09-7d21fcc19077", "value": "3ac98c9a1dcdab9cd0a806b3b7a668bd19a3b6326eed84b95e1df2c4689731dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efde2aed-91ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617173668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173668, "uuid": "f95dcb62-3b7c-4c70-8ae0-0dc13622b60c", "comment": "Malware payload (Formbook)", "value": "9f1b731012949c6e701719a77bf0a8a1", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173668, "uuid": "da5c7992-91f9-4c18-81fd-7b5b15792e45", "comment": "Malware payload (Formbook)", "value": "3ad5483f76e1269d56497d58e15957ea80390b36665b015ac53f85265a2707e5", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173668, "uuid": "2e57db65-9db9-4b1e-b766-d27661398819", "comment": "Malware payload (Formbook)", "value": "f8b05ede44dc187df2ce724d17bce5a4b47472ff", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173668, "uuid": "49a985ad-c619-4fa7-a82f-cbf6b282ae2d", "comment": "Malware payload (Formbook)", "value": "27ca38717ce9a228036f30f03617e8f3a2a2c62c097679add80bfba11b520f84ef93ad1fd516aec7ca6b549f70e35826", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173668, "uuid": "d7898509-47cb-4854-92e4-5b6b42ec99a6", "value": "9DD423BD52422904BD8A593CCFE20067CCE31A3E601F245961679F95E371F7ED24CA75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173668, "uuid": "d172770f-5f9f-4288-ba3c-ed4f9b55e75e", "value": "12288:3gtYB5abEPR4frwqqgw9S2zGRCUoLZk2zGwmf/amcW8VwPpnyMaETqKKj8V:FB4QPRPqQ9tzKCUoLZ5zdyCdiPByAXKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173668, "uuid": "8284694d-fca6-4076-bf94-4beb5e6c02e1", "value": 606602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173668, "uuid": "1784e0a2-eddb-418b-b866-23695f0198e2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173668, "uuid": "4e34e5e4-fae6-4cb9-8722-b44ec709820b", "value": "FTT103634332.CAB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34284235-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163474, "uuid": "a83ee5ee-c7e6-45ff-801e-e8429bac3470", "comment": "Malware payload (IcedID)", "value": "ed1d5233a03a31f2a114e8fbc169ac90", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163474, "uuid": "d28a7c10-dd1c-41dc-a889-6ad615c09960", "comment": "Malware payload (IcedID)", "value": "3b0f6c0d3c65dd9a89554bd2c4d341a73d6d770dd1e4ece001110806c6552fe4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163474, "uuid": "9ccbe932-e09f-49da-83c9-c18dfa9e22a7", "comment": "Malware payload (IcedID)", "value": "8ca0756d4d2a59f9735b9ff918953c0e7d877514", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163474, "uuid": "39aff8fc-2485-4922-b4b4-28f89cbf633a", "comment": "Malware payload (IcedID)", "value": "4701cd9b2acc97fe95512788f317adda680d7be265492b64a58994b717b7df6d7b3b1928e86cf621084863f365bd8294", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163474, "uuid": "aababdf4-27d4-44a5-92c6-d2d4185c6d73", "value": "7FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163474, "uuid": "9983a983-8bc3-4323-9b63-8bd2fd5721f6", "value": "3072:M2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:MzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163474, "uuid": "e9d2ac9c-09d7-4d83-949c-134f86279569", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163474, "uuid": "958e15f8-6fa0-468d-8402-954c58da6fdc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163474, "uuid": "2157a63a-b93f-49e2-8f24-01b3eced08db", "value": "document-940376813.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4520270-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217377, "uuid": "e77ad979-d3d7-46a5-8f2f-6ab02acd479a", "comment": "Malware payload (Dridex)", "value": "762c8764d30e9b5aa61b37dfef177b28", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217377, "uuid": "89a9d115-82f8-41c6-9fba-f1ac3e641fb1", "comment": "Malware payload (Dridex)", "value": "3b1b633ca28d9dcef95e7eeae2d200fca980aa0f21b953468ad5f90bc4330434", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217377, "uuid": "c4ae505e-2db9-4944-a65f-494eaa6a069a", "comment": "Malware payload (Dridex)", "value": "81de1102435df7ba0da6f1f27238db3688f38c26", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217377, "uuid": "81823744-e09e-4912-9dd8-4f7fe3a08565", "comment": "Malware payload (Dridex)", "value": "3288e990f0fcb063bd8d1287ff447b8b4f17f67de0c401b542a4670a6807a6e041bb7cfa0fea197047b9629a992a0ec2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217377, "uuid": "1fcb6650-7c8e-419e-919f-b87ba1edda10", "value": "6014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217377, "uuid": "8bb7f6c5-a8e9-42c0-aa76-9faabc216605", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217377, "uuid": "68415769-6290-4966-a017-fc604a7de2c7", "value": "3072:jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:kpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217377, "uuid": "043bfb63-87e3-4ecc-8eb6-3a06e24c0e0b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217377, "uuid": "e24d0bcd-25a7-4c8f-a271-cb46c3f8a248", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217377, "uuid": "3d7f0755-66cb-4b1b-bab1-5e6add1a8f5d", "value": "3b1b633ca28d9dcef95e7eeae2d200fca980aa0f21b953468ad5f90bc4330434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b78520b-925e-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617221871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221871, "uuid": "f53ef975-3d09-45a9-a1ec-ec725d67273f", "comment": "Malware payload (njrat)", "value": "2421c488fb9f26e44ae67e7dcf759cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221871, "uuid": "4ef1f494-c64e-41af-a951-9c7dd4a7145f", "comment": "Malware payload (njrat)", "value": "3b3877630cdc3a3aff595b6ae113a53ccd0f0d551cb87d94ef09d3115bdce9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221871, "uuid": "ba699715-eec4-4d63-b018-ba0c0b1d6f60", "comment": "Malware payload (njrat)", "value": "027f553989d5be2f87aee0c2aa719bb064bffd75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221871, "uuid": "789d2612-6668-472c-9749-81ff5dd09d6f", "comment": "Malware payload (njrat)", "value": "4ccf5b5409b1e097601fe3938b0aeda9da9cd58ee4d9b071bfee99eac984f037860327313430acd55b3920f484902bad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221871, "uuid": "442c65d5-c842-4f84-a3f1-9427c4bec4ef", "value": "3EB22A0E3FA98896C56C167486A5565003B4A1870423EE2FCCC564DBAFB3AD92D4CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221871, "uuid": "a505e410-21a8-40db-9c4a-edf85f137be5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221871, "uuid": "4ef01702-c6b8-4924-8b6f-7e45b4a4b455", "value": "384:fqYmCsg/yJrQ7hucGSl7UJx4g6JgfCcosjddmRvR6JZlbw8hqIusZzZXn:FrG0Btl7rRpcnu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617221871, "uuid": "de84118f-64c7-4aee-9162-fa5c1b1d39f7", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617221871, "uuid": "1d1fc6b9-2d49-422f-b510-5f815a4a8c96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221871, "uuid": "88d1dd27-00e7-4751-9326-53ad4bb44630", "value": "2421c488fb9f26e44ae67e7dcf759cf6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a757b4-924b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213671, "uuid": "baa44b2e-f7b1-4522-880c-9ffafb637266", "comment": "Malware payload (Dridex)", "value": "114d1aefc268e22a114a8a42706de4a3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213671, "uuid": "7a1ed786-94eb-424c-b25e-4a67c92456a8", "comment": "Malware payload (Dridex)", "value": "3b48120bd65491c0e7a1de70b3448be8c84d309d7588ad51490b089c36832350", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213671, "uuid": "fa2015d3-2e6a-4045-bdec-fea983923b27", "comment": "Malware payload (Dridex)", "value": "7a65c2fd21d1b3ae00b225e379f40e61a05de6ae", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213671, "uuid": "4e6e5f7b-7310-49cc-9988-2565c3ca1479", "comment": "Malware payload (Dridex)", "value": "7091677b727136541e55f573a0189c7d411746218d230427b5c7a1047d0cfefb0fe25de04a3c684f80bc3e61ee69f892", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213671, "uuid": "b088888c-3dd5-46d8-8726-39f0b6ab47c6", "value": "12248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213671, "uuid": "46a31d9c-3e9c-4cb6-9675-298abfd8bcb4", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213671, "uuid": "abb14cab-f05f-4dc3-ab15-ae06845d3fef", "value": "3072:c6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:coMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213671, "uuid": "fe0acd38-ace6-4b9f-b967-17fd21aae905", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213671, "uuid": "3b67608d-5306-4edb-99fc-473ac27605e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213671, "uuid": "ceac42b1-e31d-4d2b-9dd1-bdb36eb5192c", "value": "3b48120bd65491c0e7a1de70b3448be8c84d309d7588ad51490b089c36832350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db53f937-925f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222596, "uuid": "828cd7e7-a3f2-493e-a5d0-3fbc51759ccc", "comment": "Malware payload (Dridex)", "value": "1e87fd4dcbf29fbacaed6d58b2c2adaa", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222596, "uuid": "cf50a6a5-43d8-4c27-9a7d-ea3b5d0b1db3", "comment": "Malware payload (Dridex)", "value": "3b5d61d0107fea4a2257b7fc1970618de725cd2bc0ab70bbd875bd451cbf2e2c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222596, "uuid": "eb9117e5-853f-4fe7-a696-1336bcae198c", "comment": "Malware payload (Dridex)", "value": "d9070ceb4c3fe8959506f675cfbe54da5dae830f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222596, "uuid": "c438aed3-a575-4dd6-9cf7-11a4bd3828df", "comment": "Malware payload (Dridex)", "value": "3aab8a5c1ce9f30c677b84c74572733258e45dd3c07a76939ec1d1fe7ff7cdb2af43f98a9aee4e13aad0e893e6b49f47", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222596, "uuid": "d1850e9d-331d-4ee2-9822-e9b7ef7492f8", "value": "CD248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222596, "uuid": "a492ac77-5294-4d62-b3eb-c821d01d324b", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222596, "uuid": "68225972-9e8f-4273-926a-a2ad4321123e", "value": "3072:a6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:aoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222596, "uuid": "3bc00225-c584-4231-8395-afd4145c4e6d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222596, "uuid": "5d628319-528a-40ec-96ae-d4cafdf25485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222596, "uuid": "c001207e-6d95-4f06-a5c4-cc15de74ddb8", "value": "3b5d61d0107fea4a2257b7fc1970618de725cd2bc0ab70bbd875bd451cbf2e2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5027ca6-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218290, "uuid": "f79663e6-7f05-40ba-9b96-04cd05a4b0e4", "comment": "Malware payload (Dridex)", "value": "3224371a75d42ce9e11d3f19b06d5eb4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218290, "uuid": "6078e0fc-1449-4a10-b27d-ed4d5aa1fc33", "comment": "Malware payload (Dridex)", "value": "3b843f8b14d9ab9f821cbbfa14847cf2556c3776c72aa59a874c97db033957cc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218290, "uuid": "d2e09baa-5a2f-446b-b2f8-09414c9f0b30", "comment": "Malware payload (Dridex)", "value": "3a3f1da9859ed8fac9020e41ecd662f5900c3350", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218290, "uuid": "b09fb196-1727-4623-871e-79e193a5adb7", "comment": "Malware payload (Dridex)", "value": "eaab87e18de5eadc7aa0101723a60ce50b6631de4970abb8cc6d180520922e5377881e2d8c1dfd69bcac7a0099dac802", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218290, "uuid": "0c1eb156-d05d-4820-86bc-08d40a11bbaf", "value": "4C14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218290, "uuid": "92ce04b8-39f3-4217-8092-1789dcf3fd24", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218290, "uuid": "cc4c974c-5452-40e1-b563-c0ce97bba114", "value": "3072:Sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:lpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218290, "uuid": "909526bb-c39f-4e54-b9a3-0681304c5bb8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218290, "uuid": "8bf700ac-c80b-4b2e-9530-5389015ad1e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218290, "uuid": "f7b34bf9-c644-48da-adcb-5b4062da2f53", "value": "3b843f8b14d9ab9f821cbbfa14847cf2556c3776c72aa59a874c97db033957cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1717a28-925c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1617221210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221210, "uuid": "b8829543-fb53-44f8-b879-79ea0b10eb39", "comment": "Malware payload (NetWire)", "value": "1e3d729aefe43012af8f4b8d4ae78c64", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221210, "uuid": "05b30e70-3168-4bd5-94ba-2c53b8b78291", "comment": "Malware payload (NetWire)", "value": "3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221210, "uuid": "0bb589f3-398b-478b-9685-0bb3854e4af3", "comment": "Malware payload (NetWire)", "value": "9ce0416256b3b41df4015c5df56122790fd93ca5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221210, "uuid": "93744127-5762-4bf7-b8d6-23b4d7fb624f", "comment": "Malware payload (NetWire)", "value": "381d6267d553633af7d748db5e00f8093f16b5ed3c042587544f0943d329e1112237d91267f1097349038d1e636f278d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221210, "uuid": "db2f973c-3763-4c7a-8815-ea662c85f685", "value": "7C92BFAAF27D56C2D87080FED4034A2BF6E874A093655B5F05F45B809D77F392A32606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221210, "uuid": "ba6c4c4f-cfdf-481e-acff-c995787b40c6", "value": "f91a9df836a8492fd4fd127123a75892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221210, "uuid": "b52180b5-6f49-4c84-8acf-bc5b6055598d", "value": "192:YmYL0yNLBlXwXp3TftWGAZLHd3kQZlMMAsj8qCQfQApXJLTLtcebIKeFH8grRG2p:YHLbDXwXpDlif+urfpXhhcogcipMRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617221210, "uuid": "29c1a328-4d7d-4f74-8280-76d1fac29085", "value": 19460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617221210, "uuid": "ff81f264-e263-4266-8da6-232a23dd3e4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221210, "uuid": "1fef695d-8017-4fa4-b388-5298b2f0b885", "value": "3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e71523b-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617195677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195677, "uuid": "e8dd610f-de38-4aa8-9355-440c6b5b4c59", "comment": "Malware payload (Vjw0rm)", "value": "13bd7e15b751a2a6389c587fd2cc3053", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195677, "uuid": "1212ff48-e655-4b4d-bfac-aceffef8f667", "comment": "Malware payload (Vjw0rm)", "value": "3b8e07eccb807a64a193e2ead60f739384542d295af70803e36f24cfc7e8c361", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195677, "uuid": "d53ccd6d-80a9-4664-ab1d-3efff0b00898", "comment": "Malware payload (Vjw0rm)", "value": "335336c48596ab6a197b4254aec031f5dc327a30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195677, "uuid": "9fc262d2-a35e-4f15-a03d-dbf26a5a825b", "comment": "Malware payload (Vjw0rm)", "value": "ab840757e6e0e28336a970bd2eaf5faf662d52afb9b46a32174d875e433ce4be9aebb3fa9f35bbcfd7aad399a24c293e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195677, "uuid": "262eaf9b-555d-46af-aaf9-09fc9be008db", "value": "50D2E32EC3A7F86583C78210C6D5C23AC577F1870A7E51B361B3DD2A278872F114DAA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195677, "uuid": "84433e2a-4a5f-4722-a948-85a82607a96a", "value": "768:vZYPsP17dc6v+2BsfY9DNzkJlBb2+s0p2MkxWb9uNWVTjbhsdlwRTpAM3v2atxs9:vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195677, "uuid": "bfcf9713-0bae-48fe-bf85-640ae837d030", "value": 29776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195677, "uuid": "e2833f85-34cb-423e-a6e9-a22ac8caf9db", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195677, "uuid": "faf1fa49-0ef8-4b18-b297-a5b0643088e0", "value": "Statment of payments.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d079d4-924f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617215393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215393, "uuid": "87e9ee8d-04f2-41a0-8402-55619c8663fb", "comment": "Malware payload (Dridex)", "value": "ee5426a5a4b4610257e653acff22151c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215393, "uuid": "10e6af9b-8eb8-4727-a0f4-e82bbcf0d008", "comment": "Malware payload (Dridex)", "value": "3b923dffce11a84a3548c7d81a6e24b429fe2ad66478ee5f8956054c6a1cc53d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215393, "uuid": "6125451d-4440-400c-bbc8-f5ea77fdb1a2", "comment": "Malware payload (Dridex)", "value": "93a3b79fde327900a7663adb619d2432bfe7a1a4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215393, "uuid": "674dccc0-c6bb-4f0d-9a2b-ef8967f6d487", "comment": "Malware payload (Dridex)", "value": "2ce4e96fc23cdc69f999dd4f6a2b865426959461439585316c2781231536284052e21e01d1097da74886efff5692fe0d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215393, "uuid": "614ac778-86f2-44e9-a910-73bddddfa6da", "value": "9F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215393, "uuid": "0b8b4c53-fb70-45fd-a8bd-c34b683cc116", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215393, "uuid": "4b394984-30e4-4544-8868-bed22d7fb642", "value": "3072:Popj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:gpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215393, "uuid": "ad9b0c6e-1a59-48b7-9e67-0186a3555d4f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215393, "uuid": "2411daa1-5d32-4fab-9893-91dc0bcc2d6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215393, "uuid": "f4d85b3c-18bf-42d1-9ee8-465b3660f495", "value": "3b923dffce11a84a3548c7d81a6e24b429fe2ad66478ee5f8956054c6a1cc53d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1dea61-9271-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230251, "uuid": "977955d4-774b-47fa-a0a7-f1f21c05aa94", "comment": "Malware payload", "value": "801d52165b9f02de3953a0dbbb3cf161", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230251, "uuid": "e2ced607-d965-46af-aaea-660811135cdd", "comment": "Malware payload", "value": "3bba5227f7c0c1d96850c48796e0371b607df412c3dada4ce0909226d772af6e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230251, "uuid": "5c4f6a69-2037-4bfa-aed2-6a962fc351b7", "comment": "Malware payload", "value": "2e384b5096b90a6e69ef41bab52b55b3022755ec", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230251, "uuid": "d7adcef5-df5c-4956-b83b-f965357d8403", "comment": "Malware payload", "value": "6122dad8eeaff25484593fe6a32fca7da519f676c5d681046d3cfe731f81e546a0840af1fc65312286d4eea2fcef41fd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230251, "uuid": "845c5b98-cff9-4ea5-b39d-5d1a8d86f94a", "value": "BF248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230251, "uuid": "fee8017f-a06d-498d-a5b4-b7094137fc4a", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230251, "uuid": "f4ba766e-60fd-4c5f-83cc-e2f18dac26e1", "value": "3072:f6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:foMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230251, "uuid": "1e2b1e4a-34b2-471a-901f-d6882867c276", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230251, "uuid": "1dc529f9-5c61-475b-bedb-6e1d23213141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230251, "uuid": "7bc62153-b4f3-4868-97c4-833b3af882e4", "value": "3bba5227f7c0c1d96850c48796e0371b607df412c3dada4ce0909226d772af6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb89e93-926f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617229260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229260, "uuid": "ae122126-ad36-4210-af6a-ca72e19b4358", "comment": "Malware payload (AgentTesla)", "value": "6c7002db101710365b6219f91dbb26c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229260, "uuid": "c25caae4-d4e7-4b94-b957-866981086cc2", "comment": "Malware payload (AgentTesla)", "value": "3bd345e6c29879a236d8a2538a35c3239f4718ea00337d05dd07330407c5cbf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229260, "uuid": "48ddc0aa-56d2-4398-8f0b-e79a35b3eec0", "comment": "Malware payload (AgentTesla)", "value": "24ccbcdd3da73f7c7bb043f4dd5258e833253178", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229260, "uuid": "91fbb2f7-3966-4847-98ae-b3f7e7003215", "comment": "Malware payload (AgentTesla)", "value": "2e90c9d8ee6a52afcb46e202b89536d54e4458a667d1322523e199c462c294b14b3a507c88a6bf1ab7542190d8aade3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229260, "uuid": "3a73a615-6308-4280-bbb3-dc39abf03555", "value": "6B72AF1AFC2BED0B6154F4706DA8F09957A1B23FD8473D6327D80CBAA8739902E44C35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229260, "uuid": "4c39dce8-3ec0-4301-90ef-60a8079a5931", "value": "192:/6/Og7lRjPmot0GG1R1PS4xLIp94DjNrTkMAY25zyBzakqKeum3PBbENBJXO7:C/9NVt3GL1zIp94DRTJ2LjKo3PBYfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229260, "uuid": "e9106f6c-b06c-41c2-99ba-0407e24258ea", "value": 16815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229260, "uuid": "8dae9008-3058-4ccc-a59e-de88c8a9b86d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229260, "uuid": "e0b41894-7497-4f76-b11a-38c5d0a3917e", "value": "0987500000000000000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5be758-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218328, "uuid": "1fd72c68-5657-4ef6-9425-a62c55d8d43a", "comment": "Malware payload (Dridex)", "value": "8429e418f518426496cf38944dd17eb4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218328, "uuid": "33a1c7e4-9f08-4f46-8134-7d19a37e2857", "comment": "Malware payload (Dridex)", "value": "3be1fda267e45394d0d40d14e926a4632e0e98051abe77c8b866c99b4492a571", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218328, "uuid": "79c27ee9-5084-4713-aff2-2245f3c61cb0", "comment": "Malware payload (Dridex)", "value": "950f1bfdad4d99e4948a1ece8ee326df2b74bb6f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218328, "uuid": "6e028ea0-8e11-4ab5-ba41-714ab1e9f580", "comment": "Malware payload (Dridex)", "value": "d156f54a875d8adde3c410e83dac2ae9532c091de6a60ed661f52e933bba0e8ba7db2281000af73ad0f3766fbe25cef1", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218328, "uuid": "3133c96c-4262-430e-8470-621bc3661382", "value": "2D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218328, "uuid": "6e8f7b34-4511-4ca0-afe5-6088427f003d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218328, "uuid": "96f7ff31-eb95-49ae-a131-e30551ba2e33", "value": "3072:lopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:KpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218328, "uuid": "72df9857-8b53-424d-8525-97c87859a583", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218328, "uuid": "faed7f38-5373-45d7-aff9-7ff88fbe7262", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218328, "uuid": "7d329ce3-12c6-4b14-a821-e9ff5b13369e", "value": "3be1fda267e45394d0d40d14e926a4632e0e98051abe77c8b866c99b4492a571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577566ce-91ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617172983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172983, "uuid": "3bc6f928-0b93-4aa6-be91-853106255de1", "comment": "Malware payload (RedLineStealer)", "value": "a4eaf46978459eb328ac728e81f1fd71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172983, "uuid": "e213eab4-4532-4dac-89cc-6e0a29918bf4", "comment": "Malware payload (RedLineStealer)", "value": "3bf9dda1aef416ed19671df2cb2dfe9dc47f386cf82a592e1bd26bd1ad15035d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172983, "uuid": "3f57e6ea-e756-44ea-8c72-d9cbfa62dbf7", "comment": "Malware payload (RedLineStealer)", "value": "d738fbb0ab1ef16c997f27d6b66cdfefdbb628be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172983, "uuid": "1d34313b-6dcc-4862-987e-879bc2a09163", "comment": "Malware payload (RedLineStealer)", "value": "07b9742af06fef480f085bfd56021478de184d2645feb409cfeb93a0c4ec95e0e1d4ccbc44f93e0d06bedb910e31b0e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172983, "uuid": "37383462-caa6-406e-b5c7-d9fcb3790014", "value": "C7355D1973E54B3EE4AE27B1B07646001330E243654BF72B9EC9A4E92DF37A184663D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172983, "uuid": "58cb9ebc-f4df-4395-ac6a-272068f3a39c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172983, "uuid": "73c1d0e0-caff-43fd-a8f4-61d2af5a569a", "value": "768:8s2cNHDt0esAzQY2GD24p5axVsOzZztpms8mi2eYlYQO79rqVBr0bOZ+sgGextl5:8INHDaGD2wIVs4ztYD2qNuf0bOAsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617172983, "uuid": "4a60a2bb-7155-4526-b322-76259828d30e", "value": 1071679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617172983, "uuid": "af9999f7-df1d-4283-9e16-cf4a6faa059e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172983, "uuid": "648abd53-f978-4334-a355-374d9c303276", "value": "a4eaf46978459eb328ac728e81f1fd71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bd4351-9258-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219557, "uuid": "d4001a98-dba8-4d3b-9234-54c2edc1f5ca", "comment": "Malware payload (Dridex)", "value": "6930eda3bf23ee2f2e35aefe3031c998", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219557, "uuid": "9956a9be-f1ed-4031-807b-3e0f89d7f523", "comment": "Malware payload (Dridex)", "value": "3c08e330e5a4a74a2eb5afe9b23798e9972b5e871bb54c285420603132ecbd65", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219557, "uuid": "24d7ac48-9730-4924-98ff-0b1e41bedc7c", "comment": "Malware payload (Dridex)", "value": "f99864880fae1ce561b97ca3379e23073a0e70c5", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219557, "uuid": "f6a9c342-235a-42f3-a00f-6aa159e82fee", "comment": "Malware payload (Dridex)", "value": "f57247820335040bd8b86d64a2bd29e0503dd5b3f88d34e764bc97a53ca09e2aa4d9f68f415dd1d0060c6e7df46537ae", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219557, "uuid": "ddf2cc30-c4c8-4a10-966e-b709b864557c", "value": "B314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219557, "uuid": "5a03426f-6c7f-4e45-b2f3-17e8381efeee", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219557, "uuid": "baa509e3-1935-44ed-b88a-6852ee0818d0", "value": "3072:Wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ppjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219557, "uuid": "b8c96568-865e-468d-93e0-688389329bd2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219557, "uuid": "a79341f3-93d9-4e65-8e8a-e8e411475b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219557, "uuid": "7babec69-361e-42d9-abd3-c4a10596dd5a", "value": "3c08e330e5a4a74a2eb5afe9b23798e9972b5e871bb54c285420603132ecbd65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c00dbff-9235-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204370, "uuid": "0ff1c862-16ff-4554-b268-2ffde34de7e3", "comment": "Malware payload (IcedID)", "value": "a0145b9552555a3a8a3178c4a0eedfae", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204370, "uuid": "d33dda42-56ae-445e-966b-92edccf2537e", "comment": "Malware payload (IcedID)", "value": "3c0c86e81c98250a8f594ebaac986a019902d568703d9f89490c50dac82d9f12", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204370, "uuid": "862861eb-80c6-4d80-a3d9-b93a0a8fcbbb", "comment": "Malware payload (IcedID)", "value": "7a04e17f3319c9839f889948baf03b9765474d20", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204370, "uuid": "18484c24-97a2-4bbc-8587-1a527cd7fa9a", "comment": "Malware payload (IcedID)", "value": "388fb0e1fe86ca4f207b11c0c3b489cb60c1fad6a10508574be28cc51b9742cddb0afed3dfcab81361efbd02d7d6777d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204370, "uuid": "107ca85d-11c5-42e8-9c99-56bee936ac6a", "value": "87B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204370, "uuid": "bfd0f325-ad39-410d-99ae-84328d31ce95", "value": "3072:M2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:MqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204370, "uuid": "3032a273-ecbf-49c2-ba10-eb97382b65af", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204370, "uuid": "8373e527-fc3e-4b7d-aeab-6f9f19032371", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204370, "uuid": "e89c3a8e-c5cd-4aac-a915-95286a638ddd", "value": "document-1687338102.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392e8b8c-920e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617187535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187535, "uuid": "0f2e82ea-34bf-4768-8902-a1cf3723f0ea", "comment": "Malware payload (RedLineStealer)", "value": "3c2b4c4920ccbb7456ea0539e596948c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187535, "uuid": "d5f2fe2a-f21b-4d55-bb8c-d6243d9aa8ab", "comment": "Malware payload (RedLineStealer)", "value": "3c3bee00c300584717e1c307e690d05ab1c6c98428d83ca0d4285fe24a9e1015", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187535, "uuid": "54ce209c-4545-4b39-96a4-1d521d520981", "comment": "Malware payload (RedLineStealer)", "value": "948ad5579c0aef35050ec330ce954bc84cfe2559", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617187535, "uuid": "05d16f23-8bfc-4f7a-9675-43fccfabfc4e", "comment": "Malware payload (RedLineStealer)", "value": "ee6c192ccfc7dd2453ceed69d891cd8e65fa5288db99294341bd3a210cfd94a35c34d79bc055ac318000d1fa3d8cf3bd", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187535, "uuid": "d2a968a8-e0c0-45bf-a923-a751ffd3532f", "value": "6675E0C47212754EC9A2D171C8E6BE3497602CEB133BD22B95A7319C697F867CF244E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187535, "uuid": "d8531acd-5aca-4f49-9b99-f920c311b645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187535, "uuid": "c4c4727f-b72d-4198-b378-a92563a65628", "value": "24576:mSusMj6FihoWxb5XwzCz6X8v/HK8ys0vGZpjy+mwmsChvSPOrGbEEdK:mSPMoWaZmfK8DZpjb4JKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617187535, "uuid": "18636868-1771-4e32-9090-3fea6c7888a7", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617187535, "uuid": "025f19b1-fa5a-4a2a-a208-73228706c051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617187535, "uuid": "2e96d9e1-5151-459d-91aa-fd9009480673", "value": "SecuriteInfo.com.Heur.17155.13989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006bcb4b-91e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617171119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171119, "uuid": "37bd0034-cc91-4036-8a29-ed9e1aefe00c", "comment": "Malware payload", "value": "5bd52514d0a0fc16cf29634d40180563", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171119, "uuid": "06d4e3b9-931f-491b-b8f5-cd43e4349958", "comment": "Malware payload", "value": "3c4e89ac707f0cd7b0a5aea1044e688ee2d52956554cad986969ae570154e9b6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171119, "uuid": "1496e5cf-519d-4966-8d82-4e082c4c3e93", "comment": "Malware payload", "value": "c35346a87b7e06adf63af95cd6d7eb925268c1c7", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171119, "uuid": "4f5ba878-f3b5-45df-a7f6-1c13ec628c12", "comment": "Malware payload", "value": "96a25c73553cbc8a56de77f00e6afd2e77284a53892c151bd5d9c3cfe74e2eeb086c712557c5f7287be0f8da6562e8fc", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171119, "uuid": "cb0139f6-003e-43bc-9c88-dcfd08430d16", "value": "A6C533197CD2C703DE2F0EF8C5952265386AAD5A890CDA43312879216239F7E77C2F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171119, "uuid": "aefd5e7e-3206-4946-a7b0-4db662b563c6", "value": "49152:/KlempSb5MT4YDPECHqVdKU0CYM+e5kVmMLDLKnnRot2k32DspyOPlawejxbu:7o4YLqohCZ5kVmMvWnnRaSOPneFbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171119, "uuid": "c98bcd64-5511-4ffd-93a2-6348d8c76ba5", "value": 2727424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171119, "uuid": "cc200bd7-1d34-4d8f-91ca-15c842e51067", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171119, "uuid": "5928f5e4-ebfa-495c-842f-d72113eb1cf6", "value": "DN2102-MDRTCL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169e5e12-9264-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617224413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224413, "uuid": "f8bb4b09-6dbe-4dbd-b47f-f2fbb04262c5", "comment": "Malware payload", "value": "7ba44c0034b3d8986ea5f1be1982b314", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224413, "uuid": "a94ad729-ff3a-450e-9f8d-5cba36d963a9", "comment": "Malware payload", "value": "3c7736c74214272cae712e2479409bfc46fcd230663c60f480340d4b563977e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224413, "uuid": "3f91baed-094e-40c6-8a4d-1fa4ab854778", "comment": "Malware payload", "value": "e140084178407f3e816b097be571c64689f3b2d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224413, "uuid": "a9a36d5e-4805-43c2-a1c1-b6b47a1396d5", "comment": "Malware payload", "value": "8654c2e3cbc64dc8a40c3c8980879984edfb51077177659df7fe4f264f4e038680ba06ea716be9824e82faedc3368dd8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224413, "uuid": "f436d2ba-3934-4cdb-b355-ecfc4a453886", "value": "72E533480C7689D2E8DF67079E8E94FA8415FB6BE17B829A7BAD9F103C4FD109017235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224413, "uuid": "c5ac0a95-ebbd-4026-aa31-51f9923bd0f6", "value": "49152:pLxl9nRpMwKKTUVWeIOesCWeHqOkl2uce1SFNeqawn/p3JYuVgdhSiuDLUPlV7jP:pdl5cw7AIeIOeVvqOksve0nl/n9KJywz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224413, "uuid": "4bc9ce7d-7d68-4164-91bd-04e05b78a562", "value": 3117225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224413, "uuid": "37682e1d-2ea3-4cb5-930c-34b259559811", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224413, "uuid": "b4340235-e3b6-4af7-b83f-7b1f9c8ac8de", "value": "updater.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddde6943-9239-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617206279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206279, "uuid": "d0fb6cfa-6b8d-4fcf-a685-7bf7fe6e3238", "comment": "Malware payload (IcedID)", "value": "623289a517323b3592a726cc1f69eae2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206279, "uuid": "bf6a6e5f-c89b-4edc-90f9-92d2780bf4b3", "comment": "Malware payload (IcedID)", "value": "3cb69b84100b2733f7eab72f4d90f81003494dca760bf587882a1ab85c666ef4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206279, "uuid": "21d1ac63-4468-4ab6-b098-35ad123d4b33", "comment": "Malware payload (IcedID)", "value": "a3cc38c297d8b1c267dd9998cb5fb51bee6214fa", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206279, "uuid": "215c0966-c089-43f1-b4b1-28cc887b6492", "comment": "Malware payload (IcedID)", "value": "53ba91164f7dbd418e2674447da124ac37ec4269cd3c3add80ef435a2ae08158f47c85139d76ad6679a712af534718bd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206279, "uuid": "b16b94be-4cf1-4de7-9b47-6041970222c4", "value": "79B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206279, "uuid": "197237b0-d366-45a8-89f0-6ac8b5f4f22d", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617206279, "uuid": "97f63e25-e7ad-4e6e-8508-2804660bfe88", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617206279, "uuid": "c3e698ab-0db3-4a42-aff5-c0ba0f18ad2e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206279, "uuid": "e86001c4-8c66-4df7-8df2-e74571f7192e", "value": "document-452263467.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46be6ae6-9263-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617224065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224065, "uuid": "5cbfc971-b0ab-45fd-ab0c-7f76a00b02c5", "comment": "Malware payload (Dridex)", "value": "ab6fab5ce5e18a1e242cc60dd3b8e236", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224065, "uuid": "6a5141d1-6f74-4587-ab9e-0313afe0703f", "comment": "Malware payload (Dridex)", "value": "3cc793cd70d72695d810337a7097374fa048d3f457df3d2cb6d289b03b88f7f8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224065, "uuid": "f62edd47-f0be-40b1-8777-1ba1c98993ac", "comment": "Malware payload (Dridex)", "value": "771604c2ead7be4c883c0e69ff144e21908cfa00", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224065, "uuid": "b0f9994a-8c09-476f-8997-62a4a21b29dd", "comment": "Malware payload (Dridex)", "value": "6315144bdddef321d45f0c1da462c2d3c46b7545d4cf243fcf1a4aff30a82c2dccde80b3e69ec2cfa3610da84cf36a34", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224065, "uuid": "a60a1850-9d1e-42f4-882b-c3526abdd748", "value": "AF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224065, "uuid": "3b735149-e416-4323-a397-70d49cac9c25", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224065, "uuid": "53aba5b5-5d9f-4108-95fa-f057183b1e82", "value": "3072:popj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:upjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224065, "uuid": "cccf43dc-28d8-4aa2-bac3-927482607e5a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224065, "uuid": "9e3a0e00-143c-49c3-b62c-dc7ebe454a3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224065, "uuid": "f9105422-4f38-4fe2-9672-2cafafce22fa", "value": "3cc793cd70d72695d810337a7097374fa048d3f457df3d2cb6d289b03b88f7f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5e3c3d-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213201, "uuid": "3a7cfff2-650d-4779-8ca6-af68a531c0ed", "comment": "Malware payload (Dridex)", "value": "fa1eddb531a6249582c03d20fe4da870", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213201, "uuid": "f7c03550-23c0-4e88-8ec1-605fae4ceb00", "comment": "Malware payload (Dridex)", "value": "3cd54e9591a1b581376470527eb5694783c4bbeb1a8b47606cab835e8b9aa51a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213201, "uuid": "87e640cf-46c3-44dd-b238-6e75f50f9be0", "comment": "Malware payload (Dridex)", "value": "3798a9b3714536574ba23bce25c2ef2a2e831212", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213201, "uuid": "e83ce360-992d-4d6f-a4c8-73c162b94a57", "comment": "Malware payload (Dridex)", "value": "007b09c514ba4d4487ce3e3bd9454e91a7b5984629dfb9bc2d535d26e098919e8404b72e7d0ab28900e85469047393fd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213201, "uuid": "2c32b3c0-34b7-402c-9554-24aca7b4ae2f", "value": "0B248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213201, "uuid": "e03da10a-cbdb-4212-a054-72798749b794", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213201, "uuid": "854d52ca-4730-4262-b4cb-bf780d864abf", "value": "3072:L6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:LoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213201, "uuid": "ed998197-4669-475a-9eb2-5d34360c0c23", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213201, "uuid": "62837651-67c8-4e5b-9956-735827be8924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213201, "uuid": "c1963825-f635-4adb-8a27-c74dbda6eb6e", "value": "3cd54e9591a1b581376470527eb5694783c4bbeb1a8b47606cab835e8b9aa51a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c38d9d-9238-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205593, "uuid": "54299b20-72c2-4bed-a652-74db619ecd10", "comment": "Malware payload (IcedID)", "value": "c8cdb2be4b6b0149c493a2e74b068c0b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205593, "uuid": "4d52684e-2394-4860-a587-e6d45cbe8948", "comment": "Malware payload (IcedID)", "value": "3d15a35a425ef81d74414ecea4c80bbc499c3c97ef62236ddaa396098fe8c8a6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205593, "uuid": "f517c443-866a-44f8-b9fd-2e9815086e1c", "comment": "Malware payload (IcedID)", "value": "72e707236e5eb6a8a76824cb3cabdb7a9432f19b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205593, "uuid": "9d0d8e00-03b3-4a13-918a-03631d5b678b", "comment": "Malware payload (IcedID)", "value": "94a89ddc523796325a64aa26c035ba0f908b86a007aa663bbba22f07df19a583b3a84e6a61fab1c4befcb62b53bd49a4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205593, "uuid": "ce1b3e55-fb2e-44eb-aec9-cbd514e760e0", "value": "0FB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205593, "uuid": "b70ad308-ef47-47cc-a86a-e8bf1fde2eab", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205593, "uuid": "09d7765e-8214-4f96-9ba5-18d69c9bca96", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205593, "uuid": "11a145b0-c2ac-4c69-a686-d3e12795fa98", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205593, "uuid": "87f1f671-832f-412c-bf47-3eb7d3f198aa", "value": "document-897378132.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe4005f-9261-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617223375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223375, "uuid": "92c7f0dc-d056-4a04-94a9-6a82a7e4b4d1", "comment": "Malware payload", "value": "b71acac2e7e2c0614a11735953e7cfe8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223375, "uuid": "161c31d4-7f97-4f6d-8672-77a3f59b615d", "comment": "Malware payload", "value": "3d1f77515d946e2e92d3ce79f75dde2c6effe68e265883f5290f02234f525e97", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223375, "uuid": "1fd67b27-f446-4635-979d-0c6377807885", "comment": "Malware payload", "value": "292d855f4b9fdf8bd585c15e9ece2a9d93b09830", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223375, "uuid": "0740b68e-0294-4961-b666-2f36710b2439", "comment": "Malware payload", "value": "d4cbe92afdf358feb352c7cd61a42cb7f51889150d786dfe6d1d8e2200db667ac0ac04f92eacfa52cde35015ad0d0e6a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223375, "uuid": "95dccda7-2f04-4b1b-96f9-0ef177ebfd52", "value": "30248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223375, "uuid": "579b04e0-ee00-4b5b-810a-75ee385789ff", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223375, "uuid": "8c2bc87d-3189-48df-b3cb-6e8b0af9ba73", "value": "3072:u6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:uoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223375, "uuid": "921746e6-48c6-4db8-ac47-90010574ad77", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223375, "uuid": "341941d2-16f5-4fbd-809b-9b68efe83d98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223375, "uuid": "aa50be5d-ab78-4b14-b10d-c379f92c0c7f", "value": "3d1f77515d946e2e92d3ce79f75dde2c6effe68e265883f5290f02234f525e97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6da9e4b-9266-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617225595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225595, "uuid": "de23c7ba-30be-4a19-9ae6-c8e8c6b82ca6", "comment": "Malware payload", "value": "dbc84ebee78691acf50270c2db78267b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225595, "uuid": "fe2e7cc8-c2dd-4afd-a59f-eddbcccc8978", "comment": "Malware payload", "value": "3d2da3ad8ba79ba8fa3e0a2c97ef89957bce8bd08bbf45b5f15f05b48428cc91", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225595, "uuid": "536b653d-6f2f-4dea-bf82-c548e131e93e", "comment": "Malware payload", "value": "71677db340b8c9da979fbd24412ac8eb20c69f1e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225595, "uuid": "b68c00f0-21f6-440a-8d4f-2b884d295864", "comment": "Malware payload", "value": "2622466ba01bc1c8757d42fa6c6cc8460b7f207aa210316fb4af04793e7c8686ae2ea8f1cb694013c1fae096699c554e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225595, "uuid": "f31ed4d1-8d3a-4b6c-b67d-1d5623450ccf", "value": "D3248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225595, "uuid": "5e47fcc9-cc65-46c9-ae7e-21606666e280", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225595, "uuid": "9bfedcea-88a5-4721-9fb8-8a064f19d865", "value": "3072:y6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:yoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617225595, "uuid": "0cbafd14-f5a1-40c7-a852-c7593090212f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617225595, "uuid": "3ed6c927-c26b-4d90-910a-f818095cf1c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225595, "uuid": "d3258a3a-274d-4013-be71-6c18397d43ca", "value": "3d2da3ad8ba79ba8fa3e0a2c97ef89957bce8bd08bbf45b5f15f05b48428cc91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b941120-91ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617174251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174251, "uuid": "ab941c7d-825c-422c-aea8-38c367f97d74", "comment": "Malware payload (RemcosRAT)", "value": "1b28caa377d4ea28c015706a540ba7bf", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174251, "uuid": "7bc92315-5021-4d81-9f93-bb0dc5866e02", "comment": "Malware payload (RemcosRAT)", "value": "3d3942a95abdaec775465dae2d11e9a79984086933344b12bb6d218f45d512a9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174251, "uuid": "9bfe3d8e-e158-404a-accc-33eeda50af11", "comment": "Malware payload (RemcosRAT)", "value": "b9191e449ed87f3b8ffa17b139249838c519749d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174251, "uuid": "94154c57-42c0-4cd9-9cfa-aa48f8bcd352", "comment": "Malware payload (RemcosRAT)", "value": "c08d4fb3bf64310511217da888226d8897758e66b18e7a2987ffabd3c6e6c9a3876ae38e585a60c16ba4ef5d3719d812", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174251, "uuid": "e7ad0236-f8fc-4fb9-bb6d-e270a6b6bc95", "value": "CA54239AC0AFCA9CBD8F10ADF7BBE4741348B222294C15D435438BEBD46E0935E4E51B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174251, "uuid": "16307f9e-a4fe-4330-976b-e5c50560aeed", "value": "6144:pxgEdQmIjnxp2pybcLfZZcniF3IBYPlvRojsOIqow:pxgvxjnzjUZOnEtFRosqow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174251, "uuid": "8dcdedf6-4526-4d61-b0c0-c62b112d81db", "value": 295866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174251, "uuid": "a7e2d007-9ea2-4767-93e1-7ed69e7db2b6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174251, "uuid": "2c14be61-0c8c-4318-a6bf-78a41c5dc16e", "value": "IMG-001982-AW00173-SSE73I.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31392ebc-91e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617171200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171200, "uuid": "a06f8572-8e85-4e2c-9968-de7c5a2d7348", "comment": "Malware payload (IcedID)", "value": "3d21ae92a78a5fd3d33d9b006aa1935e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171200, "uuid": "bb980b0f-97f6-48db-b0df-88f6f96f1b41", "comment": "Malware payload (IcedID)", "value": "3d3d55f7c8e4bed9b55dcf89cc1176de4f2820610c76497668271911a338eb28", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171200, "uuid": "18f12ca3-6177-4930-a092-8adcc6cac5bf", "comment": "Malware payload (IcedID)", "value": "006aac146f4f269aa37ed48486080eff29d17b9b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171200, "uuid": "a5d7ca31-4cca-47cd-bbff-ad1788e45529", "comment": "Malware payload (IcedID)", "value": "584827b6723e40dffbce8864068169c1122c466b261de9796c585b8fd5befa5c76179897c87d461a30f4233145d40af1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171200, "uuid": "530a19a8-b228-4d9d-af12-33db08d80352", "value": "D6C35DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171200, "uuid": "05260e77-519f-42bd-bd26-e59de90db223", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171200, "uuid": "095d14f0-8265-49dd-8e00-228c5fc33cac", "value": 119164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171200, "uuid": "cb14ec7c-374c-4ae0-b445-84be1ebf2d33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171200, "uuid": "4489f534-25d3-4b64-9f21-e9b45ee0ab18", "value": "3d21ae92a78a5fd3d33d9b006aa1935e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9417d7-91d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161932, "uuid": "6c74678e-7e80-41cb-af9f-8ee515c60e67", "comment": "Malware payload (IcedID)", "value": "b74d6dd247b826b38c808727fb155334", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161932, "uuid": "4e939b77-43dd-4234-abeb-83cba40663ec", "comment": "Malware payload (IcedID)", "value": "3d5d4411df6a0c3c2992701c8748f5a5634537107e6a6371c33114c44e455077", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161932, "uuid": "7693c372-4802-4cde-927f-c407bdb923c7", "comment": "Malware payload (IcedID)", "value": "d9876645c92a98e0e14563169ece397f6b52e22e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161932, "uuid": "86cd2b5f-a1db-44bf-9820-25aeb150525a", "comment": "Malware payload (IcedID)", "value": "7679d541bc5ee7df3fdffa3cce71af07871d5001a8f4b0e844de90df4edecde7ff65688215eb0ed642617df9a3f92d1e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161932, "uuid": "d38e64c6-0cd6-45c2-9e84-22b507558f5b", "value": "34B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161932, "uuid": "22352efb-546c-4649-9b26-38c6f14940c0", "value": "3072:S2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:SzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161932, "uuid": "10d472de-31a1-472c-9435-bee6ea618d04", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161932, "uuid": "e95d5694-5490-414c-8a66-ab93f3c93921", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161932, "uuid": "874da608-535b-45e3-a646-e15c361b04f8", "value": "document-1008963425.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef0d8a4-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160432, "uuid": "e1954268-751f-4952-bd0c-8fa074e76fae", "comment": "Malware payload (IcedID)", "value": "79a10ca7ca3daf2cd97c6c97b846d0e7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160432, "uuid": "e35d52b3-031b-4bce-971d-b3119b1f1a46", "comment": "Malware payload (IcedID)", "value": "3d760c3637e43fa8be14646dbe9f8b101d53f4727329096292c662561f07c701", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160432, "uuid": "88d7861a-783b-4212-8935-1899fa4e4888", "comment": "Malware payload (IcedID)", "value": "1b799f8d925a7eb3b1e0e40ed1ec8c2747dcff72", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160432, "uuid": "0aeb6c93-e249-47f9-8fa9-24160db6dc7b", "comment": "Malware payload (IcedID)", "value": "9ce0804fc4ed8c243c885a0766576ce01c5f2fd065690cc41a5fb4f8743b650c285e861050454942f4cdeba918d47a14", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160432, "uuid": "0acda14b-edf9-42b2-8bd0-afaefb38fb8a", "value": "2CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160432, "uuid": "5cee7d00-14cf-46ba-ac75-ffc66c9eb478", "value": "3072:s2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:szxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160432, "uuid": "4efea67e-8d14-4cc2-8a22-56dedf576444", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160432, "uuid": "ffb99c96-730f-45b6-a413-ce67cfda304e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160432, "uuid": "7af5c198-414e-43be-894e-cc3843f811a4", "value": "document-1559875400.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f316a5-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199287, "uuid": "3bfbd0ba-a34e-4d0d-850d-b7c5ccad64d5", "comment": "Malware payload (IcedID)", "value": "2973918896d79feb90d2a92cb7273ede", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199287, "uuid": "a832af03-a911-48f5-9f47-0ab9d45fad53", "comment": "Malware payload (IcedID)", "value": "3d9059522f454c49897c44dcb96a825b46e003554202b862d000cabfe362f504", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199287, "uuid": "cfe4c5b1-cca8-4ec2-a31b-98bf256a498b", "comment": "Malware payload (IcedID)", "value": "af6fd9f0024b5b796d6b618e1fd5d3f81d0b4a1c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199287, "uuid": "251c6fe9-7974-400d-b769-4fb408e9ad3f", "comment": "Malware payload (IcedID)", "value": "fa1bcb484c3ae484a5ac9866f22474900199ee25dd711db7bc771632d6bbd04341fa1c90e3c40039713d3a5073a8db37", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199287, "uuid": "0f7df4e9-04a8-425d-b21f-45a2e6b2ec17", "value": "E6B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199287, "uuid": "98f4c07c-4e9b-4cdf-9d4c-72c01fe48527", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199287, "uuid": "8459a84e-d47b-4307-b176-3b67a00cb48d", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199287, "uuid": "495676a5-39b0-4fce-adff-2a4dc6e4946c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199287, "uuid": "4bb4b77a-a9b6-44e7-bcb8-075b2c053f4b", "value": "document-1651875307.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9a1620-91f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617174763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174763, "uuid": "b39f55bf-7f12-4c57-be19-28ba91f3a125", "comment": "Malware payload (Formbook)", "value": "966c80f3d54f3164d6616e8a62e74bba", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174763, "uuid": "a34bfa48-c7a6-4f02-b1b6-d42a928340fb", "comment": "Malware payload (Formbook)", "value": "3dd127dc91198b5fa535d083f4d7a4be0ae244ff9a45c92b25c8a5c4c3962077", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174763, "uuid": "7aea6586-2fb7-4679-9cde-fd43d84d4394", "comment": "Malware payload (Formbook)", "value": "11f4144e9bcff562bf9466bb09c0d522dc0eeccf", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174763, "uuid": "dcf1b717-62d0-4df2-b876-c0707d9788cc", "comment": "Malware payload (Formbook)", "value": "5733350e0e39a1a21bbdf5401324bc1612ff8a10649c4d178cce1f6a575fb48df05574daa478d4c22c708006a8d78302", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174763, "uuid": "e01a9a00-4c44-437a-93d6-f6aaed00216d", "value": "7AD423FD438718E8FCC4478C16F928BA81538E2E84575D768B2396BEAC16C7015DF1AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174763, "uuid": "6e1efd7d-801b-4670-824d-227097240b4e", "value": "12288:yciO9qw2E2cddKxhn1cTh5cn2SJ6BPOL2idtnLRlBsF9PqR1+c:ycii2gj4x1u0WPOlTnLRlBsFFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174763, "uuid": "aa2f6fdf-48d5-4249-93a1-24c8b9609140", "value": 636344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174763, "uuid": "940174dd-dec2-4860-957e-1e37402520df", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174763, "uuid": "a6bd1996-5cf9-46a8-b49b-313511cb6f56", "value": "HG284-2021_03_31.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883b413a-91e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617170487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170487, "uuid": "7b683d19-f975-4786-a94d-2f909a30e00e", "comment": "Malware payload (Formbook)", "value": "1c0773c39e2e549be4f24565082e2fb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170487, "uuid": "603f6a3e-4059-4437-83da-e0d5e40cbbce", "comment": "Malware payload (Formbook)", "value": "3df2cc414d6cef0d973d0f47141a13be183a9da46e0455940affe5d24b9c2f9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170487, "uuid": "33f5bdcb-1fdd-4dbf-8a73-05d78d2cf9fa", "comment": "Malware payload (Formbook)", "value": "bd69f1c092038500e9a0a92c72d3eeb63d0d0c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170487, "uuid": "b7802676-ec25-4dbb-a4cc-1d8cf6b9dda2", "comment": "Malware payload (Formbook)", "value": "5f00036c0b24153e1ecd9dd6904b309c7990f165eaa1613b545de2235a772354dd3b885cd3d8557f7523bcba5dc6f0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170487, "uuid": "47afc9b5-61a4-4ad5-8db9-cf7576d657d3", "value": "A7F4E015321ABD42E03E8BF140ED4B5177F357C48319E97DBC9492888AE36C7BADA6C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170487, "uuid": "74334ab4-812e-468b-827f-546feba005d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170487, "uuid": "32f4f5ae-0fb2-4675-8e9b-96a68b9007dd", "value": "12288:Sc933fRwYIhkrSIACFJUSMB1A/j33dNOxvNydFo0aKfht4p9igeI35yzaiq:Sc9nfGBhEStCFJpw1AjdNOLydF4qE0d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617170487, "uuid": "c8ee9478-b078-4390-944d-c3bdcc22a406", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617170487, "uuid": "1f08a360-4043-4398-8643-741bf0489ef8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170487, "uuid": "c113a6f2-2a24-4f22-8a34-f85e5e2dc084", "value": "Price list pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6994be7-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218212, "uuid": "34ff8af4-9ccc-43d9-8dbd-fd81bb608e2b", "comment": "Malware payload (Dridex)", "value": "b312e5e1f9d92eabba074ff3d33fb39b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218212, "uuid": "14f6071c-3ad6-4735-9dc0-c1e4b87eae14", "comment": "Malware payload (Dridex)", "value": "3e22b53bbf30e57395c17234b732acd7675ca95ef4402cca2e4a6dc3638f3c47", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218212, "uuid": "55ba29b3-2147-44b4-a1b4-96717da1f4b6", "comment": "Malware payload (Dridex)", "value": "41cf17e1d359dd493cc0b692955a15fd41676d96", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218212, "uuid": "8451aa08-495a-4a68-b35a-95740e3bbda3", "comment": "Malware payload (Dridex)", "value": "b9a5887fa58bca7c5f69d05a682561a5039986d18cf0e59e43066299e5193c72214c0bb15ad0f8319d48dc075a53a13c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218212, "uuid": "28637406-33e6-48dc-96a7-3667b66a9624", "value": "4E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218212, "uuid": "509b059e-526d-4169-895a-ba36a281568d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218212, "uuid": "f8aa0442-62e2-4f91-aac5-efdc5d9353e0", "value": "3072:zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:0pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218212, "uuid": "cc41f47e-8471-45e1-9fba-086e692de5ab", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218212, "uuid": "6a1bb4ee-86bf-4ac0-92ce-a8ea1200fcea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218212, "uuid": "1b35e70f-1767-4d5b-bc3b-48fe82437866", "value": "3e22b53bbf30e57395c17234b732acd7675ca95ef4402cca2e4a6dc3638f3c47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9626bcb1-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617231070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231070, "uuid": "21141b97-b171-41e0-ac8c-e1d130664db3", "comment": "Malware payload", "value": "38a086a9b3089567aa894e19640102ff", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231070, "uuid": "59792bfb-f8e5-41ea-bdf2-86802c844095", "comment": "Malware payload", "value": "3ee104beee6760134473d99307c9730dc370933f4d1079b0170ac8e5846860b8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231070, "uuid": "fcb7d996-6906-4104-bcad-68c90c88fc92", "comment": "Malware payload", "value": "269bcee6b67568444508e93d19b7287071544c55", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231070, "uuid": "0bb39c0e-07d0-4c5e-bb07-f75abbe67c8a", "comment": "Malware payload", "value": "16394d717374b2954ce47c4dff0d4e720680fdb2d095743d0eb1aabd4aa92f551fb6ed0d5cec89c02126a224899610da", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231070, "uuid": "5677badc-38e8-4cb9-b895-9df684e945c8", "value": "FE14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231070, "uuid": "181dd1df-b541-43e6-b16f-593062fc21af", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231070, "uuid": "6537013c-a850-4b87-a2bb-a0d0523cc906", "value": "3072:uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:RpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617231070, "uuid": "952c9c7d-d61d-40a3-9d88-8d33019fec15", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617231070, "uuid": "1372005e-85f4-4aeb-9244-72f85ff21c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231070, "uuid": "a6960fb8-b9ee-48f7-b547-848a36181994", "value": "3ee104beee6760134473d99307c9730dc370933f4d1079b0170ac8e5846860b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da1ded1-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204668, "uuid": "55ef0db6-3475-4967-80b1-3bbd6d6a47fb", "comment": "Malware payload (IcedID)", "value": "e29a51af92e4f89245785f2206beb550", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204668, "uuid": "cb1efb32-165e-4642-a56d-aee5d4cb9bdd", "comment": "Malware payload (IcedID)", "value": "3ef057e03d489fd8d7ae8d9d366a49171bd55538914ae7fd94f69c1f8382675d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204668, "uuid": "e530cf6b-78b9-4d02-a45e-0c2a95d9fa33", "comment": "Malware payload (IcedID)", "value": "959f248e005cd187dad5c9910d67eea1b90e3968", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204668, "uuid": "58536ce0-f915-4525-ac0e-698fd71dfd4c", "comment": "Malware payload (IcedID)", "value": "1f0e332aa5c5c45e3a3be484a154ce614bcf30fa2b3a3125fc70cdd58bf4c9d406d85de0aa4ddbc39d379a42437ba122", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204668, "uuid": "b515cd71-6b96-4c7e-ba97-85a7d02fda5a", "value": "DDB3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204668, "uuid": "8899f8a0-2896-4586-be75-bf44d29e1cb4", "value": "3072:M2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:MqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204668, "uuid": "746befb0-8366-4aa2-99dc-fdfe2087f69d", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204668, "uuid": "b6d32a50-bcc1-4757-b85f-4e2426995517", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204668, "uuid": "2b4b3291-3ee5-4c4d-bcf5-7f05e43bdc61", "value": "document-1552399001.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b0276c-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213381, "uuid": "51d8ab40-634c-4082-81bf-509a5b05d5af", "comment": "Malware payload (Dridex)", "value": "a746a062a8cad613b709f118b6922af3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213381, "uuid": "ce8080e3-7108-43fc-af3b-f32e801e3af6", "comment": "Malware payload (Dridex)", "value": "3ef56a28d2dbe909d4c90f2fb73e2c74d6797c13695731ddf6542da68fa81d98", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213381, "uuid": "85a7f9a0-9085-4cf8-9abb-1fb61ff67e6c", "comment": "Malware payload (Dridex)", "value": "e32c24af918df0fe418f88a30bd0053fb2faae87", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213381, "uuid": "c373b8a0-83a8-4edc-80bb-bc2916928499", "comment": "Malware payload (Dridex)", "value": "076e59e1c54fccd816b7217c7bac74c9395d2ac8b7fbff806757e83b6a8fc9fdf760def9afba48cee712b4e4d6283c74", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213381, "uuid": "a6043e33-f871-48bf-8e1e-3daf84f7cc37", "value": "F7248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213381, "uuid": "cb1e22ea-5c39-4a79-a51e-57757e03f56f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213381, "uuid": "bb183513-8eb8-4e6c-8482-c245852e6097", "value": "3072:+6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:+oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213381, "uuid": "6375fbfb-da66-47a5-8d21-6b17a801b4f1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213381, "uuid": "7016d7cf-27e1-4e6a-883a-376aeef0e069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213381, "uuid": "2c58b2f2-845c-4046-95e1-0fc4bb53cbc8", "value": "3ef56a28d2dbe909d4c90f2fb73e2c74d6797c13695731ddf6542da68fa81d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42244a40-9238-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205589, "uuid": "cf864b86-5aa6-4a9b-b39e-2da87760aa0d", "comment": "Malware payload (IcedID)", "value": "582a49f0490d06546f52faa711a3d522", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205589, "uuid": "a03cad0e-91b6-45ce-bd25-26be31c68576", "comment": "Malware payload (IcedID)", "value": "3f4688713f7809f969ed1693bb6b55e673fe98583c9a3f7c6da97f23f61be9ea", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205589, "uuid": "b8cc9c18-c07a-4e31-bab1-1b523705008a", "comment": "Malware payload (IcedID)", "value": "08c7b55e2f016a65fe631dc8b80a5e7b2b96a161", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205589, "uuid": "1426f196-f08a-4cf1-9f46-7972c012c00c", "comment": "Malware payload (IcedID)", "value": "79c118f7e602a04628d2aaf6e3a5587cb56da771cba40576ec6a73424b307f3077e95f988afcf0dda8dba7de8c302bd9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205589, "uuid": "07200ef1-9648-4b1c-8d72-e7948d5ec526", "value": "39B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205589, "uuid": "ebcf2507-b5b0-4ac2-a8aa-c3468a75146f", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205589, "uuid": "d807f5d6-df53-49e3-ac26-50fd6e486d01", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205589, "uuid": "67f4adc4-3868-43c1-9a1d-d2d9ea9f842f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205589, "uuid": "5a6cb546-a1d1-4710-a058-fc9b606981db", "value": "document-1010193491.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6e8c01-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223004, "uuid": "61779f75-741a-49fb-bdb5-bb3008b4863e", "comment": "Malware payload (Dridex)", "value": "9ca631c7054ce99f7256917fb99ee7ac", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223004, "uuid": "52d7af79-4bb9-4813-8997-0ad11e1ea7ad", "comment": "Malware payload (Dridex)", "value": "3f98100141d2c5cbb90f9f375863e2cb8b572308c8c9f82b00195c20d59ae725", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223004, "uuid": "607b7466-2b6f-4e7b-bcb7-a165b7f8615d", "comment": "Malware payload (Dridex)", "value": "5ad59af4f99ff099ba8c05a91017085de8f814d7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223004, "uuid": "1eeca373-3792-4978-b6ee-80e93fc0bce3", "comment": "Malware payload (Dridex)", "value": "acf3bd538d9236977250bbb381eb11ae8c1d3460c25f42d853dd5c3f7ff265a5d0aa3d61ed540a4a92a58c6a45a99f0d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223004, "uuid": "2c86e8d2-9ea1-44db-9c5e-e7e7b889158c", "value": "41248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223004, "uuid": "de0049ef-4df0-4cb4-94bf-1b5796803525", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223004, "uuid": "22b9f4fe-e91e-48d9-8f03-b8fb9c58efb2", "value": "3072:V6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:VoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223004, "uuid": "492570d2-e16a-4b01-a04f-6cfddff8b865", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223004, "uuid": "069ddace-7473-4160-a890-4dbd8eb7eb9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223004, "uuid": "fcf78f93-04ff-4fc6-af09-f9fb6ae3ce80", "value": "3f98100141d2c5cbb90f9f375863e2cb8b572308c8c9f82b00195c20d59ae725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ecf890-91fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617180632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180632, "uuid": "b95ae988-974f-4520-8bba-1d6feedfd71f", "comment": "Malware payload (SnakeKeylogger)", "value": "8ec48d6b3c508eb2b55cc4d2bbbe689e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180632, "uuid": "c7411c7a-2f8e-4024-84ee-d46b5aee9492", "comment": "Malware payload (SnakeKeylogger)", "value": "3f9d5b3c82e841a570d286b23580f0a039168d5f588042922267a6b1fd279e40", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180632, "uuid": "db483d7c-f4b8-4631-81e7-090fe621450f", "comment": "Malware payload (SnakeKeylogger)", "value": "1c40a9d24d073c03474342fba559164134522078", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180632, "uuid": "8a240581-8292-48b6-8cc7-f75bff437e8d", "comment": "Malware payload (SnakeKeylogger)", "value": "bf81ea6ecc6e587aaae5c7ba2641cb84edbf7f87122098c238104278b19eaff6dfdeb09f4a3b1db41552600e138efb03", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180632, "uuid": "95c331dc-fa4f-4780-8ade-161f8554f6be", "value": "0AA3D227BAC6CE73C1481F79E2407B267A700883DA489B74504CDAFB74CEDA5B25ED58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180632, "uuid": "d3f5412b-063b-4d9a-9e62-f8c88ead2919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180632, "uuid": "0d142133-0fe2-452c-b8e9-11981cdd48de", "value": "384:OnvIqZQySdNBYxGMoH/JBINoDLWaQgXqXfXDX60XeX5XqXhXsXAXSXbXsXCXsXpa:+Zm/Jsh6ZKYy6cQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617180632, "uuid": "fe16e235-8868-4c29-9b8a-d00f0f60e469", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617180632, "uuid": "00472027-885c-46d5-a7e0-22a601e48e8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180632, "uuid": "42d92a80-aea8-443f-bb96-c05ac58b44a3", "value": "SecuriteInfo.com.Trojan.DownLoader38.17696.30952.30777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26526aaa-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160445, "uuid": "70156db4-0cf5-4e02-bb9e-1c58baa361cf", "comment": "Malware payload (IcedID)", "value": "8a2947b4fed01d1eff05cca97003e54b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160445, "uuid": "dfb0b0f7-ddd1-41ed-89ab-7dad5bc43ce2", "comment": "Malware payload (IcedID)", "value": "40282044879a834c661ac70991c816175e846992d366ebf5af7bb6931b8b2da2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160445, "uuid": "0cf0523c-7135-4e22-85f5-444289d82b64", "comment": "Malware payload (IcedID)", "value": "482a46b5d453706a3c5abfc3fca09c75c1ebabab", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160445, "uuid": "6b968a78-9014-4fe4-a668-aaef4fa535e0", "comment": "Malware payload (IcedID)", "value": "42a2e7c8cfee5589a1849812e970076e578149aa883418e643ffde39c0be8f26a2fe37e01e325d9ac18f94cda047c17e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160445, "uuid": "e5bf808e-b119-4d38-9ca2-a6094bc9ebc6", "value": "88B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160445, "uuid": "615ca01b-82a7-451f-a774-7f7ea1b12b56", "value": "3072:C2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:CzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160445, "uuid": "78d57faa-45f6-4c5a-8cfd-3df6a13bdb97", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160445, "uuid": "ef049121-b0f0-4e02-8484-b24d9803b45a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160445, "uuid": "a85c447c-5e73-4279-8d4e-54ff26269936", "value": "document-1975036826.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d1cd07-91fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617180627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180627, "uuid": "af4484f9-a2d5-4fb4-ac48-2f3e0c5109cd", "comment": "Malware payload (Formbook)", "value": "489955bed03869f71b4f9639f2566905", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180627, "uuid": "a7c4b7aa-d341-44a5-900a-2d272645e12a", "comment": "Malware payload (Formbook)", "value": "40628d32ef0746f397d0d41b839530eae24d249dd2f414450a8d9dda03741d10", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180627, "uuid": "48914625-ec8d-45ea-aee5-9c9e1acf5856", "comment": "Malware payload (Formbook)", "value": "d91edbe0f109370c41af0163c9ca6c49a9ae533e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617180627, "uuid": "ab79df26-1c57-4e6b-aa69-9465e111730e", "comment": "Malware payload (Formbook)", "value": "73141f6510feafc17def9a17291f38df51346761d8c3298482e9edb1e358483dc8c1e90b9ce8c6d7f0699a35557a7527", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180627, "uuid": "1ae374e8-b557-4d7d-aff9-3e6bff561e4f", "value": "482412892FF2E03BDA0517F5097B5732F3F6B9102E480A3B97265F6D3D60596D61220E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180627, "uuid": "d3ad17c8-3e5e-417f-aa3a-2259d38f0a80", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180627, "uuid": "ce5339e9-e8df-446c-adf2-19fc9627f3fa", "value": "3072:nTs3BxJNmJNV8GhNhDh09Ixfbewvm0C46i0MZA47zb6zDX0at7XO7tXYsne3X4Cd:nAPXGbpG9IxzsMZjzb6P0BdYFX4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617180627, "uuid": "6693932f-de28-43e4-be91-05261c2a6754", "value": 221668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617180627, "uuid": "b9ad882f-8b25-450d-b4b3-7992148e8332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617180627, "uuid": "dfd8e2c9-e8a1-4ae2-8a01-853360ab42c2", "value": "SecuriteInfo.com.Variant.Jaik.44831.27142.27292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cec49d-91c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157650, "uuid": "d8dd7926-9e29-4955-928d-b1d91ffb90c7", "comment": "Malware payload (IcedID)", "value": "28f14a643b78ea56b6b0142630db1eb6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157650, "uuid": "495833ce-690a-4117-914c-6385adf6ef51", "comment": "Malware payload (IcedID)", "value": "40ca4c6fb16201693b16bd6a19d9193d1c45154a76a8dc6969b821464f2d5d37", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157650, "uuid": "3f7e4e78-7c88-4383-91ab-47163ed350ee", "comment": "Malware payload (IcedID)", "value": "3e378f415777c1fa98031c05299403a2b440b0e5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157650, "uuid": "bd6b982a-aadc-45a5-91fa-08319bb4ea02", "comment": "Malware payload (IcedID)", "value": "b1b45a09d95d0be2943a87beeaa1f6a2956943de36c28f5fb7691b3fb47e5973e90faf6e61887c8504eb4d2609923913", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157650, "uuid": "de393731-a1d9-4d35-b879-b01157828fd4", "value": "74B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157650, "uuid": "9853d38b-3dbd-43e5-b7a1-ef358ccdeb7c", "value": "3072:S2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:SzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157650, "uuid": "717a406e-4e2d-4ae9-a1fb-1f7c3ff15b48", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157650, "uuid": "f30c0e7b-4368-40ea-9b0c-d8d626a19be6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157650, "uuid": "b1655485-61ef-4529-af28-dc99a2545e6f", "value": "document-663560925.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753ecb81-91d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163154, "uuid": "d5956888-0a4f-4744-a221-ed22292f18cc", "comment": "Malware payload (IcedID)", "value": "ed22bbb5936b834f904be450bd386695", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163154, "uuid": "8ba2e315-e6ee-416b-b86b-7bfd4428d774", "comment": "Malware payload (IcedID)", "value": "413257e3705d79411156396fc84aeca6a922f5bd7795664a3336b640259423b9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163154, "uuid": "f0d90943-41de-49ad-b568-c128f6b970e1", "comment": "Malware payload (IcedID)", "value": "4124eea59cf5564184b07ae4bf8248a24278a643", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163154, "uuid": "a266dbaf-a49a-414d-8058-18e2b11d366c", "comment": "Malware payload (IcedID)", "value": "10cbee5f2e8e70c849059693c953a7a72c7dfb2b09ab85aed5291f1d889fcf09a4f60d23db7b98e4e2f74386d7a1604a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163154, "uuid": "97ed9c47-8b06-4661-97bd-8cff0190e662", "value": "E5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163154, "uuid": "c3b2184a-40cd-4acc-a53b-7b38d92c5d21", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163154, "uuid": "e33b1aed-c4c7-47c5-ab30-19938362144e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163154, "uuid": "2594108a-eca8-450b-90bd-164624fe6473", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163154, "uuid": "360f31c5-4b33-4d55-a873-2ff48c4cf931", "value": "document-2110688318.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2771677-925c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617221212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221212, "uuid": "82d82f14-c056-4c33-8be9-97f16c9eb3b5", "comment": "Malware payload (RedLineStealer)", "value": "2170854d93acf02e3104768dcd7372d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221212, "uuid": "70659bfd-379b-4208-9e3c-aec59b50cce5", "comment": "Malware payload (RedLineStealer)", "value": "4183961eab431f225c3e9b2ffecb8960575e83f8d14ee4f8e5bd335958271030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221212, "uuid": "eaf6953d-2edd-4091-8b21-c63489f3b518", "comment": "Malware payload (RedLineStealer)", "value": "8363d76ab878538f61a3f54e71efaf1dd5312982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221212, "uuid": "02430a6b-da49-4f1b-b144-96dd8e10ce7a", "comment": "Malware payload (RedLineStealer)", "value": "171ef08af322d270c9544d85d8a272bac62b489c8aa8a5ad170e119d7835227de3955e4fcf03cbbfe5a4bc7c12eda68f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221212, "uuid": "35ddb6a8-f4df-462c-b438-e83f8931536d", "value": "DF74010135C1C433E59669798974C3F14A7AFCB21F2595CBBB843A2E5E362E29B32713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221212, "uuid": "cc7386d4-ab45-45fe-af40-7d305bbe0b26", "value": "63a73449ffa402e797523b0dc39eb2af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221212, "uuid": "5a614f12-64fc-47dc-94c9-4dea312cd993", "value": "6144:uCy1UR7LfRavRWIrC7xR42WNFW2N50Kdpk8AoTpH64LyDUQ+gbsemX1Yg97arB:uCoUR71avRJraxRENQifk8rUDUQ+gwPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617221212, "uuid": "469cbbcb-227a-4dc7-b405-7f6ee8b7e11b", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617221212, "uuid": "b98645de-500a-442c-844f-a02b43968c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221212, "uuid": "b541c475-ff44-460a-84c9-0ea011e33781", "value": "2170854d93acf02e3104768dcd7372d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dca0867-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202118, "uuid": "dfb54ea6-6c42-414c-8f7e-6877b451f086", "comment": "Malware payload (IcedID)", "value": "56870106e4178e9d9e605b83e35ceed4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202118, "uuid": "d56835d9-3ed3-4df0-bba1-0c101c83a014", "comment": "Malware payload (IcedID)", "value": "418c94e4cfe04ff687cd675fa9f74a602a9e1f5881a99c9c42b3c084ae3d8dd7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202118, "uuid": "d89d6eee-da09-4d13-a8d9-77417cb8b17f", "comment": "Malware payload (IcedID)", "value": "3e271cfd5f09cd1b698b3ec59fd3185ce8b166f0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202118, "uuid": "5f3f0eef-6bcd-472f-a198-1d88086b6e29", "comment": "Malware payload (IcedID)", "value": "e2fb1b299926a61cb224fdfcd86385587748e927a0f214615e59175a557057e90d0b3e0441c1dbd0609efba4598b790a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202118, "uuid": "70072e7e-8e12-4f69-8b1a-ac08774ba8b9", "value": "05B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202118, "uuid": "801df8f3-a42b-4225-b00b-28feb4dd208f", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202118, "uuid": "1373f305-27e9-4e76-b4a6-cad75fe3f484", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202118, "uuid": "f847dd0d-9358-4c25-91bc-3729d3824f33", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202118, "uuid": "a1d6acce-9ef4-4ffb-9508-a62c0184c856", "value": "document-786687264.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69145971-9216-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617191051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191051, "uuid": "e2a3c7ed-5e96-4023-a9b7-184e5c316ef2", "comment": "Malware payload (Formbook)", "value": "5a0862c6200ca569f9fbec85c1046c2c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191051, "uuid": "84062b44-54e2-4e40-a929-237798586b3e", "comment": "Malware payload (Formbook)", "value": "41d1baa905b28a22e738f7379125e26301e240815e85ef0492b6061432cfe139", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191051, "uuid": "45617558-d4a4-4eec-acbe-328126b3c05a", "comment": "Malware payload (Formbook)", "value": "200970459d9549993f3eb9b9916cb37fb3561d5a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617191051, "uuid": "705b4849-3964-4f9c-aacb-9559611e8ce0", "comment": "Malware payload (Formbook)", "value": "dd65f467702850d9ebe6bbc7a022ca805825d35dc5dd92e16a9dea0242a4e199bf775a8385bd8311b81d4fa78e64690e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191051, "uuid": "5512225b-1cbd-4593-ab94-1fb837111078", "value": "49F4D010320ABD51E07E8BF500ED4B4177F397C58305E97DBC9492949EE22C7BAEA6C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191051, "uuid": "e8b67711-0bb8-440c-a77b-590fafdf01e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191051, "uuid": "e73e52e5-695c-4da1-89b5-1b2808fa6c99", "value": "12288:7mWXmWfWXYIhkrSIACFJUSMB1A/j3OqlZ2UuoXqXHaz2cTnbs734cYQ/g8UAAzae:SW7fCBhEStCFJpw1A3PXqKKczbEocYQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617191051, "uuid": "a31a2708-2f91-4edd-9ca5-e007db54f913", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617191051, "uuid": "a740fcfe-40fd-446d-8051-eddbc8b0ebef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617191051, "uuid": "950c44ca-0ae6-4b76-8141-e70f2279866f", "value": "SecuriteInfo.com.Trojan.PackedNET.576.8600.16096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e772e5e1-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223046, "uuid": "fe90b4e0-38cc-4266-9d9f-32623fc6fcc0", "comment": "Malware payload (Dridex)", "value": "7b401ef3399bfa60fd33aef3df4265c3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223046, "uuid": "dd7c14cc-61ff-4e43-ba40-8b3e9ab0ad5e", "comment": "Malware payload (Dridex)", "value": "41d6f3a395e2dfd2e4f4b49080531421f1573face586429db7c64009441781ce", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223046, "uuid": "af455ad8-4b6b-4623-8bae-97b4c4c53680", "comment": "Malware payload (Dridex)", "value": "dc58f2535cf922f7c42217a91351d25e250c2512", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223046, "uuid": "934b55c8-0ac0-4b7d-8aeb-8e7e98b2932f", "comment": "Malware payload (Dridex)", "value": "8c5deba2528669e3e874bc6c16ac8aa75313785a225216fe1a96d3af7d45a2ba20bef55538bc44d2f66c1d785b7c2c68", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223046, "uuid": "5e6d25e3-e7e8-4d75-aa83-7e7179fd9271", "value": "1B248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223046, "uuid": "f3e3b3ce-f068-4e01-9e82-c61e38eff4ab", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223046, "uuid": "a8ec7b25-6fad-4f79-af93-9e3b66a0884d", "value": "3072:96TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:9oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223046, "uuid": "15178b51-5245-4451-984a-18155a97bc3a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223046, "uuid": "3a7ee412-1a42-4910-92df-d1d4ab4f594d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223046, "uuid": "3b319366-0fa8-4006-a539-4f6cf4dd0b97", "value": "41d6f3a395e2dfd2e4f4b49080531421f1573face586429db7c64009441781ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cf2b00-923b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617206882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206882, "uuid": "f07de619-d221-422b-b211-727dd039c649", "comment": "Malware payload (IcedID)", "value": "80ccb6244d51dd7c16e385a41cfeb6a8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206882, "uuid": "a0362ec7-0adf-415a-b1e8-71017cd85d21", "comment": "Malware payload (IcedID)", "value": "41dc1f4ed712167585e476ec41a0c09b09a2e3623517240cc9b0ecf48003aa73", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206882, "uuid": "409acbdd-f0bb-4cb1-ad53-a4de2b7c1621", "comment": "Malware payload (IcedID)", "value": "98b5a1fbdad1b7d4805665096d1bb1f43c4b38cf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617206882, "uuid": "6e1d0cb4-67f1-4cd5-a0fa-ac841074aa4e", "comment": "Malware payload (IcedID)", "value": "64fe8da0297b5c7f34b8cbf952e11cf0c4c8a094bf88158cf8c5c50b6dc3d9baac33f4e77c4f08074098e6ffbd5a7e9c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206882, "uuid": "977faf7f-cc76-444c-bcd2-0cffaad7e658", "value": "24B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206882, "uuid": "c5f8378b-f65b-4b7a-91c3-36125de43a6e", "value": "3072:m2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:mqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617206882, "uuid": "1729d5d3-dc81-4cbd-ba46-944ab96203ff", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617206882, "uuid": "3dac43a2-0587-49f5-8df2-6e0d22c806a4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617206882, "uuid": "8f7eb535-a8d0-4295-8ff5-e7788d81ac3c", "value": "document-627876020.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b07e4a-91c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617156717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156717, "uuid": "c04b4efa-bdc6-411e-943e-5879087bd223", "comment": "Malware payload (IcedID)", "value": "147dac803e0d4003548c8cd604ce8dde", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156717, "uuid": "ac29c7b0-195f-4a2c-99a0-b8fc8118c760", "comment": "Malware payload (IcedID)", "value": "42160a797087e684ec0a7d8cd73ba84457cc81885c5a7fa2794247c79ec0e9c0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156717, "uuid": "ed557972-cb66-426d-977a-8eefd0a507e1", "comment": "Malware payload (IcedID)", "value": "8624046fdd090bfb137af3b4e85ab1d005dd0b13", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156717, "uuid": "b7041fa7-76aa-4b20-8768-9ad35370cce3", "comment": "Malware payload (IcedID)", "value": "1f547b14bcaf0fc5335046980772d276fc4063652c5e684dc17abbdcee94caba58efc400cbbf243828cbb37ca3633e0b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156717, "uuid": "c9d696db-2d46-4e16-b6f0-d2f1460f5c13", "value": "77B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156717, "uuid": "842db298-a08b-4b40-bd44-8391343e416d", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617156717, "uuid": "1ac2887b-bf18-4764-abd6-62049fd7ce57", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617156717, "uuid": "4c5879a3-4fab-443a-b399-9b21767820b9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156717, "uuid": "7140e259-e7f0-4553-88ff-5714d5230956", "value": "document-1752964840.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560b4377-925c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617221084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221084, "uuid": "520a5ba2-1dd4-4394-8835-53a8ecce3ca8", "comment": "Malware payload (Dridex)", "value": "9005ec21ff2891d023204b86b61f5258", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221084, "uuid": "be8d6ff0-e1c2-4cc2-a552-f8157669f624", "comment": "Malware payload (Dridex)", "value": "424c7cd5c55164e50e71c7f44bfe7cc759dcf9015c70aa5df398b6fae0788858", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221084, "uuid": "ad61d347-1759-48f3-80c4-0d9cec145e36", "comment": "Malware payload (Dridex)", "value": "d6438103db731e0ef7203e2b89997a7ed12294aa", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617221084, "uuid": "2c1bd76f-d2c5-44ff-899c-7da441d5c105", "comment": "Malware payload (Dridex)", "value": "714daa5ac0780935005baa2e70bd12150f2f329e1d65bffa4c39ecdf05a0737961ca1c1b311799c93ceacf39b8358d01", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221084, "uuid": "022b5709-dc96-4802-810e-b9d5ce6e3194", "value": "A414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221084, "uuid": "1dcc8f8c-9e94-446b-a0b1-7178fb166271", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221084, "uuid": "6a529d86-0b9d-46e0-b763-9b3dbda2f523", "value": "3072:6opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:dpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617221084, "uuid": "5f2964bf-3a89-4324-8e81-e216725344cf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617221084, "uuid": "c844550e-8050-448b-af8e-a004a9b5682d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617221084, "uuid": "1f238e48-7b17-4e7b-83e2-d64cdc6b3a9e", "value": "424c7cd5c55164e50e71c7f44bfe7cc759dcf9015c70aa5df398b6fae0788858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15995039-9231-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202507, "uuid": "d8a9d29b-508f-431e-b97a-e6781f39ea00", "comment": "Malware payload (IcedID)", "value": "a98be9454c8b6fc4bbc2067b7a536682", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202507, "uuid": "89ac1259-6d07-42e2-b44f-8ebb35a09943", "comment": "Malware payload (IcedID)", "value": "42532e9f633952ef54a4f34862a4db2474007638d1d7d39ba34db8381d255de3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202507, "uuid": "07e6cb1e-4233-4a6e-9c13-1526d5c72324", "comment": "Malware payload (IcedID)", "value": "aeb3ba63f743545220fd82f5d007ac5fe147a478", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202507, "uuid": "5ca21746-1768-48d6-bc30-ac331a9228f8", "comment": "Malware payload (IcedID)", "value": "efaef13e1ab9feaba53c40263b3b2ae7994439809f34825dedeeb625c7a09c46719802fa900b9ff296100e8c2a49bffd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202507, "uuid": "dd934ebb-bef0-4539-ad6a-21d5f02198c4", "value": "13B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202507, "uuid": "5f07b0ce-a900-4b04-b156-fbfff0692a71", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202507, "uuid": "1a23693c-2be2-4872-bb64-5d1c2649371b", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202507, "uuid": "e9b9fc62-293d-4f7b-910a-3761e021507a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202507, "uuid": "64da2c59-20cf-4e9b-80e6-eb88784cb0f6", "value": "document-252802897.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5848b947-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232254, "uuid": "3542f6b8-c4b2-4de0-a9c7-acfcd9ea2dbd", "comment": "Malware payload", "value": "accb33ed8293057726f3f0b63a37cd53", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232254, "uuid": "6680f1a2-0dbc-4163-a1db-d6264de1ee18", "comment": "Malware payload", "value": "42627ff34232b87f8605666b48ed6983c2f259f4cb9e031f734bfa260f2ec295", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232254, "uuid": "5d9c5ce7-664e-40fb-83f2-7adf7b5a3c98", "comment": "Malware payload", "value": "99e7c307ad9e514f53430ac772658d75f3c827f4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232254, "uuid": "b1947733-a4d4-4e60-bd22-c33ef2e9fa90", "comment": "Malware payload", "value": "67b20f5174cafdba218f7e601220efc6c4db781b6ad0c9252a612161e8ec1729a840f643ce8b8747a6856ad6d2a23c9e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232254, "uuid": "02481ffb-7ca8-41e4-bea4-3753b303d094", "value": "3614BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232254, "uuid": "c0b7533c-e84c-48a0-924a-7a19bceea0e9", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232254, "uuid": "ae9abee8-02f7-4ef7-accc-12719171148c", "value": "3072:bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:spjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232254, "uuid": "3d402382-4dcd-432f-a635-7aaebbb53311", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232254, "uuid": "61c9ab31-134b-4a99-bf48-f9290f6f42d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232254, "uuid": "8b52d09d-5786-4185-b5bf-b37998eda666", "value": "42627ff34232b87f8605666b48ed6983c2f259f4cb9e031f734bfa260f2ec295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4590e719-91d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161356, "uuid": "d4204c47-a67b-497f-ae0f-b2bc7e49bb44", "comment": "Malware payload (IcedID)", "value": "a85fb59ba1e5dee293863c000289502e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161356, "uuid": "11aa9ae1-687e-47a5-b3e8-c056b48f53b5", "comment": "Malware payload (IcedID)", "value": "42d5095d067f97a7ab598a25403c6eabeb9957299b67d66419335f1896a67609", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161356, "uuid": "5fa60834-88a7-4258-9730-9b90db089190", "comment": "Malware payload (IcedID)", "value": "609e96f8f095d8194c6cc74c62f52e16581938df", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161356, "uuid": "942a3675-6210-44a1-a207-9d439871dc01", "comment": "Malware payload (IcedID)", "value": "c3f15a1b97c699116e131b377df28e30c29093684e129659a7cb597bd69135ea004c0fa2235ad0f739431971faec5ffe", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161356, "uuid": "26aaf748-a0f4-45f3-9690-c7462ce39fc6", "value": "20B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161356, "uuid": "eb2ca10a-be37-4ffd-aede-9fc7293d2e6a", "value": "3072:O2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:OzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161356, "uuid": "80c134fb-40ee-49fa-9983-77e1cf45b8d7", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161356, "uuid": "25c549b8-dc37-4234-8948-e62993c7da9f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161356, "uuid": "f34a8edf-5a7d-4c1c-b465-2f8f70f7f151", "value": "document-224765459.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7daa29e-91d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161951, "uuid": "f62896d9-e4f9-49df-9441-82668ab8101d", "comment": "Malware payload (IcedID)", "value": "ba6ff712fe8f0acb20b957189b46fb7f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161951, "uuid": "582b12c8-9411-4d38-a85d-23647488796a", "comment": "Malware payload (IcedID)", "value": "43166be23a0f4bcaaf6b8e36e97456d38babbde5cba0aa286dc3ac1bd6f1f2cb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161951, "uuid": "1edca5dd-de77-426f-882c-e4d7777847f2", "comment": "Malware payload (IcedID)", "value": "368c2cf39c4d294d8d924553f2a908be6e73145c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161951, "uuid": "32d9f17d-5d89-4ea9-90bd-7496bfb3afaf", "comment": "Malware payload (IcedID)", "value": "cfa9d3e3d447c96ffd314c41003452628557e15351939d4f2fff47db747d5bbb6044a8b8c6cc2c09232bfb6f649ab3a6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161951, "uuid": "83ec371d-6ae0-431f-bf83-63fda30e5fbe", "value": "2FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161951, "uuid": "627f15b7-91ef-44ca-ad87-9e98cd77c8c4", "value": "3072:c2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:czxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161951, "uuid": "839963bc-6729-4697-91d8-5c5b4a0ed5d1", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161951, "uuid": "b981b055-6d0a-4305-8cf2-f66f8f736822", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161951, "uuid": "12947168-114c-4eaa-ae0f-43f18866ac4d", "value": "document-364877302.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e987ef-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199292, "uuid": "ecb857e6-ad0c-46d0-ba53-65c4178876aa", "comment": "Malware payload (IcedID)", "value": "d3b9d77b28b90ff43be135ca0ed67fc7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199292, "uuid": "79c34758-e1a2-4c02-8bbf-2656059cfaa8", "comment": "Malware payload (IcedID)", "value": "431a94517b3aa34034e8d35e23a8e5939abf93f79fa621091c264812f18e73d9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199292, "uuid": "8b5fb86b-de66-4c80-bec9-24c80a1bd6d6", "comment": "Malware payload (IcedID)", "value": "44c5846280dfaa0a6a4a3753bf2dc14809fd360c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199292, "uuid": "4b1889c4-1ea0-4618-a518-058a5e1ae685", "comment": "Malware payload (IcedID)", "value": "edbf162c571da630833c3fed4f0ecd6a428f182edecba3da3514a9a6f9a7163982c20ad93231d9cbe90400c964a8da54", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199292, "uuid": "ecef92b7-5005-44aa-bd6b-2c961c7bbebb", "value": "FAB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199292, "uuid": "92362bd1-f903-40d3-bafb-74b5e8eaf177", "value": "3072:A2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:AqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199292, "uuid": "ffba1924-ada8-409a-9b5c-d44308a7644f", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199292, "uuid": "50e155b9-8ce6-44d4-b036-5b40ae3fdbf0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199292, "uuid": "693c7e99-c5a2-48a1-9ae9-e1c0b3a553bf", "value": "document-709973630.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c5cff6-9231-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202776, "uuid": "6c39e92a-a6d7-4fbd-9ee9-b15156ea49f1", "comment": "Malware payload (IcedID)", "value": "c147ca7c8a6b91cd7f7b3cedbe5bf4bd", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202776, "uuid": "a3db4272-8c4f-48d2-a29d-a14ce7648752", "comment": "Malware payload (IcedID)", "value": "432819fe078c2db589cb792524e64d513c4f426a2aa16008d410f64f72c6b8f0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202776, "uuid": "b7121d41-fed7-4613-b3a3-fd044c77cdcc", "comment": "Malware payload (IcedID)", "value": "f4e1808a0aa6765de193f93226ad2a4bee96b0d9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202776, "uuid": "62540d17-c4c7-45cf-b41a-75521e5aeb72", "comment": "Malware payload (IcedID)", "value": "3e7a2ab5adb8623d2708da6a609a790ac9ccdfa86b9bef151ed9e76ab266691e7305af8ef611e30f89523673fb10e5eb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202776, "uuid": "37c4cd06-0648-4aa9-9dcf-6f0144215021", "value": "DAB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202776, "uuid": "5286a547-38e5-4722-b006-402735984b96", "value": "3072:s2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:sqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202776, "uuid": "ebc7f554-955f-4736-82dd-98ed4d6ac7dc", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202776, "uuid": "c6f2bf8b-809b-4cba-b8e5-11a6c5ed4b93", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202776, "uuid": "d479a4a6-f67d-4ee6-86a9-83872a708565", "value": "document-72883322.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ff8bce-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213563, "uuid": "a9a5117c-a5ea-4808-aebc-b02c04f0fd24", "comment": "Malware payload (Dridex)", "value": "f692fc9fc19063b0a155aa4d134abc93", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213563, "uuid": "7a413cc5-bdab-4f1b-bdb9-fc93e41a7667", "comment": "Malware payload (Dridex)", "value": "44480c67f57fd7495c666fe38cff6d3bec89220fed07dd8f4ea2d3919a2f84b6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213563, "uuid": "a5f8c2aa-c3b3-454d-b972-752d3e4cfde1", "comment": "Malware payload (Dridex)", "value": "8e5bd5da298d45eed0342e34354c35ee9331462d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213563, "uuid": "ef6d4263-6c48-4a1f-b2af-214e53529bc2", "comment": "Malware payload (Dridex)", "value": "eff1e389e0c54808a09bb4b3996176f7edc16ab9c08e54897763b579411de2350f3d5c01ce5e1745da525fdf4a5c3907", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213563, "uuid": "5fd1cd32-13cc-423a-95ba-32ce38a37016", "value": "F3248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213563, "uuid": "9bd79a9a-4d20-4c54-9821-647d3815c7a0", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213563, "uuid": "023343a6-91d7-4e1e-9423-7a9ea86a370e", "value": "3072:i6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ioMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213563, "uuid": "fae4d53e-28b1-4f94-9a72-690d40e4a268", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213563, "uuid": "cbe37ad4-e461-41c9-8968-2d5ffb858919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213563, "uuid": "ddb32822-cc69-4373-a2f9-37b2dc6d5525", "value": "44480c67f57fd7495c666fe38cff6d3bec89220fed07dd8f4ea2d3919a2f84b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0b0191-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232689, "uuid": "a10f2901-9245-45d3-8155-c7dfaf76ef8d", "comment": "Malware payload", "value": "cd27dbef5a9f3ff7a283646db8f454a2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232689, "uuid": "74e492e7-ee08-44aa-82e6-5fc429fa1321", "comment": "Malware payload", "value": "445cd2be39691d7168ba33a96dd20877d0766edfc6006671dcf3639c685495bb", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232689, "uuid": "21260176-b56d-442c-a87a-d397e7d69a07", "comment": "Malware payload", "value": "d824b7467df251af2f30d63f46dbf3f6478b5715", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232689, "uuid": "225f0f54-0cd8-4ac1-9490-30778711fbaa", "comment": "Malware payload", "value": "0c9b071e69f99be467eb0de81ecf296dadf874f941ad39c14818ef9c74e9ef0365deee304525b2ca02afe7d4e99aa9dc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232689, "uuid": "ae408974-dbd8-4e26-a0f8-b96b48d3f409", "value": "0514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232689, "uuid": "a655d75f-3c44-4c5b-b013-ff0be9ae7788", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232689, "uuid": "d2ecd8fa-ee48-48cf-b8f1-9c6311dd6f43", "value": "3072:Bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:WpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232689, "uuid": "4ae47208-6ae8-4bc3-a5fd-89cb05368f06", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232689, "uuid": "79270426-1242-4c04-a4c1-79bc62a1a7d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232689, "uuid": "5687fc68-0ad7-46b1-b9a6-7b85454905ee", "value": "445cd2be39691d7168ba33a96dd20877d0766edfc6006671dcf3639c685495bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda018a5-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223861, "uuid": "9f18f2ec-79ca-43c6-9db0-2e2f2d6879bc", "comment": "Malware payload (Dridex)", "value": "388e6005bdde37097b33c3ec30776360", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223861, "uuid": "c045b7d6-08c3-4077-92c3-07523fb07f81", "comment": "Malware payload (Dridex)", "value": "44ad62041aaea8f5d0b9ac819eac053bd2deb6c54b83bcad10ee9b65f45b2c11", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223861, "uuid": "e7112ed0-2792-4e88-9d94-cbca121733e3", "comment": "Malware payload (Dridex)", "value": "87f8f9c079a90719694a2dab05770478562bc2d2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223861, "uuid": "7ffd101e-3f99-4ce5-b419-358ac900af9a", "comment": "Malware payload (Dridex)", "value": "066d1dfb94cb8821e002e7fb914d18f5ca3edaf519b90e2b13caea611f989f196ec9d479a95a6f05dd0e50051817b9d9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223861, "uuid": "e55f2f03-00ea-4826-b850-b2fa241a2085", "value": "3714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223861, "uuid": "42786482-53ef-456c-bb21-143468aa9537", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223861, "uuid": "d7547598-e47d-4aba-ad52-8b3fde7f5fa0", "value": "3072:0opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:rpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223861, "uuid": "e25c7ac4-67ef-4da3-a6bc-d0d23b68f532", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223861, "uuid": "bacc7c42-32d6-40fa-9d01-2127ae13aaf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223861, "uuid": "8287d229-7953-44b8-af98-5f527b30b6f3", "value": "44ad62041aaea8f5d0b9ac819eac053bd2deb6c54b83bcad10ee9b65f45b2c11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52354ee-923c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617207499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207499, "uuid": "d0d79b30-b6e5-401d-8e55-0513061ccb25", "comment": "Malware payload (IcedID)", "value": "fa3fe66ce1c65711c526e09fb9ee282e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207499, "uuid": "56b572ce-fe5c-4a3a-a9a2-f06aeb83c944", "comment": "Malware payload (IcedID)", "value": "44d98f3a774afa6bb92c626e901542ba9ad43212bbb46ab3445bbbde833ba8d6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207499, "uuid": "66b19105-514d-4e60-acae-fc3ddc1fe43f", "comment": "Malware payload (IcedID)", "value": "6456d74b4d35c133778f376815d2ec17c3dcaa7f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207499, "uuid": "43f3965c-cf50-4845-8af6-5017b675eab8", "comment": "Malware payload (IcedID)", "value": "518f4c31de7fcc46ade5bd04d72793b5a96ed3fa31b537c023d4f4a7d3bd576fbae14ac885deab9c6906a55d4466e76f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207499, "uuid": "0bf1fef8-acf8-4b9c-bb8c-fed5910c3e6f", "value": "7AB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207499, "uuid": "ca870ffc-01d7-439d-9596-aebc435bc4c2", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207499, "uuid": "d5f31f81-48f1-4dad-bd09-c9012d221d7c", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207499, "uuid": "2c043d8f-10f5-4c27-8f4a-73b306516861", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207499, "uuid": "bcda3c58-1916-4b4a-9b71-bb02e4951933", "value": "document-2129662318.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44c5314-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232516, "uuid": "b964c665-2e23-4a19-8d11-d1e3bec64345", "comment": "Malware payload", "value": "1d125952aa903a5844cd198340f43426", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232516, "uuid": "37f6854f-4659-41e2-81c2-0e1e51af86ae", "comment": "Malware payload", "value": "45126a36c3a9ca1cf655d6a74349a6ffbdaa4bc35221b395d8bda5fee881af04", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232516, "uuid": "e7add4a5-800a-4982-bcd6-d0a16617c64b", "comment": "Malware payload", "value": "2cb9316247bbd19a0cb1255d858a5997b5c7358b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232516, "uuid": "caa1f67a-6a78-4ee5-b076-52e040e24df5", "comment": "Malware payload", "value": "5c916cf4fc3fd49e2a753cd3f933b8e2ffabe072441f5b98531b9207e3e49200d5308786fe9a2726b6ff010c7888da0c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232516, "uuid": "c80eb36d-e418-436a-84f6-833ef390655f", "value": "A514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232516, "uuid": "bb0b59ea-7848-4f2f-abba-f4b9e1e09a34", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232516, "uuid": "0e78eaf2-e056-4895-bad4-67ae314572e0", "value": "3072:Oopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:xpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232516, "uuid": "c4fa93c2-599e-48b1-a23f-362fa7498138", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232516, "uuid": "678341c6-c504-4a53-a3f1-417e1d161335", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232516, "uuid": "20911032-3a50-4d8a-841d-259252f8ea1b", "value": "45126a36c3a9ca1cf655d6a74349a6ffbdaa4bc35221b395d8bda5fee881af04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70979544-91ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160140, "uuid": "87b2353f-ac42-4d3f-8e14-257a6b91c195", "comment": "Malware payload (IcedID)", "value": "7b56e3974ff687a57b5bedc1d182b4f7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160140, "uuid": "5ed698d3-6505-49ee-9d4d-e6b6198b9ffb", "comment": "Malware payload (IcedID)", "value": "4557ac9ab4838a3b86fc788b87da266a7f416d8e3d201da64144906c17f55089", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160140, "uuid": "f5442379-c51c-48da-945b-7c778cd9da34", "comment": "Malware payload (IcedID)", "value": "72b21aad2debbfd85d76d5629f47ad21a50378de", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160140, "uuid": "044f8a6b-c707-4569-a536-fc55f4e0ac95", "comment": "Malware payload (IcedID)", "value": "30fd98cb9297982e17c50ab41aa6bd87878c2c8692c268d2492961990e362fc9a6ffd5b0e4a2ad15ae74bdd74b9c5318", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160140, "uuid": "46116d30-d933-473f-951a-b2b7fb493a8f", "value": "BAB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160140, "uuid": "a63a6982-1cd4-4e9a-b940-5698373fa925", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160140, "uuid": "1cc9fec3-35f3-4134-ae7e-fe799da50e75", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160140, "uuid": "84822817-135c-4d10-9525-faae7e1867b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160140, "uuid": "f3579fc2-da59-440b-a7fc-1430c316a332", "value": "document-77455150.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba10c2f-9248-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617212530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212530, "uuid": "efc88ad4-2f31-4107-8b95-5e19c6db6884", "comment": "Malware payload (IcedID)", "value": "b664a71cc640212159a145f0505609ff", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212530, "uuid": "a4e8f35f-6b4d-41a4-b515-530e7f5abea7", "comment": "Malware payload (IcedID)", "value": "45761f104af41652eb77b797c5f2e92271976cfe5cc24820967b85bf50bedc93", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212530, "uuid": "36141245-e458-4475-893b-0e578ceaccaf", "comment": "Malware payload (IcedID)", "value": "6e9e558ef228c65fffe930679c16102954fecf16", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212530, "uuid": "40993570-0c26-4ec6-aeae-142446b4cd31", "comment": "Malware payload (IcedID)", "value": "a11ae489c86e48d441ae85e5f6e00e02d26da1ee23812610f04433c6554e23ca0c85bf0a6094f3a136aaba38f56bd3bd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212530, "uuid": "c8f4a500-a65f-4b5b-b83a-618b7c40e2ab", "value": "2FB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212530, "uuid": "d8c29cf1-93de-4ce5-a23b-9760124bbc7f", "value": "3072:02S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:0qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212530, "uuid": "a7cee056-d653-4603-86d1-4dde5d66e73f", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212530, "uuid": "a9d2b161-7870-413d-a302-8d2d26c74caa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212530, "uuid": "0e50d39b-7c7f-4450-a99f-7ecf0cfd5d25", "value": "document-1258602967.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0b69f5-9237-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205288, "uuid": "4bd24569-6ab2-4af2-a669-1a7c38f34b10", "comment": "Malware payload (IcedID)", "value": "1a43f26d21fdcea971f8ef1e11a3e2d2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205288, "uuid": "0d70b7b0-dc89-47f6-9878-55b37c2c2534", "comment": "Malware payload (IcedID)", "value": "458546e485aeb87a8ff287e0b9e95a162f72a50fa9d909f9dc1f0da2d6a507d3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205288, "uuid": "bd2af600-36fb-481b-b795-9b0cdc277551", "comment": "Malware payload (IcedID)", "value": "7314cf4f2b311c0640558a55617f2ee87b928a4c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205288, "uuid": "9b3d90d0-6c9a-407f-8a22-ccd416a8d90b", "comment": "Malware payload (IcedID)", "value": "fb888058f6916c14fd51ec181684b5ceff1abdf0a77c5dbdacd15872035234479e04dd045d94e8e581815b2f6f67fc3c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205288, "uuid": "2a5b5251-f4ec-459b-90e1-d5c45cf7129b", "value": "5EB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205288, "uuid": "89f48af1-957b-4d21-ad2d-274d8c9d39c1", "value": "3072:M2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:MqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205288, "uuid": "d6ac8cdf-224a-4101-b189-51d3e2d8221f", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205288, "uuid": "5a413521-1098-4171-ba73-89620d0b102e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205288, "uuid": "927005ce-09f1-4e40-949b-472594966e49", "value": "document-512667882.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e28b7c-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217567, "uuid": "acafcd55-2052-4c7b-9d42-a50168517868", "comment": "Malware payload (Dridex)", "value": "284518b839c9538375791570d1b61cd6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217567, "uuid": "0aa16d05-8b8c-4f2e-a95c-c1082efe4619", "comment": "Malware payload (Dridex)", "value": "45d8cbf4df6a44cc6d2844e3f2361c04e394e84a2e5a720928fcb9582c8fa67c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217567, "uuid": "1d95f1cd-12da-479d-89a7-3ea9cd46ff17", "comment": "Malware payload (Dridex)", "value": "89430627e6d21d2e875954d0e46b9170378ddeeb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217567, "uuid": "cac37426-b453-4015-9654-2cba2522d4d0", "comment": "Malware payload (Dridex)", "value": "9c20520c70443de53dace44950b66e348672e9debbd24574e56996fd8d9968c7e6a0547f726f36b6a4068f72df6c6a15", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217567, "uuid": "2500dac6-05bf-4028-b81e-1a4e1a3b236b", "value": "5414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217567, "uuid": "034134bc-988a-48f8-ad68-1aa2c731c732", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217567, "uuid": "f9525297-423e-4326-9ea3-4c9774afed38", "value": "3072:eopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:BpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217567, "uuid": "d88c24ad-bac4-4750-8c56-8a89da51ba5a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217567, "uuid": "88912ac3-780c-4e61-aeff-4c43c86e3289", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217567, "uuid": "ce4e2e07-c9ae-486f-baa7-a0d8aa3128b7", "value": "45d8cbf4df6a44cc6d2844e3f2361c04e394e84a2e5a720928fcb9582c8fa67c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2323e078-926d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228300, "uuid": "f7f25a15-cae5-48bc-8ce9-b783fb00ffa9", "comment": "Malware payload", "value": "b714c9091490dc0f7dda61ea89f14ac5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228300, "uuid": "d9c877f7-8d1a-4074-b8d4-7885174cda28", "comment": "Malware payload", "value": "45f56504c5023e1a0b9c1aedb6bfc182605c31a752f0b233347997bb7d0ff45f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228300, "uuid": "557334ec-fc01-4330-8169-6cae599a67a4", "comment": "Malware payload", "value": "0ed275cf10c81db839bbe76e41722e65f01e846a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228300, "uuid": "4d92af9c-946b-407b-a7b3-d4dd2a6c682c", "comment": "Malware payload", "value": "1de3f22cbd17111f1073df3c94b9ac404788d899537c8e13a968ae7e82440f358a3d3ae2383d37f5af67ab47febb36cd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228300, "uuid": "7b8240e1-68f3-4d36-8551-d7b68e1157f3", "value": "9B248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228300, "uuid": "f2af897c-66d5-4428-9a77-13928e1ad4da", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228300, "uuid": "f9ebca0d-1dba-4808-b5ab-2232595a5387", "value": "3072:s6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:soMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228300, "uuid": "cdb5c01c-8fbf-48df-9d6d-5963ca673ebc", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228300, "uuid": "2913797b-5c45-437e-ac7c-42965033d6dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228300, "uuid": "ae772c19-b112-42db-aaf9-755e63968bd8", "value": "45f56504c5023e1a0b9c1aedb6bfc182605c31a752f0b233347997bb7d0ff45f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03266533-9247-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617211925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211925, "uuid": "bc40ed2b-8438-4ec4-b754-77c6585ca870", "comment": "Malware payload (IcedID)", "value": "9834cf916a4d9bc2eb8bb3e301c8dd38", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211925, "uuid": "d6ab134a-0664-49bc-a162-a88c86cc7fe0", "comment": "Malware payload (IcedID)", "value": "4603695abccc36c0d02012cc5c2b5eb2bd78e1b4258776b9b8ef522fb86507a6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211925, "uuid": "2ff11723-068b-4683-9384-543da4500dad", "comment": "Malware payload (IcedID)", "value": "931b8ff51cbbf98ab96ce43223fe7c4b4d88ad60", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211925, "uuid": "090eeeaf-adee-4758-87c6-79b6908954e3", "comment": "Malware payload (IcedID)", "value": "a6dc89db053e7c492d3c063f313ecd1f7c15916f46ad7f5a15c660f6ea516484fe0cc4f93e45f129bd7d1190cfe91fa9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211925, "uuid": "4a6ca2b3-57f2-4c5f-a119-cc7464550c07", "value": "A7B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211925, "uuid": "8c728fc4-4539-4bfb-863d-4eee618836d5", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617211925, "uuid": "079bcbad-5914-402e-b226-dce0cf54c1cc", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617211925, "uuid": "fcef13dc-94cc-48ce-8d56-3d6c258f7245", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211925, "uuid": "31349958-5621-4cb9-891e-c14b055c9851", "value": "document-180931699.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04355945-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213216, "uuid": "e1b45299-dfca-47d6-a6a3-60459d4f82fb", "comment": "Malware payload (Dridex)", "value": "972a6bf6d5c8b3619a295b524fd49eea", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213216, "uuid": "fe722a43-1d3f-4152-a98c-d2ec41b35b04", "comment": "Malware payload (Dridex)", "value": "46234418d0f680132199028d23abbbb1c15820241b932dab160ba092aaad4637", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213216, "uuid": "23446454-70fc-4941-93a4-416f74e5fc44", "comment": "Malware payload (Dridex)", "value": "dac9cbd0d0ebab5b9be8f9ba0c269839780dc95c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213216, "uuid": "e1d6f64d-53d3-4251-92f6-9ed494d2f16a", "comment": "Malware payload (Dridex)", "value": "0af97d870d8246639dae9222c661e02e22077144f0892d945797aa448d3303b76bcadc8c13691d9014b09bcb9d394b37", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213216, "uuid": "0ed869a1-baf3-4e5d-b9cb-0beaf25bfcea", "value": "60248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213216, "uuid": "b2e6f9fc-1239-4429-9298-246effe40af2", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213216, "uuid": "d19a1712-cafd-49a6-9d0c-c2c68e84a8f3", "value": "3072:w6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:woMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213216, "uuid": "399f4e61-be48-4d3b-9cb1-18b1299b05a8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213216, "uuid": "462396bb-062c-40da-b227-93cab8adc1a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213216, "uuid": "353580a5-454d-4be6-9d33-22e3701ac1a0", "value": "46234418d0f680132199028d23abbbb1c15820241b932dab160ba092aaad4637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d36d675-91ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617174227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174227, "uuid": "92b9287a-c617-4a63-9dd1-4c2a4ed5d473", "comment": "Malware payload (Loki)", "value": "d0a17d7d7c3a05c7bbba3683fcf56285", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174227, "uuid": "a9d0c8ee-ff1d-423b-a65f-ed356aef7d95", "comment": "Malware payload (Loki)", "value": "464a6c5e0dcde73fed0c94cf972b1221332cfa2b0e00a6053939d04dfbbe2345", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174227, "uuid": "969462b3-1ec3-4a27-b767-9a64a41961f6", "comment": "Malware payload (Loki)", "value": "734ca2c1fd1853c2325d8333cf359e8e93fadabf", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174227, "uuid": "f2e8bac4-d429-4126-bf28-672d755976c6", "comment": "Malware payload (Loki)", "value": "7964ae388ea0ac4e1fec33ef2793e9c1bc4856b18d8fc3b0bb716206c1afd97ea1f4f4391320bb0ff80885e6b9f36014", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174227, "uuid": "beece264-6f69-4344-b27f-35e66bc5f0d0", "value": "EFD493AC309E545DDEB6A630F9B459925FC868321F52FF3F249327046C6B766FA0E420", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174227, "uuid": "0738e452-35a0-4ce0-941f-7547ef8e76e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174227, "uuid": "caccd0f7-a1bd-48ae-b65b-84475c96b4b8", "value": "12288:zQU++Vh3htlNiCY0iz2cLIq+clSlEmVXuMkMdTTjriSNWn:ZvVxhtS2cLIqk8SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174227, "uuid": "2b081cc0-6e8e-40b3-a956-7237e62ea7b4", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174227, "uuid": "c1dbfe5f-cf6f-4d2f-b799-aa0f79e9f993", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174227, "uuid": "11035787-1180-49be-9a35-231dcfed6574", "value": "pago swift.PDF_________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2893a18f-9224-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617196956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196956, "uuid": "cfa6b138-2579-4d6b-bcf5-1769bfb23414", "comment": "Malware payload (AgentTesla)", "value": "5c03f9c3595e66b9b56d4490e2d93af1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196956, "uuid": "3c58669e-6ee8-4993-8115-dc8f8c9b33dd", "comment": "Malware payload (AgentTesla)", "value": "464b0e1f84a023c4bf64986f3b70e67433bb3d19366dc7c83fe57ff7cf447d7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196956, "uuid": "f1f6ca2f-7071-42a5-b398-ce78277a8425", "comment": "Malware payload (AgentTesla)", "value": "fe537a7525fe02ac40147cb81e5ecf8c8f73b30f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196956, "uuid": "b370f7a8-3cf8-470b-a89c-d199f8bea871", "comment": "Malware payload (AgentTesla)", "value": "71af755e7abb2177738e5dd422e6905bb2ba1a58d7cedbc9fe732d0a4fa4bc6fd7e9bb2b8eb89bb5445542e62955c39c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196956, "uuid": "11725cc3-367b-42d6-a29d-552d3ebe0b92", "value": "20E402F52442DBDADA3817FB602825060BFAEBF250034F85D648F9B23527F8D1DE9586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196956, "uuid": "bf338f17-043e-4822-9aed-2fc327df7a99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196956, "uuid": "83688301-8db0-4818-96c9-dc941c60ce4e", "value": "12288:1JDeUH1PNz3sq3pTnMCCo5Lu8x5+MpbP+TjeiEWC4Os:1JDeUrT3BnM6s8fXPueiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617196956, "uuid": "19e2be5a-e2a2-4c54-8376-0026d6d9b0ba", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617196956, "uuid": "a5290e2b-3044-468a-9623-927dea4cf5d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196956, "uuid": "2f490875-6617-42b2-89bd-c3e6ee6ab626", "value": "ONEYJKTA78412400_draft_20200816100108-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7ebd43-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617212827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212827, "uuid": "b91ffba3-732e-4332-853d-f631f95cfeff", "comment": "Malware payload (IcedID)", "value": "9c9c04d2189574fbe4ba49033dcbc11f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212827, "uuid": "1e0e832e-bb5e-4176-9b0b-b78f64f3079c", "comment": "Malware payload (IcedID)", "value": "469999a0e1ac582fd404e278188d3943d2425ad80683e6f33d94ff422e5ebb63", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212827, "uuid": "ff9dbf75-34d6-4faa-8b06-cb10442295d0", "comment": "Malware payload (IcedID)", "value": "3f3841c3a9a69741f47a5a8da108d67eb1b9429a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212827, "uuid": "03a472f3-1ce3-4f1b-bf24-7e4a3f136392", "comment": "Malware payload (IcedID)", "value": "3e6c68047e8b7a19ad05f15baf44e47a85ce8ccbb3dd832ddbab8a2bc27952f8b7a280b878b0eae5ae3bc5ab0f7dd6d6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212827, "uuid": "8d788c74-81e0-49ab-8e81-518a6dbcd28d", "value": "3AB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212827, "uuid": "616a9a78-03d1-4ddb-9f6b-6774d7e6fb99", "value": "3072:Y2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:YqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212827, "uuid": "3cc09e40-3c08-4174-ba00-e85252516672", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212827, "uuid": "00a1d772-b8c9-478e-ae25-59181b6d1487", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212827, "uuid": "c679068f-00da-485b-b8f8-e4f6c71b0aec", "value": "document-905517021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c36f035-9220-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617195298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195298, "uuid": "fc612a4a-0531-46c7-945c-6cbde24a70e9", "comment": "Malware payload (AgentTesla)", "value": "73b6a5de6e2aec7b2642323176ac6ea9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195298, "uuid": "97b8d852-39b5-4f87-9cbc-12b3989451c1", "comment": "Malware payload (AgentTesla)", "value": "469ed981d99354408a8ab4cb4593f47b0761490ac6a2539057c8faf40ced113d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195298, "uuid": "ac5d8272-28ff-439c-a8dd-a40f3282c333", "comment": "Malware payload (AgentTesla)", "value": "c41ddfac7bc7bee2cd6982d873aa707b86b93910", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195298, "uuid": "f4685481-3725-418c-b613-818650f8f44b", "comment": "Malware payload (AgentTesla)", "value": "be3bd36275d6a8fbd9e4bc9b7e0652a3cdb47f7927d7f979e18a8dd35c9d25c64671591dbd072e7e65a2647758f40f4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195298, "uuid": "e00e5e5e-c31a-4779-a620-0dbf468d940b", "value": "F615CFD42549BD41D43B8AF10C99CB5133EF7F4D865AC439BC97F1888992683BAA72C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195298, "uuid": "119c05c7-dee0-4de0-a6e5-044ff66cdbbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195298, "uuid": "4cfcc925-cae8-409f-9f8c-e968da5eb4c8", "value": "24576:BSefVBhEStCFJpw1At8Ubijs7EJBcpYlf+:RpabijSEJBkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195298, "uuid": "da124724-17f8-488d-a6b4-b104a14cf75b", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195298, "uuid": "39702bd0-4565-4a6b-b677-ba3e560aa16e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195298, "uuid": "fc8278cd-4f09-4a41-92cd-10b132b020d9", "value": "73b6a5de6e2aec7b2642323176ac6ea9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d96a898-91d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160994, "uuid": "842ec5d9-7286-41fc-afb4-68bf764f4384", "comment": "Malware payload (IcedID)", "value": "9a639782d4c04ed76e4f33d231ae66a1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160994, "uuid": "265ba397-59cd-49fa-9a42-7012dd077fc3", "comment": "Malware payload (IcedID)", "value": "46aa0b1e715f82d6eac1e263bd73002a723b1bf397c88c6f935d9aedcf1b1228", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160994, "uuid": "fc8cf035-aeeb-4c42-94f6-94a27cf4f0b2", "comment": "Malware payload (IcedID)", "value": "5aab6bedeec0be37883678ca9dc39fc0bd21504a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160994, "uuid": "b8d48d8a-5aa1-4299-93ea-2e32e4ab9ec0", "comment": "Malware payload (IcedID)", "value": "c2d4b3992f952daa64ad919e791cb302c8bbd5478fbf1e4661e06404a1dd96615d083feb90eeedc01a051585e719646d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160994, "uuid": "f5d2f2f7-1f04-4944-83e2-ec06490d8386", "value": "0AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160994, "uuid": "4645bb4b-c1dd-4df1-8855-5a68229faeff", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160994, "uuid": "30954f3e-5794-468b-8ed3-7d5861b05785", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160994, "uuid": "d4559b77-e808-45cb-aceb-e94aacb27de5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160994, "uuid": "4e02b48e-5144-468b-bc99-eb3c4c527e47", "value": "document-1213016400.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ecec2a-91c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157927, "uuid": "7f4324c0-4f7f-410f-ac45-e28a22807e9c", "comment": "Malware payload (IcedID)", "value": "3426782ef3ea4a331aa7132abba63fef", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157927, "uuid": "c765b20a-b758-49f6-a1d3-609ea0758b9c", "comment": "Malware payload (IcedID)", "value": "47231f4d2776470051c217cfb904773b618ddf4580533f2e5b72e497bac625d6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157927, "uuid": "a1a94bcb-8659-4b92-84dd-cb7873b56573", "comment": "Malware payload (IcedID)", "value": "968e378dd1f8aa6d0cc9bd99623edc8774641280", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157927, "uuid": "1b7a7996-a0e5-4157-9d56-c94115b08f71", "comment": "Malware payload (IcedID)", "value": "b766c726c90f34de90ced63afe833ea4dc0f91fcf45b96e6c31bc011b56223d22fe846cc7681a2ca184e458e202d8535", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157927, "uuid": "fbd63867-52c8-4fb8-af14-fd26b4759072", "value": "77B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157927, "uuid": "73ad4435-1f68-43a3-be76-4e62c7531041", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157927, "uuid": "27b15bd9-36c7-4338-ab4b-dd5b448b2d73", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157927, "uuid": "f26aee68-e6ff-4e95-8625-4894c3a66fbb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157927, "uuid": "2ef1324f-475d-4f65-aebb-296f48fdaa48", "value": "document-1127298445.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a95a68b-926d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228339, "uuid": "73c81a4c-9298-424b-a550-fef5e29a1714", "comment": "Malware payload", "value": "64b7b7a07254a669ac79ff6d09708d9a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228339, "uuid": "af76e36f-e13e-46c7-b498-0c7a4b11cb87", "comment": "Malware payload", "value": "475393fb53614384b4f7b8dba20acd76e0918dd5abac1aef13fbff746ea6872d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228339, "uuid": "f9969928-846a-413a-a32e-097be3748f3b", "comment": "Malware payload", "value": "e389492d3cf9472544fe1123b39748f807857bb7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228339, "uuid": "00d7081f-7f48-46e3-917d-a18dd9fc7808", "comment": "Malware payload", "value": "35a790f159e9eeed8116de33c4461d1f6a9c9f8c3845b99ca5bde116e32fe349b58009ca8f1be741fffda373001a9be1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228339, "uuid": "5fa1a87e-e6d6-44e4-95a9-bde2534ef054", "value": "E1248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228339, "uuid": "6314fec4-9f90-4342-9da7-4e7a62e7cea0", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228339, "uuid": "1738e872-2daf-4d57-bfac-c0544a83560d", "value": "3072:+6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:+oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228339, "uuid": "174980f2-08f1-4281-bcf9-794fc2b6016d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228339, "uuid": "e7376225-9997-4fb2-b2db-114422c9c6db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228339, "uuid": "7618cde9-6693-491e-9653-8867756377a2", "value": "475393fb53614384b4f7b8dba20acd76e0918dd5abac1aef13fbff746ea6872d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c4c86b-922c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617200473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200473, "uuid": "fc44e2a8-81b2-4db8-bf8d-51f87eac8090", "comment": "Malware payload (Loki)", "value": "b9f10164106cb250bbe480f073d49aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200473, "uuid": "89c33ada-268a-4477-9665-47e3ca2c52b8", "comment": "Malware payload (Loki)", "value": "477978eccf7bc14027a7868f679e5a872a73a7980c654ca88c9644a40cb5a70c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200473, "uuid": "233d6c5f-fd0a-4228-b6a4-c3394fb9dc10", "comment": "Malware payload (Loki)", "value": "9927fcaa1c3944054351754326aefd7ede1ef1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200473, "uuid": "78bc94c1-bd44-4821-a5b6-b36ef99f7233", "comment": "Malware payload (Loki)", "value": "e4b50fb6aae26014b3b6602cdb9708692df4a7b1c03b08265d1e011d3c03096d4fbda5aaceaf903e9708de48aff2be36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200473, "uuid": "65d74aa2-ae25-40ac-9de4-6f88979ae4e6", "value": "AFE301AA3190E4FBD32302712C7A67D6EFFBC01155A81F477394AB9932649E3861D393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200473, "uuid": "5e849a3a-3f3e-494d-957b-8122e2b68b72", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200473, "uuid": "0f760518-8a10-4cf6-8d73-96f0a8cac662", "value": "3072:KBkfJpRXATwMdFCcXbYRl1qw0LjUGgINYOqkMcDVz8VpcZBMmz3IJj3m:KqjIFYRl1qw6Zvun7wVz8V+Wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200473, "uuid": "58b38051-5fe3-4284-a009-b3fd553692d7", "value": 150898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200473, "uuid": "a52499c3-af2d-4248-bf6c-b45d2f6a3fba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200473, "uuid": "75c9cf5b-8eb2-49c8-9af5-40a90ce8d6f4", "value": "b9f10164106cb250bbe480f073d49aab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d5a958-9272-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230749, "uuid": "27c763cd-967f-4a42-a66b-df93bb9b9daf", "comment": "Malware payload", "value": "b5d352b30e28648a323820bc72d85a21", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230749, "uuid": "3f6c62d0-63a4-47c7-989f-83a60c9b033e", "comment": "Malware payload", "value": "47a66fce047e3079f6aaaf9a62ffcbfa50e007c349805fb8f3c9f4fd0411ee8a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230749, "uuid": "24cc8e09-d801-419e-96bb-b24f2de18a36", "comment": "Malware payload", "value": "f64cda04119c3fefc4518e29921a1273717f01af", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230749, "uuid": "d818584c-76a0-45c4-8534-b332f722ab67", "comment": "Malware payload", "value": "25474d97c034151f3c07a07efd8872a89571765e68c576af6fa5031fdf9e8a296883826d8e1cc1521703ee470d73d474", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230749, "uuid": "be1acd20-4d7b-420c-973b-6b99d6a012b6", "value": "13248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230749, "uuid": "c55c12de-ba3f-4b87-96a7-b937d46462bf", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230749, "uuid": "c0776a8e-6682-45c5-bd20-a1e5e0c75be5", "value": "3072:+6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:+oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230749, "uuid": "142928f8-ae96-4904-a172-2417d1c70d8d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230749, "uuid": "5c99bbb5-05a6-4771-9ff2-352c71ba8f9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230749, "uuid": "6a5ceb58-52ca-4b44-806f-7b03b491c05d", "value": "47a66fce047e3079f6aaaf9a62ffcbfa50e007c349805fb8f3c9f4fd0411ee8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5c6703-9261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223160, "uuid": "095a9618-2edf-45d2-8472-0546bd78892d", "comment": "Malware payload (Dridex)", "value": "2510b4724103dea713e7d1fd27ec31f8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223160, "uuid": "5826764f-9e6e-400c-a0e3-ffeb9526e608", "comment": "Malware payload (Dridex)", "value": "47bfbfcf6d99af5c01e7a0d161e171052c020af600c903cd418e8e60d6b7e636", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223160, "uuid": "84cb1521-9d9b-48ab-9dc0-43cb74259ee8", "comment": "Malware payload (Dridex)", "value": "d428b21b131c78448fe186e16bb5feb9dc8e73c5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223160, "uuid": "70579f55-865c-48a6-aa0c-146dd9850667", "comment": "Malware payload (Dridex)", "value": "2f2555c246e2f5ddcfece5dae24339d0813badf3e0ba61a6bfa3ba7ae743cc7af83cec46411e75924f493b32622722f2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223160, "uuid": "ba2c01e5-fec4-4a0a-b77d-b6fbf74dc8e6", "value": "26248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223160, "uuid": "4a20fe25-cab4-4f37-9eee-8e5fc1f8af95", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223160, "uuid": "00704708-0833-492f-ba10-261c7d306417", "value": "3072:r6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:roMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223160, "uuid": "2f0f9e29-dd9e-4adc-b711-e849fc83fdb3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223160, "uuid": "ef290807-e80a-4833-83bd-af42b86ac8a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223160, "uuid": "af21f032-6a88-4d16-805b-77bbd7a340ac", "value": "47bfbfcf6d99af5c01e7a0d161e171052c020af600c903cd418e8e60d6b7e636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c95039-91e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617168571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617168571, "uuid": "b5eed5c2-40e5-4f16-ba67-39453daed623", "comment": "Malware payload (SnakeKeylogger)", "value": "e2396c097ddbf0678c9cce699b3eda55", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617168571, "uuid": "890530ef-2ef9-428b-a08f-c9b7025113e7", "comment": "Malware payload (SnakeKeylogger)", "value": "47cb987900f7b52282705b2eed444cedc74a74684d49ca6a300a9a7eea964a44", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617168571, "uuid": "7b50f0e3-bc53-4c6d-8534-b0a1eb96702e", "comment": "Malware payload (SnakeKeylogger)", "value": "553e4c761c47d2b0911aaa3128bfbd073848abab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617168571, "uuid": "2e40e9aa-4f26-4859-85c0-d388bf01cc38", "comment": "Malware payload (SnakeKeylogger)", "value": "ec76e9b3f0b197443f960daed8c732c99092b7faa7aff5bd93548c538bdcf313aadc429611422bd01d16f69524801ba5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617168571, "uuid": "46410410-ec60-408f-9ebc-9ba793d28a96", "value": "02D4236812F7C4BAAC2F1B704B00D73CCF3B8BA8652E69865AB7C547063D1F19DD6845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617168571, "uuid": "02868815-9fe3-4a7b-b8f7-8535deeaca84", "value": "12288:iRXfvSfUsbzC3IftX4VHvBjsZEevFexUu4efMb9Wg3:mSMsllapniFZubMRWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617168571, "uuid": "a2ad8e66-1fc5-45a2-a882-c84e7856c8da", "value": 610461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617168571, "uuid": "1614c0aa-6b68-4dbb-ad6f-0058db608e89", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617168571, "uuid": "5028bd36-f195-4d66-9c07-cc4bef9ca729", "value": "ASB Swift Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fb455f-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218235, "uuid": "862b7ccf-2d25-47a1-ac18-e643255d82d4", "comment": "Malware payload (Dridex)", "value": "102e23e82411c812ea301d0584d181e2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218235, "uuid": "d686f880-5a59-4e69-ba21-2ef6cbfac8ce", "comment": "Malware payload (Dridex)", "value": "484f9a0f9eba5481cbd5a51ab55f07a63803147e979372228da1e4df34ecd31a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218235, "uuid": "2669a548-67c5-4e2d-97f5-e323614b6483", "comment": "Malware payload (Dridex)", "value": "8c0f005915f359fc0f5a85bb3cfcea97510d575d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218235, "uuid": "ae87c063-51b7-4972-b7a9-d8a03f9dc0d6", "comment": "Malware payload (Dridex)", "value": "6537601bc38c69bba70042baf487baa7312f754da178875d482c21b2150fe407d9db0ab99078036ec7c3f045caecced0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218235, "uuid": "55e60b96-22c2-4e88-bd19-6d650734f171", "value": "E614BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218235, "uuid": "34142141-c247-4f9f-aa34-c4c035f5e215", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218235, "uuid": "d30a1bea-680c-4194-b99b-812338c91528", "value": "3072:fopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:wpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218235, "uuid": "05bfa313-100f-49e9-b288-9d2fd7aee92b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218235, "uuid": "d2ce8d59-21b7-4c42-84a5-54ebbb35988e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218235, "uuid": "b216e4d8-46a4-4a65-be29-92b08fe1f56a", "value": "484f9a0f9eba5481cbd5a51ab55f07a63803147e979372228da1e4df34ecd31a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688dd200-91f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617175588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175588, "uuid": "35ad9c0f-388a-4485-b7c4-488d4e9a4207", "comment": "Malware payload (AgentTesla)", "value": "4ec4c7b0ea8e691c92b4e0a75c953496", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175588, "uuid": "4719636e-80ca-4678-8413-5b62c6d43cec", "comment": "Malware payload (AgentTesla)", "value": "485f3f878a825c720b10dcecdde1774972ba5518b95fbc663e9508154c4bcd01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175588, "uuid": "81494a48-b1b1-4e8c-8eba-86e4bfd29423", "comment": "Malware payload (AgentTesla)", "value": "e7a527315caa64925c921eca2cbcee34a84fa3d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175588, "uuid": "bcc04f49-a97c-4135-89ec-aaeae20e5236", "comment": "Malware payload (AgentTesla)", "value": "248a596c45a78e9ad3b9db9cdcfa9f48a5430ab3edfaee23b2ded4270aa4d4c21733205d165a0c222ae811e56fb80245", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175588, "uuid": "b6f07334-46d1-46df-a363-1902ca223c1c", "value": "B515A4AC306D609ECEB69530F9B41C919F8428364F17FE3B24932654AC5FB66FE0E461", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175588, "uuid": "bf93ddfd-7a3d-4d54-ad17-70ae9eb5b737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175588, "uuid": "046ebfe2-2b35-40ee-9b00-e22a7fd2e8fa", "value": "12288:xN3//1ApOAt8Ngp5WfFJb51H297bg0L0URJZq435saibrKT6sMR46vgQ6ZU97gv:j//1ApOACNq5WfbF10Xg0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617175588, "uuid": "7eccc29e-8bb2-4542-bdba-fa4137eee874", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617175588, "uuid": "f2b79ec9-ab17-4d93-9f4b-e6ba6e22104f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175588, "uuid": "07f6b75d-bb73-4630-bc8e-7019172bd9f5", "value": "4ec4c7b0ea8e691c92b4e0a75c953496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d63b3b-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218743, "uuid": "86b699df-ed4a-4d70-81f1-7123346c3207", "comment": "Malware payload (Dridex)", "value": "61f4f3db3335cba8d31ae8e7055cd474", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218743, "uuid": "4eeb58b6-0e11-47e9-a781-e384adfee7eb", "comment": "Malware payload (Dridex)", "value": "48aca0788d1a0a0d728bd53188b8232b16efb41dfcf2628238b8136e196f426c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218743, "uuid": "368b4896-fccb-4686-ab6d-71f30799105f", "comment": "Malware payload (Dridex)", "value": "522ed57960bf6de6b5d7b58d6de2ced7cc6d8538", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218743, "uuid": "c3eaffca-79b3-40de-a4f1-2a3f129716b8", "comment": "Malware payload (Dridex)", "value": "ad20b62ce0fc6621d3c57e4588b8a6e2775c8622659114a090d97cf84ee0ab742b07726a6aa2fc6029ccd0d0b4246d1c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218743, "uuid": "e6a6ec5f-9e36-42e4-b345-19c4eb1302d0", "value": "B414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218743, "uuid": "2ac35ce1-440c-4a1a-99e2-d33f294451bf", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218743, "uuid": "e02e6b6d-6977-4f6a-a28f-5979c5139f8e", "value": "3072:lopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:KpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218743, "uuid": "ad74a749-e640-4b12-a666-7ee73e84b40a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218743, "uuid": "34c237ed-3a6d-41d8-aa00-167c7c1167fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218743, "uuid": "0ce807ee-0a3f-446c-adb8-70fc5dab2bcb", "value": "48aca0788d1a0a0d728bd53188b8232b16efb41dfcf2628238b8136e196f426c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7430d92d-924f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617215551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215551, "uuid": "6d1c331d-6703-40a0-9e30-450dfbcb7d20", "comment": "Malware payload", "value": "0ba179b03da30637a198728d4b46f91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215551, "uuid": "65df8bf3-b7a2-4c3a-9c8c-0aa0ff9a2eba", "comment": "Malware payload", "value": "48c1378f5e48ec365691bf3cf9c44f381e181c0e669df0169ff057c2cf8917f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215551, "uuid": "4407411e-b646-437e-9c67-7aaf5fee0e85", "comment": "Malware payload", "value": "de06fbf9507f84a780f2d4b452c24331e1efb5f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215551, "uuid": "e014b4e8-52d0-4eb1-9a39-1c4a89b97bfa", "comment": "Malware payload", "value": "a24f497a8259d6be6f2d8a69acb9374c0002a1bc50624a10fd03cbd882471bd665f217ba3a68ff5f13589c1e6ecdab33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215551, "uuid": "304fc282-0bd0-4a41-a2d2-e19469b8e06c", "value": "54563332EC5247B3E02238B2855723B1B53EFB14472E9D5F25F94A2C6E3634723952E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215551, "uuid": "93e1f1cd-e5ff-4d70-abb1-2023888ee671", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215551, "uuid": "79d62904-02f0-475d-ae20-ec3009c4bced", "value": "98304:pAI+mqSPmQTD5if5ytiU3YHHpA06/W+3rNyraQA1eMtd3OjsOI+vxJj1gQGrgA2j:it/SnIfDU3YHN+3xyuQcF1mJxgAA2hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215551, "uuid": "a8c1574b-17f6-437f-8466-73e9ca2f2972", "value": 6042376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215551, "uuid": "7c93abe0-dc94-4b98-8920-9be9145bb51c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215551, "uuid": "ef50a9ee-c963-4b58-bb13-a95ebb92f6d3", "value": "0ba179b03da30637a198728d4b46f91d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7fbe0e-9270-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617229577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229577, "uuid": "c22cf6d1-70fb-466b-83db-c3f82c35c1ae", "comment": "Malware payload", "value": "5a3c2ae2ea749ca1685e48170c04e7b5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229577, "uuid": "839a1b95-78de-4453-9266-e65514d83675", "comment": "Malware payload", "value": "48ec46d2178e204152719fde92648d9b0dd1e1a9c222b39ad511d33622388836", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229577, "uuid": "557618b4-ec20-4f0f-ab88-6d7071b292e4", "comment": "Malware payload", "value": "ec020b1b92d3013b2fc9ecfc06b759406d92a87c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229577, "uuid": "23dd4ef1-1681-4a14-a17d-25c97db2ae0c", "comment": "Malware payload", "value": "19c6337401e228f5f807be3da9fc75e712c3964cf70fa55ad084a8e6aaf785ff1a9267840ebdd69edc6fc0e2c4bb2b69", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229577, "uuid": "373d0b7a-284a-41e8-8349-100c8a76c983", "value": "63248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229577, "uuid": "0dd1076b-a0ff-4ca0-89ea-3d0915cc43f8", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229577, "uuid": "25d99052-42c5-4548-ae14-0c322c36ac0e", "value": "3072:I6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:IoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229577, "uuid": "fc8b8842-3cb6-4acf-b8d3-94f87454f10f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229577, "uuid": "aed4c8c6-3ad3-41c4-aecc-fd817970a977", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229577, "uuid": "de011a23-aff5-487a-9d2d-f405503067a7", "value": "48ec46d2178e204152719fde92648d9b0dd1e1a9c222b39ad511d33622388836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a7b814-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232118, "uuid": "3a03a659-1602-4530-b53c-dc7411309b95", "comment": "Malware payload", "value": "5298e1f4d9b6f3cf030be0e53237acb7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232118, "uuid": "b9d9b96b-c28d-40fa-9a0c-6b5f1dc8fa7c", "comment": "Malware payload", "value": "48f6a65f1cc079c23a64cb989c7aece69503b25214d2c16cb3dd0a1012e6d9ab", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232118, "uuid": "2a60132d-e365-46f6-a555-c9921297e4e7", "comment": "Malware payload", "value": "d66d922e7c49ac0e0f1f37277c921e0b56af8e71", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232118, "uuid": "3d950cd7-b427-4569-b030-e14cf5d23c30", "comment": "Malware payload", "value": "46b8b435cdcbd7a7b1aa05a7072be302a4baa6d498d64dbfc75bcf625a73e097f14e1dedc871eba900778c6ed8f36f0e", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232118, "uuid": "82422e62-5cab-422f-835f-d41acfea9d98", "value": "8714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232118, "uuid": "939f3be9-3f15-4530-8ce6-e527928d0246", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232118, "uuid": "a028b04d-e15b-4ef4-b4b5-3e975897c349", "value": "3072:kopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:bpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232118, "uuid": "a12868dd-c694-4237-9311-37338dd6b0da", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232118, "uuid": "d208fa6b-dddf-4b22-ad70-38e693b1d5e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232118, "uuid": "f74d6c30-1621-42c0-8313-132d30144ea3", "value": "48f6a65f1cc079c23a64cb989c7aece69503b25214d2c16cb3dd0a1012e6d9ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1c37bd-921f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617194792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194792, "uuid": "98c14a88-563e-478e-944a-5189aa7f5a1b", "comment": "Malware payload (Dridex)", "value": "7892af30c1da21ebe84e516dc21cce5e", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194792, "uuid": "4abccf37-69f2-475b-ab57-d17a3259e74f", "comment": "Malware payload (Dridex)", "value": "4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194792, "uuid": "f7d18507-4c40-4dbb-90e9-b67434040b9b", "comment": "Malware payload (Dridex)", "value": "0a7ceb5a578098734f84208d31e103bbf1ef6d3d", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194792, "uuid": "b30a9236-69ea-4770-b139-507a2610851a", "comment": "Malware payload (Dridex)", "value": "10111ebb05e91241fbfb0441779152a2802e06b8f4c75a373771f4404a94cab241c8dd89ffef02319e4a4b4557e11d23", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194792, "uuid": "79c0d119-e63a-491e-a2b5-8ae21856fad8", "value": "C4C49E016962A039E8B386BE89FB564D46AEBD50073464DBB3CC985D1F6B6E17F30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194792, "uuid": "7ee57564-3d20-4845-bfc7-458dca29d937", "value": "c481640479b1f140aa694701dbc594d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194792, "uuid": "9b835a39-0176-4124-a39a-f454428baa8e", "value": "12288:MJfvOjRSY7eIDrMPhdLXhnkSx7lCUjw6DlHk+KAPV:2udrArayXDVk+5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617194792, "uuid": "26bbb96b-31cd-46fa-a95c-6146afd7be7b", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617194792, "uuid": "84c3165f-be37-40f7-afdf-4f9eb3393a07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194792, "uuid": "55687015-4dc4-4755-9084-51425ed453a9", "value": "4902830374b401c3a75fe1567c3e9a7a3efbdb2da587f0d97d3fd3fe17e50c80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5432871-9263-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617224331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224331, "uuid": "8520754e-f11e-4ea2-9876-b0c341868dfc", "comment": "Malware payload (Dridex)", "value": "a99bf169589388272371e03a4102553a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224331, "uuid": "169e3b74-cdc5-4310-99c8-02e5062fd1dd", "comment": "Malware payload (Dridex)", "value": "490ae037863ddf8d389f83720b80cdbc92387ce82c94934a242ae01ee536967a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224331, "uuid": "06f97c91-3387-4d3a-8d44-d642a9b3315a", "comment": "Malware payload (Dridex)", "value": "7f4913d20b4c70b8fa6b77c1c8943fc935962416", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224331, "uuid": "503c4e4b-e240-4c9a-b9e7-34c22283b08e", "comment": "Malware payload (Dridex)", "value": "59df22d64469774198db70b1a8e3492c75e134898e4b4aae41c7451c3d635d7bcc414c2652111c61a265040b2e360bcf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224331, "uuid": "0f242c32-95a8-4e36-a440-43c4ccb99744", "value": "D6248C5FE339E486FEE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224331, "uuid": "308a3642-5d68-4657-97ba-88095be77342", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224331, "uuid": "52f99f82-5f4e-415c-8cd7-12c826ff5ba5", "value": "3072:A6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:AoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224331, "uuid": "af38d295-919d-4bc2-9e2f-1afeaf4dcc98", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224331, "uuid": "a16ec412-1877-4a01-8298-ee588e26c5cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224331, "uuid": "3cd65425-68dd-45e3-be74-69bf92bfb714", "value": "490ae037863ddf8d389f83720b80cdbc92387ce82c94934a242ae01ee536967a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649f1259-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232275, "uuid": "5ce8ca30-47a8-44b7-ab5d-1f0fe014c528", "comment": "Malware payload", "value": "d1eb8360b3744a9dab24b27675661a42", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232275, "uuid": "08d71af4-0221-4f21-8657-362bf0978b26", "comment": "Malware payload", "value": "4913d9ac0b7b6bdd9fc19e9e59d38af3a00a59b786e9ba56ee891db44b2fd7e3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232275, "uuid": "c07b7433-77d0-46d5-81a0-9083a259e7cf", "comment": "Malware payload", "value": "f2f678fc1f57a45987785c95f7bb333e5681e979", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232275, "uuid": "9e8f1c84-c909-4565-bfb8-cd3d938b78bc", "comment": "Malware payload", "value": "1ad9ab1d35d5d7e4acb79eb91071d5d88be8244f6a7fccdc22f4131385cf3a9aa7dec98f72b20cf4030fc93692b8fc59", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232275, "uuid": "210f7d48-e4e8-4119-b495-352781c93a54", "value": "5A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232275, "uuid": "215b3e59-cb6d-44e1-8b53-1d6de17c8add", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232275, "uuid": "77207c66-4e02-49d4-93aa-139044a7fc8a", "value": "3072:Xopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:YpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232275, "uuid": "b24d40ec-4e86-4bcd-8826-e5710d82c4cc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232275, "uuid": "7c95090a-504d-4bcb-a6e4-36a30740ab73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232275, "uuid": "bc453b73-d385-487a-be69-a9376a0929ac", "value": "4913d9ac0b7b6bdd9fc19e9e59d38af3a00a59b786e9ba56ee891db44b2fd7e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0f23d9-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200295, "uuid": "58e5b4f3-39db-451f-90be-7ad71fe3e197", "comment": "Malware payload", "value": "04806efac8ee6f673fbeeebc480b9bd0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200295, "uuid": "8a26c778-2ff4-453a-a047-3ccff8ad7866", "comment": "Malware payload", "value": "49175caede1bcc65558baae479ba1bd0d7f51c88966e299a5bb3551fa9eea9e6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200295, "uuid": "64ee041d-a6f8-4989-83c6-54766c374b5e", "comment": "Malware payload", "value": "7e83441fcaef1b308e54b28a46d7a5cbd9e27259", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200295, "uuid": "266d64be-18de-434d-923f-d36b4f4b6239", "comment": "Malware payload", "value": "61493b35b8256e6658fe915a7c0ad81054bd7c65de5cd497403dfec73947c017a264bc49ba4e650daa9940dd2a3739d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200295, "uuid": "4554bb6b-8895-49a5-84f7-0dde3aee5138", "value": "38B27121EC17B7510A3AC162ED420827E96841D223411079FE6E41BD7FF970949FBAAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200295, "uuid": "2ee36bf5-0f49-42c1-8fcc-26ac9c5f4940", "value": "768:izjOhvi7vRwnJQ8QeCiKQEameC0m1pr06sGoTNDMIpim2B:gjOp0RwnJQ8uK4t0kohQIpeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200295, "uuid": "e132069e-5698-431f-bf19-4c1fe2c9e3fb", "value": 25003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200295, "uuid": "b203b32c-8a85-444a-9e92-c86afafffc1d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200295, "uuid": "39343fd7-9966-4e1c-a718-4ae4f08436cf", "value": "49175caede1bcc65558baae479ba1bd0d7f51c88966e299a5bb3551fa9eea9e6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2d730a-924b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617213927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213927, "uuid": "82f93ac2-02e8-4c24-a455-f279ea2cf63d", "comment": "Malware payload (IcedID)", "value": "c4a231bdd759961f1d5ae52e19e8998b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213927, "uuid": "167c8404-b97f-4b9f-80b5-cdbf5afb459c", "comment": "Malware payload (IcedID)", "value": "497e2300c11ac54434c5b813a017653b916872b6d07f44ba419016de9ec7b01d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213927, "uuid": "0af34431-e047-4002-896c-e5425526f6a9", "comment": "Malware payload (IcedID)", "value": "66da5f08befe9fe0f47d40592e95295eef95ae02", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213927, "uuid": "f57f6c99-5004-4b46-a5ef-eeca689cffbe", "comment": "Malware payload (IcedID)", "value": "9e141eb63203ab524b0bd68edd3aa130f823ae8af27ea5614a46d4f46e218776d7ed5a1db3ae410fcc9363343d1517e4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213927, "uuid": "d90312fa-fad8-45ee-8d36-347c73eeb8ed", "value": "EFB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213927, "uuid": "15c3b443-ec71-48f7-8129-4b6654959221", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213927, "uuid": "592a73ad-bfc5-41b0-9241-a71a384f3b75", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213927, "uuid": "3405cb11-f635-4f77-8647-3d74de24eeb4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213927, "uuid": "ff525eb8-1195-4c0e-9256-05ce268752a2", "value": "document-325250864.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66457809-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216387, "uuid": "5a0af833-edde-4f33-ba66-a6102f2f6236", "comment": "Malware payload (Dridex)", "value": "65a42c48c3857fecd6c7bf5eaa44a466", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216387, "uuid": "415469c0-86d5-4252-9c9b-27f994f59c20", "comment": "Malware payload (Dridex)", "value": "498b174eb4cacd0d3b79715dc027f5b770a8bfb9a68053c1ce9127cc79c484bf", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216387, "uuid": "b7528845-7ff1-4372-95ea-816d57712340", "comment": "Malware payload (Dridex)", "value": "d2f5a462f1ce4d611dd792e8ab5eaebb1220248c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216387, "uuid": "49e2c5dc-c5a1-4916-8308-d0f8d5de2021", "comment": "Malware payload (Dridex)", "value": "3186b44732d67dec4da473cc98fc3c6ff57c38f19c1f58fa6b6bad302ab31398d1ace5f025e5560a3b9a8968e040151c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216387, "uuid": "4c8fc9bd-043d-4a1e-a154-1745d4a3e7d6", "value": "1E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216387, "uuid": "acf52f1f-192b-4efb-b985-10961db26679", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216387, "uuid": "d801d281-bf9a-4502-be5c-1cf83de5ad10", "value": "3072:Dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:EpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216387, "uuid": "26061d64-47d7-427c-96c2-ea8fcc9a0efb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216387, "uuid": "c63d6141-24cd-4f1e-9b82-2e57d201e8c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216387, "uuid": "d79ff155-4ff4-4c9d-9865-8118527fee0a", "value": "498b174eb4cacd0d3b79715dc027f5b770a8bfb9a68053c1ce9127cc79c484bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95293df5-923b-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617207016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207016, "uuid": "b6b74634-843a-48b1-b872-e83387a1997f", "comment": "Malware payload (STRRAT)", "value": "63e5ec90d36fafcdc22aad175130cbd1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207016, "uuid": "8b4ffe99-99c0-4495-a612-6c9fd78cff80", "comment": "Malware payload (STRRAT)", "value": "499e033f57c6291605c4e0b602b5c199e7a03712560204b25b2ed668264683e4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207016, "uuid": "29dc9f79-49a3-4289-9c6c-27a73b65cac8", "comment": "Malware payload (STRRAT)", "value": "480b119b33c97dbe54b552e700c647f2f0c7f3e2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207016, "uuid": "3bf283cb-de7c-4f5f-9cbc-0363f9e6c28b", "comment": "Malware payload (STRRAT)", "value": "14e88ef39144874adbda77463cc414b075e804208a84aaf4aaa963cf97c5688cc5a69a1241c2792e0e3164bc7444ab02", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207016, "uuid": "40a14e53-8e77-4f38-abef-c22f39481aa2", "value": "1AA3CF2BFEAEC2D4D51B4173200D5336EE8F8694D162542F6AF818496CB1D3D8B12EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207016, "uuid": "4f03ccf3-6da0-4436-a5ed-ff6ea91b2e10", "value": "1536:gcN5g9YfggaIg4EGjD+2Vok1FrVOvWJvxkL0yz3b/C5z08kZJYG5RYqp:vgmaI/5rw+vkLPzTOzcZJD5+qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207016, "uuid": "9b92ec68-fd2c-4c68-870b-cb37049ceae6", "value": 102055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207016, "uuid": "3ca71367-bfed-4925-bfa4-8e208237cee2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207016, "uuid": "2eacb725-ca63-405c-9ea4-d0cfd83f51b0", "value": "Quotation Request.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ca8254-9259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617220015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220015, "uuid": "098ed017-6ffc-492f-ac79-e85f1f958fc8", "comment": "Malware payload (Dridex)", "value": "f592d0be8144b0f831561cff3b6f2319", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220015, "uuid": "2fb6eccd-87bd-4fb6-9b1c-a057a8f9a958", "comment": "Malware payload (Dridex)", "value": "49a6993fc18703ff69fba54fbd4182df50e0169647bcbe7d9a55cc0f93886293", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220015, "uuid": "c4a478f0-fc62-42d7-ad2d-6b3c5d7b957f", "comment": "Malware payload (Dridex)", "value": "da8a1a59589be29b9f0ba1f7310f1aba43a9492c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220015, "uuid": "282128f0-fb80-4c7a-817a-aa0437e67569", "comment": "Malware payload (Dridex)", "value": "66fd52941d2a43e363d39bc251a28d0525cf95730f2d768dd36f570769ed4ad579923840bed80656b9c603c29d0e78fa", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220015, "uuid": "ba94c9f8-1608-43db-90d4-ea2934d39e35", "value": "1814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220015, "uuid": "1eff81c2-0c3b-498e-9f82-87ef4dd00fe7", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220015, "uuid": "b3a50706-fdf6-4569-a856-a0328df0bd0d", "value": "3072:8opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:DpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617220015, "uuid": "52a9253e-12f0-450d-9e22-1714f34e8489", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617220015, "uuid": "b25a16bd-9627-4b21-8962-1d491aa58895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220015, "uuid": "4e2a6598-8aa3-4dfa-bc77-5e41e8dd7796", "value": "49a6993fc18703ff69fba54fbd4182df50e0169647bcbe7d9a55cc0f93886293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd7fc0c-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159139, "uuid": "30951460-34d1-4173-b318-aaa05d46e9b1", "comment": "Malware payload (IcedID)", "value": "57402d14d57c2406f9256ed0ca6b4c80", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159139, "uuid": "7f7470b1-4863-4c96-8e15-745bf8a80cae", "comment": "Malware payload (IcedID)", "value": "49d02e23e7616ed8ad1d1c1d0227f4ff9bb8043947a0d3184a638a9afcac9094", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159139, "uuid": "58a44473-f52b-44e7-9259-bfddf0f00711", "comment": "Malware payload (IcedID)", "value": "cb504f901be196798acc016d8a417b327e0e28ea", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159139, "uuid": "8911a97a-680b-46b9-9155-2ded669a5ae8", "comment": "Malware payload (IcedID)", "value": "af5de31d91f1b798fb694e1136d57fec7592cc7ea0f4d0d1de65300f3968c81aa9b3c3710cefe49f3a21e6eae8458d01", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159139, "uuid": "2aebed47-c568-46bf-8c06-facb9190cd4d", "value": "B8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159139, "uuid": "698f1609-49fc-4c1a-9172-9f3a27b76d84", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159139, "uuid": "59395616-5fb5-44f3-b087-5b539e8ea1d8", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159139, "uuid": "b3c99c60-4d64-4b5a-a894-da881a06e500", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159139, "uuid": "34159fb3-daa0-401c-b5c6-f2890d8d5174", "value": "document-1970254878.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16992dc5-924b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213676, "uuid": "f5027c24-7e3a-4f56-8433-1218d8531787", "comment": "Malware payload (Dridex)", "value": "4787e26c0a51d4764cc3e30aad707908", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213676, "uuid": "50f32a1a-6b92-44f8-b44e-21f88e056ab4", "comment": "Malware payload (Dridex)", "value": "4a166c97a0d05385af0d4204457152fce7b7d46b93b2d7578429c35b0927528c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213676, "uuid": "ad8dd9d3-800c-45aa-80fe-aa945793dfee", "comment": "Malware payload (Dridex)", "value": "36d1ac324aa12fa26457cc249548fc36c7d434e1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213676, "uuid": "1e3d7498-9cfa-4638-8dc6-e67f89e9a435", "comment": "Malware payload (Dridex)", "value": "8f6ee6ed109f6a4e9e7b97feab38412c44534c57475eff232ae9977b06e0b92a3927698a0eed3cd3037eff1b52774505", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213676, "uuid": "55a32d6a-ff98-4c32-b5a0-f4f906892c08", "value": "46248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213676, "uuid": "228f4ed3-411c-42f0-a8ff-01a33040b9f1", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213676, "uuid": "e87bedf5-7ee2-4026-af06-0a51734fac2a", "value": "3072:N6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:NoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213676, "uuid": "eadc7df7-c774-4938-8a59-00140e24ccbf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213676, "uuid": "6401a51a-c9cf-419a-8789-c824aa2a5d25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213676, "uuid": "6c685bcf-22bc-4efb-8377-a0c3e077ac57", "value": "4a166c97a0d05385af0d4204457152fce7b7d46b93b2d7578429c35b0927528c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba768b1b-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217816, "uuid": "f4a16a58-6668-4600-806d-36e9f6967c8a", "comment": "Malware payload (Dridex)", "value": "edc4363f76ae7e4249d699c3d10681f6", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217816, "uuid": "6fbdc1ce-6d1b-4243-9d4e-36e74a185dcf", "comment": "Malware payload (Dridex)", "value": "4aba04e06152d9f12ab8ba04bca7cfa3971d37b75a0c928f84753b0dc5fea088", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217816, "uuid": "439592a9-4092-49c4-9444-a6468a8e8f95", "comment": "Malware payload (Dridex)", "value": "63adc7aed08809b9eff0726c6a46886af618c502", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217816, "uuid": "22915170-d540-4937-8bd1-6c56dcbfd14f", "comment": "Malware payload (Dridex)", "value": "d020a75daa1d2985ebbdfd6b459622df43e57e1b56e9d32865fa0c897dcfa89c7008b5764f702ee4b97564b836bef43b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217816, "uuid": "ccbcad93-31f8-4474-88ce-6b82201d100d", "value": "4714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217816, "uuid": "553262e9-6209-4895-8a85-7a770a70006f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217816, "uuid": "b9318533-7ed8-446d-a4cf-8c3d20b62ef2", "value": "3072:Ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:mpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217816, "uuid": "2fd8603c-40ee-491c-82b5-2839064ca426", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217816, "uuid": "94c81165-f571-45ed-8a76-89ce6f8422d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217816, "uuid": "78db52a2-7f15-498a-91f6-abca0e3071f9", "value": "4aba04e06152d9f12ab8ba04bca7cfa3971d37b75a0c928f84753b0dc5fea088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa98a372-91fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617179269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179269, "uuid": "079db419-71eb-4ca3-b1ee-0b4d68eef70d", "comment": "Malware payload (AgentTesla)", "value": "cea31134c9f6998dcaaf327fb1763a4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179269, "uuid": "b2904f0e-d6fb-4b0e-b44f-33487a53c229", "comment": "Malware payload (AgentTesla)", "value": "4acde41f7dd76c5591a90297fdb74422601c8287639e4f04cfcd5c7102765676", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179269, "uuid": "ce2db036-6bf1-458d-9eea-64a2f01a76cb", "comment": "Malware payload (AgentTesla)", "value": "736904d91c34f5bd254723c287598cde567069a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617179269, "uuid": "040f2c68-cd1e-450e-8ed8-470fbdd0d05c", "comment": "Malware payload (AgentTesla)", "value": "6aa7174d3d5484950faf6f3255994b01ae04b3001f9fab8a3df10f3667f1c2017dcfe6aa4105acae287f20a13cc09210", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179269, "uuid": "d8954d8a-98c1-45ab-9230-58158ac48f31", "value": "2705E115321ABD46E43E8BF100DD0B41B3F39B84871AE97DBC54E1989ED22C6B6E76C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179269, "uuid": "de5e0d7a-0294-4d01-9922-789325bcfac4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179269, "uuid": "28d0c16e-9c38-4b20-a3b5-fe5ab251dcbe", "value": "24576:ZH9fjBhEStCFJpw1AVM5mP2CEGwC6dTn18JMxx+X:JpQgC6tOJMxxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617179269, "uuid": "63fdd559-2c02-46df-a4dc-d8a64bf7a8d1", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617179269, "uuid": "0c7ae6f9-2abc-4467-bdad-5737004a87c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617179269, "uuid": "125109f9-8c9e-41d1-9e87-95f79652461d", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4c32c1-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232795, "uuid": "424fa405-5510-4752-8b2d-443d47cd7b00", "comment": "Malware payload", "value": "2bb151bfc8dc3ddccf318d585e12bcd3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232795, "uuid": "dba07b67-a90b-4f85-a189-95926a6c7a2a", "comment": "Malware payload", "value": "4ace76dd8ffda96b052a297012557190716ad2ffecf693e26b98c6cc30a61df8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232795, "uuid": "cfbf7731-bb1c-4819-8585-101dec3d1b05", "comment": "Malware payload", "value": "fba42e0b198be56d737459347a2573a82c1ba592", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232795, "uuid": "99ed98af-7959-4d0a-8702-dd9ac6a0ff88", "comment": "Malware payload", "value": "d9191d088c65fb79124fd0d7a7fb24c89c05fec04dddb30971d2829db78dc11f076c56dc2eed3ab32f8e0cdfeabc2aa7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232795, "uuid": "d1c7f32a-05cc-475e-bf3e-e01f3e4760f4", "value": "4B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232795, "uuid": "885cc7d5-ee9b-4e6b-a92c-7e6a948ae15c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232795, "uuid": "59e5fd92-e9d2-4cab-80bf-1f28f6ef9db8", "value": "3072:topj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ipjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232795, "uuid": "56fe36a8-f6fe-4712-a93e-f5b00677254c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232795, "uuid": "9cc476b9-5056-40be-b053-8fd8f70484ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232795, "uuid": "02e5551f-aa67-4a88-a6c2-433560c42a5c", "value": "4ace76dd8ffda96b052a297012557190716ad2ffecf693e26b98c6cc30a61df8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e35856-91dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617166397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617166397, "uuid": "c6758164-2857-4a68-9900-40e102520ec7", "comment": "Malware payload (IcedID)", "value": "8d13153b706e823570ee6947debc576a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617166397, "uuid": "6878cc9f-e6c2-4527-95e5-eb163014c148", "comment": "Malware payload (IcedID)", "value": "4b02bf41d2b17859e8527882a3ec25f2552660703217b88f26822323bef0eeaa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617166397, "uuid": "6ede55a1-982a-4b39-a0c5-f2c679f09e03", "comment": "Malware payload (IcedID)", "value": "d81ca5874c977d56c8fbbce2c4f150fa2da5aa9c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617166397, "uuid": "48ec5338-9544-4f63-b971-ed6bd0662d1f", "comment": "Malware payload (IcedID)", "value": "390374f3ce8daa48b4f7312be60c0ad8d164e1dd42ff22ce8dd70d5b2d55188bf0ad0c4fdba7df2c5413338d6d328f12", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617166397, "uuid": "a5dab9c6-0ac5-424e-92d7-4e2f918b0162", "value": "F4835DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617166397, "uuid": "1ed1a084-ff0d-438c-9914-bbfba8996cd2", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617166397, "uuid": "72916e67-fbd1-4fe5-bea7-96e80fd0b859", "value": 80878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617166397, "uuid": "fa776bd0-a92e-4643-9b35-9b0627fd74aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617166397, "uuid": "708273da-4c83-4170-8371-cb0a20ddaad6", "value": "8d13153b706e823570ee6947debc576a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df088a9-9264-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617224399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224399, "uuid": "ddb73b22-151e-4a3c-a21b-95aad787993d", "comment": "Malware payload (Dridex)", "value": "91c79b7432d31ed7141546a3e16d67c2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224399, "uuid": "e8c50432-e8c8-4f52-ab48-91c86e8f595b", "comment": "Malware payload (Dridex)", "value": "4b077b6329be15b08ee811f982839948b87ae40c3dd7f80141b77ff3c6661614", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224399, "uuid": "6d9903ca-2e7e-4601-8e23-c92de1136601", "comment": "Malware payload (Dridex)", "value": "ad67b59011a44645e2c8ef6926aa44658345482a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224399, "uuid": "0e66f1a9-c44f-479c-8592-0fe1846e1a98", "comment": "Malware payload (Dridex)", "value": "311d82c80f8fa1af97aa0e88ff12a58e0bf2a70ebd307a239e915ebb5dec83b5c5f237921ef962f03d160c6175ae229a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224399, "uuid": "446cae0a-f3f7-454d-90ef-393f9a4152c6", "value": "41248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224399, "uuid": "c8bbb595-faef-46a5-bf19-071605272a14", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224399, "uuid": "fffd1d44-1eb6-4e49-8a70-e47dd0af9ed9", "value": "3072:X6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:XoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224399, "uuid": "c35dfa66-1baf-4364-82ea-99f47d3ea5b1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224399, "uuid": "e9ab43d4-66b4-4e7f-bf7e-98e522e294d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224399, "uuid": "1f97b61f-3fce-4933-8516-71d5132ef3ba", "value": "4b077b6329be15b08ee811f982839948b87ae40c3dd7f80141b77ff3c6661614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c089654-91d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162280, "uuid": "6841a90b-cb91-495e-a9a8-3a1122c00746", "comment": "Malware payload (IcedID)", "value": "cc5060bc5d1467aa6b5cb2a00f182210", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162280, "uuid": "d5b71aac-7050-4f18-bc9e-c2849d27498b", "comment": "Malware payload (IcedID)", "value": "4b359b57484dfdcff09e3dacbfa4a97e0a9c9d5e6affc691521b7856d4af3a86", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162280, "uuid": "37f74210-5182-4768-9eb5-b625433ff4c0", "comment": "Malware payload (IcedID)", "value": "104b09ae6f438af1da177b8c0c90bbbff6e36844", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162280, "uuid": "ba861ac7-7fa1-4f18-a165-c6834deaa607", "comment": "Malware payload (IcedID)", "value": "f35d0d68bb9d25235b3a639492d9537bf8b6d9c259e53371a83eabe38a0e6d9e51783be39f9f8abba1e29d369ef04590", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162280, "uuid": "daed0776-fd5c-4b13-b2ea-ac07174d1016", "value": "2BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162280, "uuid": "75a129a6-d469-423a-a19c-9a279fcbab50", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162280, "uuid": "d4bb0bbe-c80b-4564-b6db-20198ad090cd", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162280, "uuid": "2be500f6-88eb-4dc6-b79e-432d14426bfb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162280, "uuid": "489223fb-54e9-45db-9977-480f7a0d212a", "value": "document-627251743.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034fcbdb-9238-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617205483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205483, "uuid": "1328f079-2bba-414b-8458-3304b8758da7", "comment": "Malware payload (AsyncRAT)", "value": "e00c1ea0cd7016eabb3f50361d9aa132", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205483, "uuid": "4b46c29d-608a-4c6b-8f30-86c1c6a88de3", "comment": "Malware payload (AsyncRAT)", "value": "4b4a2ef593425b8beebedfbd78c6ba48996d7d141d0579da24558d7b1d5dfb55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205483, "uuid": "9acfb6f0-ec0b-48fb-aadb-a7f1db57d586", "comment": "Malware payload (AsyncRAT)", "value": "613f1ac5182703ac543b9a95b56737d72820cc7a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205483, "uuid": "1c63b41e-0c0d-44e0-b139-3191d32b631d", "comment": "Malware payload (AsyncRAT)", "value": "b2805c055f76270c0bb8ff13d2bfe8ffd2bef81fa79a6a747afc4fd4e09d5828bef414f808993bba8ba00b0d621722fc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205483, "uuid": "8c58ae2f-cbb7-4961-9a03-aa08bcb8caef", "value": "4BA423D97AF5BFC9D123A3779992970F0660EDF9CB18844B53297019D9B33B45E0A00E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205483, "uuid": "e1eac1db-9465-4e6b-bc89-7393a8098dba", "value": "12288:mF3ua6gEgnIlavpYJ88c8nBDYmQ/WNX8mKRZxw:oX6T34v8txC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205483, "uuid": "702f376e-47e9-40fd-bf16-a874a87aca7e", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205483, "uuid": "d47f6bcd-5429-436e-9ba3-6e1db43368df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205483, "uuid": "e2d34594-fde6-4972-a7e4-c19cb4bd39a1", "value": "MT Group RF24032021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad74d6c-9264-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617224447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224447, "uuid": "a7db32bb-262a-4418-ad66-5e69efd14a5d", "comment": "Malware payload (Dridex)", "value": "b73e7f31b17cd42fd18efcafb6d38e3d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224447, "uuid": "449b53d3-3aa6-40ab-813e-373bff44de4b", "comment": "Malware payload (Dridex)", "value": "4b8ce47189fb9e1f9be8cc15b2597f3c741aa8583998c248755144593d10692a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224447, "uuid": "b448ce52-c800-4c3a-bbb7-c47b2d6110a3", "comment": "Malware payload (Dridex)", "value": "7ea7785290ecc21679584e6c1ee1ddce1ca72069", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224447, "uuid": "ef231203-c31c-474d-83cc-43c5fba995db", "comment": "Malware payload (Dridex)", "value": "6b3508673dac4c04c3e5831df0eba1dacd54cdadd66cda00652756df7c9c9ecf6036624d7649f9aae8306f63e477b1d1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224447, "uuid": "839bb91d-bb24-4d02-ae08-3781358ed1b8", "value": "4A248C5FE339E486FEE3CAF44186A72296A39C92436F580DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224447, "uuid": "79d33605-6637-4c29-930a-2531ab4314ea", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224447, "uuid": "3d28b921-fcc4-4ad5-a278-192a187adbaa", "value": "3072:z6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:zoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224447, "uuid": "011ee899-542d-479d-b31b-eefaf5f2d696", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224447, "uuid": "454970cb-8d0d-4f40-ac01-028eca14b93a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224447, "uuid": "f0f83fff-d500-409c-b87f-c895437b1854", "value": "4b8ce47189fb9e1f9be8cc15b2597f3c741aa8583998c248755144593d10692a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4143a88d-9240-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209023, "uuid": "364b72dc-7c88-4e2a-9850-7cb15850e34a", "comment": "Malware payload (IcedID)", "value": "67b9d5aee60854732fa2b20e2f1653f8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209023, "uuid": "9b9f71eb-58fc-4118-b5bc-2439d711cf96", "comment": "Malware payload (IcedID)", "value": "4b9986ed71a17651f1710077b5f397cce6ef250fb041ce4f9591094a3fb9b94f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209023, "uuid": "df080893-a7b7-4f97-a5c0-c5c2a1922ff7", "comment": "Malware payload (IcedID)", "value": "f931705d2a7227d220b935b9bad38578b794b647", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209023, "uuid": "c7df3fba-eb2c-4b8e-9598-d9c36ac2ef29", "comment": "Malware payload (IcedID)", "value": "ba4ccf7019ece3dd36eea0951eff174ff26b1c136d760a93671352de1009d32e50cb5de700d2a378d20b98b733cddedf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209023, "uuid": "73f2f20c-6f38-4d98-84de-755ad578aff6", "value": "0EB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209023, "uuid": "48b37098-8176-45f2-b7d8-06abcb0b9f30", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209023, "uuid": "bcdf8085-70a5-45c1-894a-ccdc3fcf6a8c", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209023, "uuid": "2566d50f-16d3-4a37-a14e-716ee9017915", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209023, "uuid": "66af24e4-4aaa-4d6b-8f55-1cb654871631", "value": "document-1169491079.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb9fc7c-91f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617175916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175916, "uuid": "4425fef4-127f-42a8-a14f-fcccdb633247", "comment": "Malware payload (AgentTesla)", "value": "bba11f81794c3a2574e680976c6b8e54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175916, "uuid": "247e99a0-758f-4259-869b-0a08779db8a7", "comment": "Malware payload (AgentTesla)", "value": "4bbc025849f8996952c998d7658df3dc8d70ceafb8dbdb22d55e94b2abe00d81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175916, "uuid": "8563424d-399c-416f-a999-4e4dffa1e6c4", "comment": "Malware payload (AgentTesla)", "value": "084c2068d4770be406fb713f176948563650f757", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175916, "uuid": "d1c07e3e-b0b6-4514-88ed-a973acf4e0fd", "comment": "Malware payload (AgentTesla)", "value": "c211f973773f6a195e87d5fe36566b5f5f985b9621ad30b49a9d197a47df1a4627c2b689c1690c65dfa12fc1dd29d837", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175916, "uuid": "90792314-baab-4f33-a8dd-4236eb0a18cf", "value": "F5E4A1A870AE405CEEB46B34F5B555821FC925321F62FF3F28E657006CA3769FA4E520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175916, "uuid": "d679e56f-1473-4050-b782-5d8aea5124d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175916, "uuid": "0bb7dbee-476a-4140-b6a1-beff286888f9", "value": "6144:na0H3vfIKEcSEopNALNlNHh7FYloNyyKKSwsrCdgzmKSSuC8RY7VymvMRZ1xKQmg:9YtzALNh+SfqZCdXSBXuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617175916, "uuid": "a28ba571-a84c-46c9-969c-e1aa6f889365", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617175916, "uuid": "af1ee35f-8132-477b-ad67-78e5f2f37d92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175916, "uuid": "6cc161a2-eff8-429c-8b57-2d13180105a0", "value": "bba11f81794c3a2574e680976c6b8e54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d15223-9243-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617210420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210420, "uuid": "85ddcfc0-e062-4a43-9439-c1c819e839ea", "comment": "Malware payload (IcedID)", "value": "78eb578b79ecca1e5d4c9a8c40a29db3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210420, "uuid": "dc47b0fa-feed-4e32-863a-190b12e0ebaa", "comment": "Malware payload (IcedID)", "value": "4c06118e45c1becf339dbd9ff93ad2a6e0a7080eb113fbb13dbdc60de1fd077d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210420, "uuid": "1b68b22e-355d-4985-903b-7494e17e9a11", "comment": "Malware payload (IcedID)", "value": "222e1d785794a8bf2a04c684ca72995b320410f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210420, "uuid": "b010a1b8-c83e-4abb-ab7f-e07ef4ff833c", "comment": "Malware payload (IcedID)", "value": "cefe9b9d918a17f2a3d7288fa9a83f7ab821dca786c99e8bdde0a14fc82c6033cb71c4ea1ebecfbf2d39d6c1d005f51b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210420, "uuid": "2c01ac37-f554-4c2c-8a62-f6f5145d1bb4", "value": "19A37BCAC9710643D4379933C1F26B28E526FB60B3A395FBC0487266C593690EB72776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210420, "uuid": "556d0c34-12e0-4641-8dcf-dbe591ff3bdd", "value": "768:YcaM04GKf146QXQRno2wI6PudG9Sktdxp9AOCs+Apj0mjJbBRgYc/WVI2C0v:mxKf0A+2R6QG9txpSd2iErR13I2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617210420, "uuid": "cdec90d8-2365-46e3-81e9-623518c9f095", "value": 101619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617210420, "uuid": "8eee3dc1-d32f-42a7-b72a-adbc1d534f59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210420, "uuid": "f30d9953-0857-4f9c-9ba7-8c4abac5fcbf", "value": "78eb578b79ecca1e5d4c9a8c40a29db3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6821b5-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232394, "uuid": "431862a1-c1a5-4c8d-b2ee-95dea52ad3ef", "comment": "Malware payload", "value": "aaa8dc7c37da7d609ca9a4ba77845b9e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232394, "uuid": "8f2ecbf4-7e67-4058-aab4-d26bf4e34aef", "comment": "Malware payload", "value": "4c2c12588cb7db121cf238c1cc2bf7cc5efeeeca946683f7eacf0cd59c94adff", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232394, "uuid": "83335f92-8b8a-4d63-93a4-3fc43419439c", "comment": "Malware payload", "value": "f3c6e893628d2e0d96927591e52d7c9c99a31dfa", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232394, "uuid": "28f27237-ab0f-493f-9fc6-2c7026d6e450", "comment": "Malware payload", "value": "1c014606cd8df4ac07211956df9b33217972d2bc4f6746e10ec99021db7ed47d0ed1f521858ce80c15d27ec84d856bfb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232394, "uuid": "39f04bcc-80b7-45d1-a308-11587901c553", "value": "F714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232394, "uuid": "a912ba1a-de0d-4f27-b94c-8c7fd80ec95f", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232394, "uuid": "96374c76-06b4-43b8-8fc5-34f4eb420c15", "value": "3072:g1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ci78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232394, "uuid": "39a47b9d-eed4-4c8a-862e-509596260529", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232394, "uuid": "96c06d3b-fcca-4ace-a928-d9a4d98b2de5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232394, "uuid": "edc29838-f95a-4eeb-bb6a-a97abf6598f9", "value": "4c2c12588cb7db121cf238c1cc2bf7cc5efeeeca946683f7eacf0cd59c94adff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461abe79-9238-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205595, "uuid": "15004c07-3d69-4f8d-baf8-4fdd68e3eb76", "comment": "Malware payload (IcedID)", "value": "98cc9cd10771e3f2f92ed759fc2ed868", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205595, "uuid": "1d6fbbd2-deab-4865-8fa4-1ed87d10ceb9", "comment": "Malware payload (IcedID)", "value": "4c6adb76f346529ca79e51d4c389a4f4411698cf73f040349e9fffd1904eac7f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205595, "uuid": "42ba9530-31b4-448c-9a6a-a464a340fdd3", "comment": "Malware payload (IcedID)", "value": "9eb88b7d4f318f8fe6ba27df46a58bbb429dffdd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205595, "uuid": "8bf6437b-34b3-47b1-8b7b-32e972ee20f9", "comment": "Malware payload (IcedID)", "value": "e9efef45161578727018a41dc52af909db1686aca57c23aabfbda31829fff8a90110dee1db6ad18ef1de359308a49e5e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205595, "uuid": "6ba1182e-86e6-4ebe-bb0a-f330fa61ff84", "value": "53B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205595, "uuid": "866cdefa-fbc3-4252-98d5-e61418dbd201", "value": "3072:A2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:AqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205595, "uuid": "1e803817-f22a-452e-9a18-2cd63a96d372", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205595, "uuid": "244c45a8-356f-4e54-9a1b-170cfe2ea384", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205595, "uuid": "0ffedc0c-9ba2-4612-98be-27b71e224df2", "value": "document-1184367585.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f5df65-9244-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617210720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210720, "uuid": "140fc8d9-3897-4386-8bb4-4b07e74b7118", "comment": "Malware payload (IcedID)", "value": "1dd3be1c20c848b771242131d450eaeb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210720, "uuid": "1113b9f5-7149-4521-a1bd-2b702f4b1244", "comment": "Malware payload (IcedID)", "value": "4c90ce519179a5a643a2328097a2b54cbc1a0a0b556259dca0d2dd8325b6764b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210720, "uuid": "e66ebbc1-3e73-4cb9-9447-cf4100e8d68d", "comment": "Malware payload (IcedID)", "value": "6e0b0aa802486b0fd36dff5927dc0e493bc817d6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210720, "uuid": "636a1bab-ffc8-42ee-b9a9-1ad9720357e6", "comment": "Malware payload (IcedID)", "value": "9f8d3566ddc027f36c9aed269d6fa34d0998c78737f60c234d0b4423dd71b6157eac361e930137f1800ae708efaf0317", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210720, "uuid": "8568f2a1-5bcc-4bea-926a-8f70d733730c", "value": "D7B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210720, "uuid": "5d5d2b3a-c516-4757-b8fb-fff7aebb82c2", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617210720, "uuid": "b3d88d4d-ae5e-4873-a73f-820088143768", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617210720, "uuid": "ab2f8b89-4ed8-4551-b77e-b4aba397fa38", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210720, "uuid": "2a1ebe9d-3c31-48fe-b8cc-60e2ca10b86d", "value": "document-544980560.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9b4ee4-91d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617164292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164292, "uuid": "44d6cbf7-ac26-4ebf-aa41-2b396901a53b", "comment": "Malware payload (IcedID)", "value": "8e41a7d2bf559b300740b46cf3a0beed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164292, "uuid": "054bd22a-75a8-41ab-a70b-5f27f393dcb3", "comment": "Malware payload (IcedID)", "value": "4cebb31bf05b288feb869bff17a381b2bf22ab5bbeab6e6b397a9ece7d80bced", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164292, "uuid": "c4b55e43-b2fa-462f-886a-f10f62d85bcd", "comment": "Malware payload (IcedID)", "value": "fc9a74007d3fd53718682c3d4de6d58ab9144691", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164292, "uuid": "97ed37a0-633d-44c0-bf8c-306926b945f2", "comment": "Malware payload (IcedID)", "value": "6ad8d91dad80083e96a15f9b1d8434803a935bda4b8fb2487536e1f2c9ec7538e7729afb115ddde26fc2666cc5edabec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164292, "uuid": "f5a38e5b-5b4e-4e20-8e39-62419f88c9ac", "value": "7F935DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164292, "uuid": "649f9581-081d-4992-9601-9691c56a67f8", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617164292, "uuid": "302828b2-987d-4f7a-95e2-acf34ad4590c", "value": 95242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617164292, "uuid": "32c6fd20-18e2-444b-a3e8-563ca6202a0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164292, "uuid": "02884242-74a0-44f5-bbaa-1bf10f555256", "value": "8e41a7d2bf559b300740b46cf3a0beed.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462f7097-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617195717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195717, "uuid": "fc88895a-cbec-476c-bf28-e119f1bf9401", "comment": "Malware payload", "value": "7890e436eb84173ff67ea51eb9a1b7bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195717, "uuid": "c44e4ac4-444e-4d0b-b83a-55846f14df9d", "comment": "Malware payload", "value": "4d21d5b2c9d9f333abb041399970df835604c03ff32b946910079ae2e674fc9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195717, "uuid": "7d40b889-9df7-431f-be6b-e3b587bc7417", "comment": "Malware payload", "value": "afd968a64e4bd65065da7b759b84745db3563a92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195717, "uuid": "bc5c9c1c-59d6-40d8-8859-2aa6c0bbf559", "comment": "Malware payload", "value": "2f23c9be91ed94f2e5b2cb71c11bb3af2551d0e9eda84bc68f72f843bf5f49c0dd08d28b4e4c4e4190cc0b1e0554859e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195717, "uuid": "ca670311-6b94-4076-bce3-7d7ab31b164a", "value": "6493FE316DC58379C78638F8D0027DB53AFDCAB3D020456B8EACE1E666B6CB51749C68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195717, "uuid": "da308842-4d5e-4252-bd9e-4049fa2b947f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195717, "uuid": "94d0d40d-abf4-437d-abd0-2b09c4a6a56e", "value": "768:YgHw+zaogYSnwoSu8bvr0YTZUeKNLs2LF6nsN1IDcF6SHblhci:DwGaPIoSuoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195717, "uuid": "122a0161-0558-45ae-9d51-08f10d40ad61", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195717, "uuid": "5eb39175-8c97-492a-a10c-9951c53971a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195717, "uuid": "c08a29c9-3c35-4f0e-b8d8-36e80790f536", "value": "IMG_061_36_01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46564a24-927b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617234372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617234372, "uuid": "b4f7f599-4ecd-4098-97d1-38010877a6c2", "comment": "Malware payload", "value": "f20562d0acc2695325d965c2b8227e56", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617234372, "uuid": "a2260c85-7f54-47cb-b498-640953e802cf", "comment": "Malware payload", "value": "4d2c3060d7a5781985f17acdbeed95deeebaf7ead098586cfa9517ad278c2f85", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617234372, "uuid": "99edb296-b6a4-4822-bde1-d700c6c10284", "comment": "Malware payload", "value": "8d97710767cf8f220fea500babc1c56cf08643d7", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617234372, "uuid": "4fa8b792-f701-422f-957f-e5970d9f5886", "comment": "Malware payload", "value": "5c1d79bd722e7baa122c1e69d7dc9b45979c151425e23247bda83625ed6a72e7a3aacda2d5c8f111bdba742e99e9cca5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617234372, "uuid": "94244d84-05a8-4ee6-be52-1ff89ccc6a9c", "value": "0114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617234372, "uuid": "a13a4b28-c7b8-4c50-b365-28e02d7b68b6", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617234372, "uuid": "8af6d5b8-1ce3-4ab2-8bc7-3e2c969e5a51", "value": "3072:9opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ypjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617234372, "uuid": "16014860-226b-4fa5-9bb2-ca4bfe2f4002", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617234372, "uuid": "06565f48-ca65-4443-b2b6-1a0af0699903", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617234372, "uuid": "400de215-5cff-42ed-8de5-288137ac230b", "value": "4d2c3060d7a5781985f17acdbeed95deeebaf7ead098586cfa9517ad278c2f85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d839d6d-9232-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617203084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203084, "uuid": "d49e1327-c004-41c7-92f9-3cbfe6fd6362", "comment": "Malware payload (IcedID)", "value": "30c5f0af3f96e4a1a1403c39cf058d42", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203084, "uuid": "937c6085-fef4-4a7e-b845-fbebecda9107", "comment": "Malware payload (IcedID)", "value": "4d2f050c81fd3be3cc0090c6f7b42a99b12b88fc39e9a4ec377b5e94489a7855", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203084, "uuid": "f34822a1-6559-41f8-b29a-0512b728c623", "comment": "Malware payload (IcedID)", "value": "99ef944a76bd1f8702b8ac80ceb6fa42e22fd3ea", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203084, "uuid": "40c68391-a10a-4c45-a3f1-3300dac83cba", "comment": "Malware payload (IcedID)", "value": "57109fd2b1ea4d8788920db36af8e450cbf879778292085212abf7cdce606ccfb9c6f60df62d7952a0beaddfe611e12d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203084, "uuid": "a38279da-0662-41bb-a085-ee088120d055", "value": "A0B3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203084, "uuid": "de053109-fef5-4306-bd6a-a980249579af", "value": "3072:u2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:uqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203084, "uuid": "1a22e268-6b6d-4ff3-865f-13ebc39f83a8", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203084, "uuid": "09b4998d-3918-4577-83f2-399b05be571a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203084, "uuid": "f8a60d31-ec12-4172-a7a9-d9bc4d1fe64f", "value": "document-1178664949.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2228adc0-9223-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617196515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196515, "uuid": "194b2650-ea1b-4f6c-8b00-2218888c0ddb", "comment": "Malware payload (NanoCore)", "value": "a92dde55f0cb0b98c46f7ee86f323563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196515, "uuid": "6722c906-b8a8-465d-89ca-9c83d24c5f65", "comment": "Malware payload (NanoCore)", "value": "4d5e5a73f1a72488434792a60058592fea951df2b5b7d139aec774272ca149b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196515, "uuid": "92bed4d0-29c3-4b79-b222-30e044a5bdef", "comment": "Malware payload (NanoCore)", "value": "3df3d7914a73affc60d986aef363a7df294c6589", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196515, "uuid": "83acaff8-9459-4248-9d21-0a2a2ed7d89e", "comment": "Malware payload (NanoCore)", "value": "3bc2e7dcc9633db6f836317564113aae000feb53371bac1a617d25c51d959d7a5fa18f0bf38bc64b38b64bfab2c44a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196515, "uuid": "265f0793-51a8-47a8-8651-3e56234751f9", "value": "FBF4B4AC30AE609DDEB5A630F5B45D925FC428321F12FF3B249327446C6B766FA4E460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196515, "uuid": "6fdf7751-3787-4c8e-aeb5-36e4ff88ee5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196515, "uuid": "e8bc1cc7-9558-4039-9601-9cc78b900dc5", "value": "12288:qaB2Rsk2t7db4E3CVgqGvWxac4SOzfmyzt7uykSBOsEP1elhHyEaTeT5Yur7f4:qZb2t7dbBoGv/BwyzxlBUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617196515, "uuid": "225cbff2-a977-4a5f-a638-91649278d86d", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617196515, "uuid": "b738f688-6d1a-4900-97be-c8572f79613b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196515, "uuid": "3f5eb1e1-9b4a-4669-bba9-cd8f6222d357", "value": "URGENT_ORDER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae9eb15-921f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617194758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194758, "uuid": "5d7140d8-a0af-4aa0-b551-508274ea7da1", "comment": "Malware payload", "value": "0265fb3fdca25aa9bc5c0fd495e3590a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194758, "uuid": "71ecf178-6eaf-4ceb-a7d3-cf78f8fc1c6e", "comment": "Malware payload", "value": "4d630c5830d0317ebe89a54d9575a3d63449b2ae3a459dd7dabcf6d7eb3107c5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194758, "uuid": "37a4ec85-0b20-428f-9343-dc88e928d7d9", "comment": "Malware payload", "value": "a1a171861cf974361c0e3bd9f64f972b95feb021", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617194758, "uuid": "4ca3328e-44e7-438f-aa6c-b56cf91ed5ac", "comment": "Malware payload", "value": "c2aef68ce5be0ea65edb53f96f4e0eb8c7ec3bc7992c567c6fe593f724e3188266f59f9c770a7a29a89990b7a32fee9d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194758, "uuid": "bdf6e4fb-bf27-4577-bcdf-b82146e4b90e", "value": "2782C56CC4970B888F89ABF92B1B1F44051C356DF384A17378B857741AE5EBE9612C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194758, "uuid": "19bdc7d4-121e-4e66-9719-97e96794058e", "value": "384:xIhKHMffnIae4muuzWicvF+9eGiPTowO3UBgWIoHl:qhsMZeFjSic9+9ejMwHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617194758, "uuid": "002ad63e-0d00-43e6-9c99-b49a2b810679", "value": 19174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617194758, "uuid": "532dd29b-4894-4d23-a324-95c698cba056", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617194758, "uuid": "ec4d7744-00cc-4693-96b5-2613c95cf67f", "value": "SOA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aad803-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202130, "uuid": "e8b4566c-d383-4402-9de9-e6b79c481e70", "comment": "Malware payload (IcedID)", "value": "b4a22568f778781369599de8e697d8e2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202130, "uuid": "b75cabec-a082-4abf-bd81-4e5228d3af29", "comment": "Malware payload (IcedID)", "value": "4d70182b26fe845f79337ad355825c7298ae5f6e2c1c265afeb85a789efe0f77", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202130, "uuid": "85163c40-ad06-4f00-b43f-1922664b282e", "comment": "Malware payload (IcedID)", "value": "70f2715fcb10347c2f920b3c15f82bc8c86ffe47", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202130, "uuid": "7475843c-c21d-49c9-b159-6366364e51bb", "comment": "Malware payload (IcedID)", "value": "88fa07e413ea78011838bd563cf60f16a4b7ef2ef0712b1baecbc06799a0d807920baf74b24d26444e2a025c57f56731", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202130, "uuid": "c718d488-9fd2-4d2b-8894-8524c45ddcd2", "value": "A5B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202130, "uuid": "db24182b-2923-4c00-96b8-9146574d5f45", "value": "3072:M2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:MqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202130, "uuid": "1f81d557-7031-4cd9-a218-53814d347ec1", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202130, "uuid": "619ab54d-b189-40db-952c-091998977e67", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202130, "uuid": "1ca9ef91-d44a-4b02-99c5-b4d01df4a240", "value": "document-298736015.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2440db7-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232459, "uuid": "fc512b27-c325-49fe-9596-e0f3221eb2a6", "comment": "Malware payload", "value": "33b357ee354891a9108df3a849cd88af", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232459, "uuid": "3433cd87-f0fa-49fa-ac12-5d1099e6ac87", "comment": "Malware payload", "value": "4d7181df365789a6226e67d9cf522dee5b39121853cd798068d4050393d15ea4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232459, "uuid": "3f83e728-b921-40fc-822b-a0a4e685e546", "comment": "Malware payload", "value": "9a79ee8e5cb79a211ba718a02e5c31f94bf609b1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232459, "uuid": "a735d58e-3a57-4bdf-abb0-9a79aac50e1f", "comment": "Malware payload", "value": "a042f57d0b4ffb49bf08de23742d2dff5519414d2067fc302faa25a259f13380419b2e2b4da40c4fb40525c1f4f140ff", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232459, "uuid": "b83dfcc9-2513-4838-8b0e-213ce8b3f6b6", "value": "4214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232459, "uuid": "ea1b0abe-5618-4820-8d01-069ca1f100ce", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232459, "uuid": "5f0e61cc-f87a-40a8-b18a-6503a8420171", "value": "3072:iopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:1pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232459, "uuid": "c8cfee6c-bb36-4e6c-bee1-37f796bd3ef4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232459, "uuid": "39cf18f1-91ff-49fe-b05f-c0b3e9209cb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232459, "uuid": "9133dd60-3fd1-4ed4-a3c4-78653c76bcc5", "value": "4d7181df365789a6226e67d9cf522dee5b39121853cd798068d4050393d15ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b00a2a-9265-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617225209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225209, "uuid": "b2c802cb-0270-41d7-8046-9ae522f722bb", "comment": "Malware payload", "value": "9c7f30b07a1e9b79c460b12e542c5d4d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225209, "uuid": "b8cf7be3-dc9b-4759-96f3-a6c164d29a21", "comment": "Malware payload", "value": "4dbbdb51fb34474ff6245580048e75925ec0d23d02842a4fe1d2c6e1324b76d1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225209, "uuid": "24e968e9-9a2b-498c-b527-33c10bb676a3", "comment": "Malware payload", "value": "ad690e75bac9c3557035556b7bcc836339516352", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225209, "uuid": "2b10fcb7-ca46-4439-8532-1d85a366cded", "comment": "Malware payload", "value": "58247fcd13304463c78e355f2bd72d7f7c2976c62b71a6ccab0aa4b3221e2ff8b597d27d32f59b879bcc7612f12dd9a7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225209, "uuid": "f1741805-1957-4dc4-8bff-6773d1c6ed53", "value": "60248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225209, "uuid": "11f3f33f-e836-4205-8fd6-4ca487d0d4df", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225209, "uuid": "9424de96-c00b-4ada-b66d-c34fc22eb93c", "value": "3072:n6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:noMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617225209, "uuid": "f043f92a-43d0-4121-af89-e65f9e9ece24", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617225209, "uuid": "7b6bee69-e982-47e5-bad4-f1f19691c8c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225209, "uuid": "8dbfa6d1-cd0e-40c1-aae2-8bf541618e30", "value": "4dbbdb51fb34474ff6245580048e75925ec0d23d02842a4fe1d2c6e1324b76d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79924e21-91c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617156719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156719, "uuid": "fe7a8081-444f-4a94-9195-ed467d9d5480", "comment": "Malware payload (IcedID)", "value": "08b9bb447415b876251a0f610367fcb7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156719, "uuid": "e87fcbf7-2a9e-4c7d-b94d-1ba942d5702e", "comment": "Malware payload (IcedID)", "value": "4ddd71a72c0ff3e514c20edc8d4855033e50611c5cf03454e93f6ade167abe10", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156719, "uuid": "f755b3cb-84bf-400d-a884-8f37d5e46429", "comment": "Malware payload (IcedID)", "value": "8b9ba79ae02adfcb4d80d14f63546975b9cbbf15", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156719, "uuid": "0c40e285-5a91-4586-86f2-83af350642f6", "comment": "Malware payload (IcedID)", "value": "76d90865d225f387c88c2068d477543f902620f7547f9c0d2a1715d59383dedfc491b04af745bd76cf4f34c8d5b91480", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156719, "uuid": "f7de0ab3-9083-4655-8636-546a4da0a930", "value": "36B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156719, "uuid": "1e105214-54e6-493e-8fe8-5a86b0acc2e6", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617156719, "uuid": "8d696ca7-13fb-4e88-b060-0bf1b61e9201", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617156719, "uuid": "12be69c9-2ce5-4d86-ba32-e315e03757fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156719, "uuid": "9ed025b8-eb4c-4f01-8c86-be0eb46da3fa", "value": "document-1936055461.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fd8ad6-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "4b8f84e3-613b-4bf0-bff5-b894ebede0ad", "comment": "Malware payload", "value": "13677e7c5ae216598f6cc74c06a13155", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "fe15d056-7553-42e7-9a9b-a5cf2fd161bd", "comment": "Malware payload", "value": "4dedbd2656024e7c9f692e83f69bacb41d0515a6ed4ca720c2f3261a8da60fb0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "3fd2fc65-f31b-4c77-9ff6-3f402d78245e", "comment": "Malware payload", "value": "1d15688a4e3d0370620e433d0005327cc43e307f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230991, "uuid": "598c11ad-6cae-43b0-8758-df35df20243a", "comment": "Malware payload", "value": "d191cf70d02d94efa016ba87a242089e02ee01d37eea0520c8be5ac1a8899161f6eeeab9fe713efb5be50b0f2d280d46", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "bd8e874a-3066-481d-afb0-aa1702697112", "value": "4C14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "8498aaa9-d760-404a-a63e-7f32afd91e92", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "e9cbc08f-aea6-46da-996d-ed0e70e3e77a", "value": "3072:5opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:+pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230991, "uuid": "8e547cb6-d8be-462a-bcf9-48c5484c1ddb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230991, "uuid": "16452a45-a579-41a6-9a72-89edadcd968f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230991, "uuid": "5deea789-97a2-4692-ac78-fd453c917bc6", "value": "4dedbd2656024e7c9f692e83f69bacb41d0515a6ed4ca720c2f3261a8da60fb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28886c1f-9261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223155, "uuid": "f94108f8-ad19-43b7-9a50-b6bd9268fb21", "comment": "Malware payload (Dridex)", "value": "ab7d78efe6fa1b3db48c578eebac020b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223155, "uuid": "16d5f56a-781b-4540-adcc-c9d319d72746", "comment": "Malware payload (Dridex)", "value": "4e31b23a164095403dbd7984ef316c38770f990832fd65d36180c41256eba691", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223155, "uuid": "6eba2194-76fa-4a3b-90f6-a0f4865ee95a", "comment": "Malware payload (Dridex)", "value": "bd8e20c8f003d4dd6282b62f2b349eb526e51821", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223155, "uuid": "fb8e873d-c31e-49ad-9404-09051571ad71", "comment": "Malware payload (Dridex)", "value": "152c199a92123f40b94cfda927c67ebe19c8d0e9bb0b1a8803604b7a98f7c387dcb81d95168b0b90e54cc2b7fdcfd3e2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223155, "uuid": "638f5d9b-8ed4-4d3a-81d3-01c7fcec7985", "value": "23248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223155, "uuid": "dfea787a-49f8-42cf-8d65-b97d84ef37ef", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223155, "uuid": "6611a4c7-652c-4571-8750-e959d3920276", "value": "3072:26TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:2oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223155, "uuid": "c0ff54f8-d7e2-4741-9e91-8500008bed02", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223155, "uuid": "5fcbaebd-0da8-4e5f-bb2c-5310d36de567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223155, "uuid": "161cb363-b395-4015-ac5e-5a5fd5c6b542", "value": "4e31b23a164095403dbd7984ef316c38770f990832fd65d36180c41256eba691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a195b5d-9224-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617197039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197039, "uuid": "b789894c-7174-428c-b9c2-d7f9bbd39807", "comment": "Malware payload (Formbook)", "value": "2839e67eeef4a8306f124909f77e976b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197039, "uuid": "207737fd-ad7b-49b8-ad2c-d946a1d31ca8", "comment": "Malware payload (Formbook)", "value": "4e5290b59d085d2d8492782191609fb2847e2f4a554b2ca48d1e7d7c86f6fb92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197039, "uuid": "5f714740-9843-4f77-a91d-b411975529a6", "comment": "Malware payload (Formbook)", "value": "5e36e38bc0542180b44b7651c84cf8e2f17ccf4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617197039, "uuid": "13020ef4-e96c-4575-a27b-5bee9d0a7a05", "comment": "Malware payload (Formbook)", "value": "1a08eaa1be9f9d80f8fef8becc221b9281a2716fdaced0173275bab1bd8bff3dc2fcb209edf2198f7cf1dd509cc93928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197039, "uuid": "08c0e9c5-7d97-4f13-b376-13db2bab4189", "value": "C7F4DF24321ABD45E07E8BF100DC1B4173E35B848709E97DBC9492989ED32C7BAEA7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197039, "uuid": "64fd3532-392b-46e4-9a66-5ac62fb6114f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197039, "uuid": "111bd8b4-3ae4-42a1-acde-bff686870b8d", "value": "12288:zl27AfmEYIhkrSIACFJUSMB1A/j3mlcpC7XJ4D0jHodycjPENjBqxzaqq:zl28fBBhEStCFJpw1AiypC7XySH+zEda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617197039, "uuid": "0d3d8179-4922-4fc2-8c83-56b32843ab99", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617197039, "uuid": "5d03841c-de8c-43b4-a565-adbaaa2bde98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617197039, "uuid": "0cae856f-564d-415e-ae2f-5024262d0bdc", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27712d0e-9233-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617203396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203396, "uuid": "c241d6fe-0f0f-4fd0-aea7-285359950672", "comment": "Malware payload (IcedID)", "value": "6890429895c8146751352e233d8af41c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203396, "uuid": "f469a622-9e55-4187-b7d5-2e8414080f4b", "comment": "Malware payload (IcedID)", "value": "4e733d150143fe761bb2530446d484022cd45e2930c61dd1439d1da0c9078f65", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203396, "uuid": "90bdddbc-8def-4f1e-a49d-263e0c9a5b9a", "comment": "Malware payload (IcedID)", "value": "b6e0b3abd06be5f7259cdaf113d40e5d978d5aab", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203396, "uuid": "6e19d830-60c1-4207-8d03-2607817d21da", "comment": "Malware payload (IcedID)", "value": "de2432e8ace528c737d5720bcb10fd490f42cc1ad2c545ac3b5bd8e3b537464217674bbd6eb31c38d2fa3dbae8409539", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203396, "uuid": "91449891-90e3-44ac-9114-5b796f6627da", "value": "5BB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203396, "uuid": "fccafb1f-3aef-43a3-b23e-8f306b08f8fe", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203396, "uuid": "3e2b3913-4b49-463c-8298-c63ee0fdd525", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203396, "uuid": "ca523822-75a0-4271-ba40-94f83557d492", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203396, "uuid": "d6f90fd7-dfc4-4102-b9a7-8086cd3ddabf", "value": "document-1942414654.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d235be66-91d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617164599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164599, "uuid": "87eef5e0-0c16-43b0-a304-d2bcb637c312", "comment": "Malware payload (IcedID)", "value": "82ca426e9a675da325102d0a8e43f3bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164599, "uuid": "cbe2bb79-41a3-41ef-8609-dfe9453f649f", "comment": "Malware payload (IcedID)", "value": "4e7ebb619cebd4bc87ad4ac1a70b5821d2cfa6be5867ea570d45987998949cf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164599, "uuid": "ed9a087f-b797-4de7-becf-593a8c265220", "comment": "Malware payload (IcedID)", "value": "ceed53daae904da1cfdd54d4c024e75a01bbd62b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164599, "uuid": "1ed77309-e08d-459f-9e94-76ed2f2320ff", "comment": "Malware payload (IcedID)", "value": "6a7efa06ce1cec2fa056e974c39da9b2452ae9b0f5a67976501c1a08a0811ae84f9a11b590eae6212590211eedab07c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164599, "uuid": "3e68abbc-373a-4068-9703-570566ff4a80", "value": "25B35DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164599, "uuid": "a80e2686-dfeb-47e4-a9b3-1a208cf0ca09", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617164599, "uuid": "ec6871b0-4b74-41f7-837d-fcd3894a61b8", "value": 116671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617164599, "uuid": "98327654-f3b9-41dd-ba7f-21f37e7a88eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164599, "uuid": "2c8661b5-539a-4de1-a81e-406d7dae13f2", "value": "82ca426e9a675da325102d0a8e43f3bd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d94d43a-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159142, "uuid": "e65dc41d-73a7-4ffd-8316-c78402284fa5", "comment": "Malware payload (IcedID)", "value": "5bf331552d56ca8f55883c5a244e4c60", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159142, "uuid": "ffb6cda2-980f-4a26-9b8b-6194cb482ea6", "comment": "Malware payload (IcedID)", "value": "4e975ed7ae2a984b3796bf1430c28f5727ac527598e55fe57ab57a95b09bcf90", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159142, "uuid": "480e9a74-1d1d-465d-92d8-6d955da6e628", "comment": "Malware payload (IcedID)", "value": "9cc915b0fdad890217d6a74ed0e2ecf6db67c342", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159142, "uuid": "55f508df-7b3d-4703-9d08-08040148c391", "comment": "Malware payload (IcedID)", "value": "51eebc44288b63510322fe586cb7d1309f39226603b8d4e1206baf52b01d736818f3c52531fa3a70b19dc49a89bfaae7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159142, "uuid": "da55e5ab-a2fb-414d-8162-9eadf8b701e8", "value": "4EB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159142, "uuid": "ab5f0ce1-6e84-45c5-ac47-22e3fd00bd54", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159142, "uuid": "71688df1-6c3d-4503-90b7-154ed9e5bdf0", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159142, "uuid": "7a166608-9f9d-41ae-8a8f-5673ee689e3f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159142, "uuid": "0348f087-0c6d-41c1-943c-bd996c32e495", "value": "document-1997958095.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f02a7ff-923d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617207731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207731, "uuid": "05c21e0e-0d69-4645-8f39-8caf0c8670fa", "comment": "Malware payload (Dridex)", "value": "3166c9e87dda1f896a7e2a1894ba279d", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207731, "uuid": "16ffb40a-e3f3-47c5-a34f-f8156458ddf5", "comment": "Malware payload (Dridex)", "value": "4edb85bc25603bb33ddfec00d3258176ea15a736b566b01c298269333bf2b445", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207731, "uuid": "5b70386f-9cb4-4a71-b537-7ccca6e554c6", "comment": "Malware payload (Dridex)", "value": "9457528c9fe39e48f7cc5b7b0b67881bb6ec1b1a", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207731, "uuid": "69de508c-dbbf-4db3-bd5c-613522d1dd9e", "comment": "Malware payload (Dridex)", "value": "5523668218bea340aa552a974002d8a7a3d29deb94bdeb535fa26475c2c4901d5bbe3b8010dc641b37a274da129756ce", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207731, "uuid": "d7d20601-7d29-4727-a6b4-d1ddf42342c5", "value": "F284DF42EAD54431EB726F3808738B514BEF79D18E308CABA29C205D1F676D0567CB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207731, "uuid": "3707a9e9-5f25-476a-948d-7514495c01db", "value": "f80d389dfa6eb310b9592775bddbb2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207731, "uuid": "f080c90f-e06d-45be-82a9-9434749d4951", "value": "6144:BCyziHGu+B0VlPM+iHlDx7YVUggVSkMObhe+UqN2oCh5pGmN+zT:EYiH06/iHlDx7YG7RTIZQFi5pFuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207731, "uuid": "6011c74c-2bbb-4eac-b849-8e0efc3d9142", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207731, "uuid": "7d32a8f7-1905-4250-a3af-abc324fa37a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207731, "uuid": "a19c9b69-3288-4860-989c-66407e355212", "value": "4edb85bc25603bb33ddfec00d3258176ea15a736b566b01c298269333bf2b445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701fe245-9232-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617203089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203089, "uuid": "e3e162f5-886c-4789-a804-492b7565d980", "comment": "Malware payload (IcedID)", "value": "ea2cf84faefb4b4e7f2fdaf37bd4ba4b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203089, "uuid": "bf117be7-02df-4902-b083-0e95d025184f", "comment": "Malware payload (IcedID)", "value": "4efacad293bc02b401bee554687948370b84becaa6e5ff0eb21af611e77ed38c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203089, "uuid": "b438c41b-6ed9-45d0-9f2b-c5ca8ffdf312", "comment": "Malware payload (IcedID)", "value": "659c7f63d883031d28fd5de5043143f20b42ac7b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203089, "uuid": "8106be17-691f-402d-8fa3-736f0ba4a205", "comment": "Malware payload (IcedID)", "value": "7e51a034199296d3e7a58cab3a0cffe0159fffef7a1ecdae8c57d65c8b217eb5aab892f03d5abfa6d164ff86e8ec8f2d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203089, "uuid": "b75cf1b9-30c1-483c-a704-2423976fe94e", "value": "88B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203089, "uuid": "b5efe5d8-b44c-4978-8f6e-0c7db9fadd7d", "value": "3072:I2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:IqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203089, "uuid": "a2577831-9161-4b0f-aecc-a549cc171093", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203089, "uuid": "7d0fdce7-ccef-4908-9299-b23076a37c30", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203089, "uuid": "d99c17e8-6128-48eb-adab-75c7ef7645d9", "value": "document-181008826.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "616c2aae-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212942, "uuid": "d763bb06-de7c-4836-8e94-8088ee770360", "comment": "Malware payload (Dridex)", "value": "5855f5810b82187adfeed90699922eda", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212942, "uuid": "867e40d3-62f4-4ea0-86bd-74370bdb9be9", "comment": "Malware payload (Dridex)", "value": "4f2f8b683117a216c5f4a2b789c08728f613bc74f2e0eb89d3950a063fc7c536", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212942, "uuid": "4666e314-06ae-4037-a276-e1a08c08bc3e", "comment": "Malware payload (Dridex)", "value": "f952ac961f0a9718cb5bc96cb6f244e7e208d4e9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212942, "uuid": "ab50f899-b54e-478f-b9c2-dc1f4440f53b", "comment": "Malware payload (Dridex)", "value": "033f1f6d9db67cc59d8499fa81f5d9842a6197f19010b72e2535a2ec24432c99c87289bd9c24e6c7a80ca5b4488d9e52", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212942, "uuid": "3d50bf8a-a853-451b-b719-ec2e61ec8a46", "value": "AB248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212942, "uuid": "c3e7882a-d8ad-4c58-aa18-ca66f2170d7d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212942, "uuid": "470a39e9-f058-45b7-8b07-00b34c961b22", "value": "3072:E6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:EoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212942, "uuid": "309aa5ed-f88b-4b5e-a58d-43c6cb8863f1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212942, "uuid": "7b196b75-ae83-4953-ae12-b94da9e3e42a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212942, "uuid": "bc4a891e-4819-4a49-9d48-4fa18b5d52cc", "value": "4f2f8b683117a216c5f4a2b789c08728f613bc74f2e0eb89d3950a063fc7c536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aff18b3-91ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160157, "uuid": "b7e14fce-c2d2-4b7f-8177-13a238e4eefe", "comment": "Malware payload (IcedID)", "value": "7fd8f4d4fb164d956cb2084055ed59ed", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160157, "uuid": "ade41d07-7ed9-417e-8afe-83d4478c3202", "comment": "Malware payload (IcedID)", "value": "4f7188190bf0aac74ac7a9241eab158fd130eb0f668ed50e6bea990452248907", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160157, "uuid": "98bbbb24-00f5-403a-b743-e29dcf4b72ff", "comment": "Malware payload (IcedID)", "value": "b6c0854b369aa6d47f8bcf25a37aae02ab54a2fb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160157, "uuid": "09a5bebd-44ee-4827-8984-0aaa93086ab8", "comment": "Malware payload (IcedID)", "value": "180031d4e0ee444f182870f5a83f490e0f6f9888339eda27f1ca507abf1d5d73ce580dae2748a1b4e1a2fc15cecce1f8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160157, "uuid": "623fae0c-bc97-421a-a969-1b9bbc6439c0", "value": "39B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160157, "uuid": "524d04b7-b715-406e-bdbf-b539cea7c89f", "value": "3072:y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:yzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160157, "uuid": "433f1fe3-4011-48e9-8590-1ca7d54845a7", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160157, "uuid": "2f80121c-3d5a-487e-b77b-adaf8d89d567", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160157, "uuid": "0c48a579-b0f9-4bb8-96d2-1f7fe87391ed", "value": "document-1183755438.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9eee60d-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213198, "uuid": "13030ecb-a31c-44f9-a6f9-cf6a53d490d8", "comment": "Malware payload (Dridex)", "value": "d7691ae8e99e32e19d7cf79c6f861655", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213198, "uuid": "0d9acb51-2e44-46ea-ac8e-9af218f08e2d", "comment": "Malware payload (Dridex)", "value": "4fa7c59c506529b2a44f5100c32d10520cc57de0d5b36d0caddcdd6932320596", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213198, "uuid": "ed1f9aba-6ac9-496d-b63b-c5648e6c4f2e", "comment": "Malware payload (Dridex)", "value": "8930f52cc1f06ed577fb9ce50bd32cf755c2f9fa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213198, "uuid": "3ae9e856-fae4-49c9-b2d5-bdeed48a3de9", "comment": "Malware payload (Dridex)", "value": "7e9f390528ee4e74f1494a039cc540c8b751c7b7b26237358f2b32097799c6c1db196fef10bb3865cfbd175aa3a2a36f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213198, "uuid": "ffbd1ef6-a871-4b81-8192-c9f32aafa6ad", "value": "C5248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213198, "uuid": "325e166e-f81f-43fe-acf4-76776fc117b4", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213198, "uuid": "64eb976b-c36e-4b92-85ec-e16aea5cebf5", "value": "3072:66TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:6oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213198, "uuid": "0786bb94-60ea-4ffb-9d30-289fb2bd98e1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213198, "uuid": "7815668c-b59e-4916-9bc3-cada9098e344", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213198, "uuid": "616b28e7-4e29-4bbf-902c-f390cb67aef9", "value": "4fa7c59c506529b2a44f5100c32d10520cc57de0d5b36d0caddcdd6932320596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f47c42b-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218576, "uuid": "f5bb7114-ff98-4bc0-8f1c-3bb6c8124acd", "comment": "Malware payload (Dridex)", "value": "42f7bd0c98cac8b5b8ed8a1329a889fb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218576, "uuid": "cd48d489-3c40-4616-a768-318fa8b42d05", "comment": "Malware payload (Dridex)", "value": "4fb6bba52ef0593c6cafe261edfca30a7c5cc5909c61076979b145480c064044", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218576, "uuid": "f293abec-a9ef-4eeb-8a76-be341f8629ce", "comment": "Malware payload (Dridex)", "value": "3b8bcc321f343d17f5458948a127be26bf02f468", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218576, "uuid": "07823931-ac3a-4df9-8c9b-dfb04b768c08", "comment": "Malware payload (Dridex)", "value": "7ccf1df189826a766a808ce78912afa397ec1df9b77539b2e1372cc60b97cf7f0076d3569f1ef4a403471f406b976155", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218576, "uuid": "1624e630-0687-4df0-b35a-3c79bccae255", "value": "AC14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218576, "uuid": "cd78494e-37bc-42f7-89fe-f85be88dd191", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218576, "uuid": "3199a2d5-e4a7-4f94-9e6c-1ecce5c7d3a6", "value": "3072:zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:0pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218576, "uuid": "b4e81fcc-e3d9-4735-b015-4de74ba7d88f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218576, "uuid": "5ad7264a-aa9f-419f-9fec-b10d92d9cb6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218576, "uuid": "50195c87-9f95-4418-a565-94dde764ff49", "value": "4fb6bba52ef0593c6cafe261edfca30a7c5cc5909c61076979b145480c064044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c19c5d9-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212934, "uuid": "ba7bd001-9e9b-4f59-b047-51ac585f5182", "comment": "Malware payload (Dridex)", "value": "dc109736244f2ae94ee1e9198e4c3853", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212934, "uuid": "02e98779-0fe3-46fa-ac4d-9bc0bd80457c", "comment": "Malware payload (Dridex)", "value": "4ff25ba56c46f30dfae8208de1c94ed594d407e193add835498cd23131d5106b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212934, "uuid": "ac0dd048-b71f-4644-ab1d-70b211c0f32d", "comment": "Malware payload (Dridex)", "value": "4774679cddc7d79eaceda1671b2169008d1209af", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212934, "uuid": "615f622c-0b38-4c65-8478-c58fe533a4b4", "comment": "Malware payload (Dridex)", "value": "70df82b9e5a463b9e53d4e648d5eebb2b621b7859e572577a8d028bf313ede24622e0ec0340912d637d1e52eec693e65", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212934, "uuid": "ea74ef0d-4873-4a2d-b0a7-c1eb854d495e", "value": "3D248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212934, "uuid": "b26b861d-c0ac-499a-a818-d7adbc2e911d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212934, "uuid": "6ffb0600-56fb-4cbb-a0af-57c7d251c093", "value": "3072:w6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:woMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212934, "uuid": "10fb3784-d594-4273-9d24-bd1a114a8f40", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212934, "uuid": "dc3745be-bed7-41d5-bc97-bfe9e9b7c2d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212934, "uuid": "ed823fe6-2b43-434d-b56a-e2a36f8c1829", "value": "4ff25ba56c46f30dfae8208de1c94ed594d407e193add835498cd23131d5106b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0090a3e3-91f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617176273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176273, "uuid": "fad9445b-aa9a-4af2-8255-8986c9a3d9ff", "comment": "Malware payload (Loki)", "value": "fc8a3cfe189d3f34be4a393f7286be78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176273, "uuid": "f1bd7209-b88a-4e15-afba-6f8542080f2b", "comment": "Malware payload (Loki)", "value": "501d4cf13f1e91b23dbc5b82ce88e655e14180097c685968d0de26608d973455", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176273, "uuid": "28ba7aed-47ea-4c69-b2ec-8b330305e3c8", "comment": "Malware payload (Loki)", "value": "996cfb58708a69659c7f6be00cb10bbe01e2a673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176273, "uuid": "30f169f5-fc8c-4b94-b385-8f00b51ddd96", "comment": "Malware payload (Loki)", "value": "909fd0a96fa83426e1daf3bfed30dbae7b4564f9a6385cac3795d230248faa3ff6bca43a501fd518dd63474ff642ec66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176273, "uuid": "618f4749-f754-4617-bfe6-a6ea5028ddd6", "value": "DBF493AC30AE609DDEB5A630F5B45D925FC428321F12FF3B249326446C6B766FE4E460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176273, "uuid": "58850e15-7165-4f1e-8f89-21fc25aaf7e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176273, "uuid": "e52a37c8-2826-49c6-bc9f-79b8ea03db90", "value": "12288:Bdhty9QxrQ1elqcUFpkAj7AIbllalsX39wNfPVqSEeQki://y9EaelqcUDj7Vblla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617176273, "uuid": "27c97562-9c6b-4a5e-80bb-4b46f8418913", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617176273, "uuid": "725dd2e0-8c02-46dc-b3ce-fb90b292f5c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176273, "uuid": "696330c7-181d-4051-954d-2f641d961781", "value": "fc8a3cfe189d3f34be4a393f7286be78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9268a28-91d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161953, "uuid": "f70cfc56-3853-4633-af2e-d5b2642d595a", "comment": "Malware payload (IcedID)", "value": "bd4d7c6815f273e20c8d0d7a7b5de9d9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161953, "uuid": "248af09b-d2ff-40f7-8fe4-62aa483f377d", "comment": "Malware payload (IcedID)", "value": "503948207e2cdc591087646f92dae1bac08ba6f8d4f7116185f353299ff77b16", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161953, "uuid": "85d918d3-7aa3-4720-a0c6-46997e71f930", "comment": "Malware payload (IcedID)", "value": "9218e208952b1fb0da03d010b1fbaf9b4432d1bf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161953, "uuid": "b8e62d7a-45ad-46cb-bfaf-35d50709604d", "comment": "Malware payload (IcedID)", "value": "00bf34b669b96cd5d836aeabdfc053abdcb70a89ad06b31296987f38877b5c78d83b16fe9d87bd07f7de4820acc8b41c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161953, "uuid": "6de9b719-45ed-44f9-9cff-13fbef690cb0", "value": "B6B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161953, "uuid": "08791148-449f-4c0f-9d45-31a7ae696cc2", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161953, "uuid": "5529f25a-85f6-4d4e-a8c8-87c65d924486", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161953, "uuid": "ae674938-365e-40df-b0a6-cde2a7a6bfbe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161953, "uuid": "a8629f0b-2e80-4315-a6fc-a26254f6d30b", "value": "document-1621204455.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e08cfdc-926c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617227969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227969, "uuid": "f16ffc17-a109-4c24-b795-00383d1c3f56", "comment": "Malware payload", "value": "cc13fd8480fd9f0990f89dc1063cba27", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227969, "uuid": "41774b7c-9112-4b3a-84e0-afed5578f82d", "comment": "Malware payload", "value": "5062d66447b48fe6695992b46978c16a1bdc44324fc647b42e6a0575637dc1de", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227969, "uuid": "dec1076f-bbb4-469b-bba3-51cc6c2b28a3", "comment": "Malware payload", "value": "9d8096d99314340ff42f898ffbd2a5f48e5c03c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227969, "uuid": "232c0974-a098-4014-8af3-53009e304f97", "comment": "Malware payload", "value": "f081aa89b8208c734a9fc37545567819bd84a7139e21af1127dbfc35ec1bb77ad1e38a087555e7a6bbacce53b244a200", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227969, "uuid": "c44a6fc1-6df2-4644-99cf-baf54bf6768f", "value": "F4248C5FE339E486FAE3CAF44186A72296A39C92476F680DA0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227969, "uuid": "e6b6eb6a-c11e-4a15-b5ca-beea656fb219", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227969, "uuid": "377a3768-81f3-40ca-9fba-10b198216c06", "value": "3072:H6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:HoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617227969, "uuid": "5161f12a-84b2-43e9-baf8-1a525c3663aa", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617227969, "uuid": "344bde6c-3237-4602-891e-adbef3dc6646", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227969, "uuid": "cd92cc9b-d9ed-493a-ae0f-6aff472eed62", "value": "5062d66447b48fe6695992b46978c16a1bdc44324fc647b42e6a0575637dc1de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bbfc9e-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218748, "uuid": "7b393cd3-262a-4a3c-a0a2-693c61b818aa", "comment": "Malware payload (Dridex)", "value": "0b0ff6f3a87165c2d0910a20e96e35cb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218748, "uuid": "35e78f0d-f6d9-4c54-911f-a0b6b99cb34f", "comment": "Malware payload (Dridex)", "value": "50e648f6445d14c0afd0ea8d05293c8a9a0e5320b7d9e34d10905621af802087", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218748, "uuid": "06f62209-89f5-4820-a4eb-8fa590795777", "comment": "Malware payload (Dridex)", "value": "9ecdf32c18e284b7ffca45d76f1098654199fe5a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218748, "uuid": "611d6a1d-81e8-4de5-a8f5-145081003209", "comment": "Malware payload (Dridex)", "value": "b8a1e40fa5d27abc9683cedff19861215f5422f1a428d96d777ad316d4815d6f4f21ead05b807b16b2742dd68ddd35b9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218748, "uuid": "c66d4ed4-2a1f-4521-97b0-d163817c8bf0", "value": "DD14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218748, "uuid": "a03a7c6c-99c0-4725-853c-6ae8c7db3af3", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218748, "uuid": "059ce40d-9f26-450a-a969-a5271eff3a63", "value": "3072:ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:8pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218748, "uuid": "d5bd73b3-c62e-4282-a999-a27040944c4a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218748, "uuid": "c05a0447-b18e-4229-aa34-bd8ad790af1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218748, "uuid": "17d76703-d59f-42b6-a838-1765b34bc146", "value": "50e648f6445d14c0afd0ea8d05293c8a9a0e5320b7d9e34d10905621af802087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd049f2-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232182, "uuid": "0011daac-66e2-4098-a449-75e861485d6e", "comment": "Malware payload", "value": "d5a44f1d709e4333f45693f0cc8f8701", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232182, "uuid": "02f479f0-9a44-4da8-b4db-541f95ca0b56", "comment": "Malware payload", "value": "512863c004e53214989d876838ed02cfae13ecf6c5a7afd56a27d3964854fe94", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232182, "uuid": "41c4fb50-5788-4863-bc56-3a531f31cc22", "comment": "Malware payload", "value": "c4647867f9cf833c7eaa1ee30a7e56ed37358c12", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232182, "uuid": "4adddcb1-20ee-410c-8a2a-2e4b02562e06", "comment": "Malware payload", "value": "bd2f653eba5ea82a3dfcf0dae23cf8a664f648543c077cffea6fa1d421939e51f190c33d84c6e875c844456142783399", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232182, "uuid": "8cd497d6-8565-4847-8f9a-46598e1c83f9", "value": "B514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232182, "uuid": "3410e0e3-cbd7-4e5c-98f6-ff0eb613f52b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232182, "uuid": "8e1cc514-6a49-4396-afe9-88640f9b3e8f", "value": "3072:Zopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:epjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232182, "uuid": "22606d92-af65-4fb9-b407-4608105cd8f0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232182, "uuid": "cdf4a1c5-1268-471b-8c69-9af04dddf933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232182, "uuid": "8203821b-caf4-4744-8dc9-76bd878bf21a", "value": "512863c004e53214989d876838ed02cfae13ecf6c5a7afd56a27d3964854fe94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b82c9c7-91f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617178465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178465, "uuid": "183183f0-51af-49b6-8c45-030b9011e327", "comment": "Malware payload (Formbook)", "value": "f90ce8bbfb66823a9d2005164f05a2eb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178465, "uuid": "07697d44-cbe7-4828-b6fb-59d7fc3e75c8", "comment": "Malware payload (Formbook)", "value": "512bc5ca2e6103f2cb06df5287087ab881725db829de761cac9d011fe6df0003", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178465, "uuid": "48a23be4-2033-437f-b156-3ed7227e3a59", "comment": "Malware payload (Formbook)", "value": "895d3de847b91837efc42a0a83caad5632ca215f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617178465, "uuid": "0b334385-e412-4d9f-b993-033d24328d0b", "comment": "Malware payload (Formbook)", "value": "9f039d63e35684405366f5e1cc18eaf9aeac9c8c50ebd907427e6a5d30e05eee89fba868ff9140982ad1abfcc54e3c97", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178465, "uuid": "6146f55f-5268-4ac1-aa42-70d387f21808", "value": "5BF4DF293206FEC7E53A84F444C95742F2FB47D5920BE9B9BCA0929152C36C3BBD16C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178465, "uuid": "2f1d5070-8dfb-45bc-8e7c-a48e443c2d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178465, "uuid": "e6efbb86-d03f-42a7-a853-6d03f2335755", "value": "12288:AD/2wYIhkrSIACFJUSMB1A/j35n0nh4gYILoq473+ALzsbTyS3dHudzanq8:cBhEStCFJpw1ANnEh4gt473fsKS3dQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617178465, "uuid": "94843e0a-be86-42b3-92cd-dd18d8b27601", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617178465, "uuid": "a85cafbf-c1c4-4a7a-90a5-694d7db09263", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617178465, "uuid": "c4d7d76d-1cb5-4b27-9f8a-372439e8ce73", "value": "list.dwg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d51779f-91d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617164295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164295, "uuid": "4a857ec5-b163-48bb-9797-7fe18e7c1130", "comment": "Malware payload (IcedID)", "value": "4703c312e13b43f82eaac295865951b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164295, "uuid": "2c78c292-2e63-466f-919c-d979875b22b6", "comment": "Malware payload (IcedID)", "value": "5134cf2c97c0f81bc0ddf79d73c67363476dc74ea1940b0cc1c025b16ab78b20", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164295, "uuid": "dec1af26-8b41-4adc-98dd-3eed4864a1ba", "comment": "Malware payload (IcedID)", "value": "9e8c942a41a106b3c1c095344355c1c2679bef6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164295, "uuid": "688d0efa-5c37-4ceb-b1be-8a0e012c3717", "comment": "Malware payload (IcedID)", "value": "b1267070a5070aa7bac1d2c9bf16c5dc231484c88e53381703f9683c6bb46c159db3f32c4bea88cae40d725b5d20e970", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164295, "uuid": "83aa70a7-2760-4ec8-baaa-dd403395a2de", "value": "3C635DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164295, "uuid": "b2207c11-1fae-4eab-bd9b-a4db3fb56158", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617164295, "uuid": "a9cc6c0d-0559-4724-aebe-2b1c9804a209", "value": 66748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617164295, "uuid": "683a04d8-b999-4c04-90e9-c48431a67ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164295, "uuid": "8b2a0c69-1899-4109-863a-79736e287ef8", "value": "4703c312e13b43f82eaac295865951b9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d67951-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212983, "uuid": "6fc4ef85-cc8a-46e6-8595-22143080a91d", "comment": "Malware payload (Dridex)", "value": "fa61ee73e09c0ccd862391c7518a00a0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212983, "uuid": "8815f68c-6b8c-4819-82a6-4f502c5c2231", "comment": "Malware payload (Dridex)", "value": "519b30b268c87bd601c286fc4fbd7c914cb9c5a739159ac28e7c5725ea833447", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212983, "uuid": "6cdf40b2-c17d-4b20-98ea-05fe2509f664", "comment": "Malware payload (Dridex)", "value": "3bebd0ea71fd0779e4ad5a40f2f6de14ad6dc134", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212983, "uuid": "6d1a333d-20eb-4c53-8661-e75ff56c9226", "comment": "Malware payload (Dridex)", "value": "f891ec5781bc43ac9f997737d09bc7c4dd09eae1a0155ad1c2a8b1f4a34eca7a040ce8f2a4aca3a408617859ad8f22a3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212983, "uuid": "231bc813-7edb-41e3-bced-29b31dbb85fd", "value": "ED248C5FE339E486FEE3CAF44186A72296A39C92436F580DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212983, "uuid": "440066a5-dcd4-412b-9cde-6446ca3f4f97", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212983, "uuid": "44980608-8040-4731-886a-9a0da068b642", "value": "3072:06TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:0oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212983, "uuid": "d2f39358-aeb5-48ee-8bc9-32894f283dcd", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212983, "uuid": "7c9853c4-3538-4e5b-80fd-f872872c61cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212983, "uuid": "fcd19afb-9aee-4da6-b784-06666674fbc8", "value": "519b30b268c87bd601c286fc4fbd7c914cb9c5a739159ac28e7c5725ea833447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e13ed9-91d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162544, "uuid": "7e574b14-7046-481f-97e4-1f0a0e16579f", "comment": "Malware payload (IcedID)", "value": "cc1f60aa486125b35325f60bbafc9932", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162544, "uuid": "b0a82f80-51bd-43c4-b650-4a2bffb8fc36", "comment": "Malware payload (IcedID)", "value": "51a06d1114ea69b775a7253904724a17929c7fbb6c220d072535ef20253de9eb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162544, "uuid": "a1a30df6-39c6-42d7-b169-4ee955aff594", "comment": "Malware payload (IcedID)", "value": "9a6e99f69dbe5be29854d1e9b78e51084d68c962", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162544, "uuid": "7e77d57e-2334-4e99-9856-f1be210ee723", "comment": "Malware payload (IcedID)", "value": "704b7d902f334b77d5dbfa1d5bc6d7d50227775b25d9ce81f8cc1bc3e62e84b23685993aa271ad77e0090aa24046c743", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162544, "uuid": "b781a958-5768-4ed5-823d-28a6c7805525", "value": "B7B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162544, "uuid": "3b56863c-7b98-4366-89db-4feea7d001ea", "value": "3072:O2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:OzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162544, "uuid": "99ad7868-0963-4d6e-b62c-03cdae804b80", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162544, "uuid": "0c2d18b7-cc6c-4784-9892-22269c669ce7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162544, "uuid": "be05c86b-3cc3-4139-870a-96bd7f164ec8", "value": "document-977658617.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10850b83-9259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219679, "uuid": "29089272-6c0f-4ec0-a477-3c28c68c179c", "comment": "Malware payload (Dridex)", "value": "a5bc03da2d7a7df9204b59cf1b1683a8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219679, "uuid": "26afb5f7-c3d4-407d-ae6d-03876a174554", "comment": "Malware payload (Dridex)", "value": "51ac5fe95e0cb62f76a6091ffe4bdae5a1a6c4f5045b73403fc193df2d8ee156", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219679, "uuid": "8a4b7b48-1219-43d1-82d2-cb70e491e1c1", "comment": "Malware payload (Dridex)", "value": "37b5f8400ea554b8c3e37ea0aef92a6203870a83", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219679, "uuid": "f761f10d-307e-4a26-ba40-6958b1462071", "comment": "Malware payload (Dridex)", "value": "a5716687003e856a79a09928d68b2d1040b18eea9e0d6e010d47ebe93f66fea7bcfe9065b736bb6f8c1a13250254d5e4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219679, "uuid": "8dc3a0a1-a760-4385-acdc-0d478d21b969", "value": "B514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219679, "uuid": "a3e5a41b-b064-4c72-9e20-e74c96ba54f8", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219679, "uuid": "e791fcdb-99c2-4f26-88ae-5e87c2bf4bb7", "value": "3072:Uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:LpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219679, "uuid": "d0f72987-30fa-4b25-b467-48b483365eac", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219679, "uuid": "d209f8fc-b966-4c69-b821-9dfbd0e85228", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219679, "uuid": "4fee490d-4af9-4787-b76d-50f61cd827ef", "value": "51ac5fe95e0cb62f76a6091ffe4bdae5a1a6c4f5045b73403fc193df2d8ee156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aa100a-9235-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204361, "uuid": "2e5fd3c3-32cf-41aa-a7ac-17a506074b27", "comment": "Malware payload (IcedID)", "value": "ac9091791b551d859a27edd065e6aac6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204361, "uuid": "178343b9-d8cd-4d19-b0c5-4d325b8ac6bd", "comment": "Malware payload (IcedID)", "value": "51aeee5fbea03773fd957849c0be03baf8fd498e50e8ff272b3471bafe241e38", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204361, "uuid": "27b3eaf1-1f28-47cb-b972-5301db208ee6", "comment": "Malware payload (IcedID)", "value": "9dff865f61a74a51ca0e1874fd3d08c3a557e363", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204361, "uuid": "2707e1b1-debd-4514-aeda-8fc12c2963cc", "comment": "Malware payload (IcedID)", "value": "258917447b944205989149eb0a9ea827c1f6924351447d526d250176feecf70516ccfd98c04df601bf250d16d3550615", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204361, "uuid": "da4b3440-7f49-4c65-b951-3ab3e3410cc4", "value": "D4B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204361, "uuid": "d63953ae-0418-4403-b70c-87f67aca8b30", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204361, "uuid": "1b668070-e839-4a32-9d0e-361686efcbc1", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204361, "uuid": "b5b0dfc5-605a-435c-8df4-37344fa11c2e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204361, "uuid": "46305b38-a439-4701-882a-427b50e71bc1", "value": "document-13448665.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc25a37-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617173929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173929, "uuid": "cb50283e-f0a1-4766-9bd1-47aed8bc7cfd", "comment": "Malware payload (AgentTesla)", "value": "769de2e932309dc78b20e4b78bca206c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173929, "uuid": "d3960e21-3b98-45f1-ba86-2a1d9e9fca3e", "comment": "Malware payload (AgentTesla)", "value": "51d068920ee714c25ce8b122798f7492ca0d0fc4ef196040a1443aa392a1e88e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173929, "uuid": "be1d4061-543a-4e03-a9f0-2da449e1f12c", "comment": "Malware payload (AgentTesla)", "value": "3ee0cb340ae116d4be36b20c6c5a865a5274f575", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173929, "uuid": "93c51c20-c868-43a9-a571-9d8d634fe657", "comment": "Malware payload (AgentTesla)", "value": "2ffa6090219cce37d2a459a45c4cac0971be5e223bb4b3e84eeb37f7f41e3cfc5c51fd45567a0cbc2e9f476f5f8b0409", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173929, "uuid": "dc71b447-0ec6-460b-b8fd-7835fbaa9219", "value": "1F54024E61E2440BF0329E701796FE27E6955F0C4A327F4B23800BA9B8D4956BB2F5D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173929, "uuid": "28dd30ae-6a06-45d8-a521-22d1951892ac", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173929, "uuid": "c2e27e4d-cf3b-43ac-8fd4-4e8a0679045a", "value": "6144:dAPUlMPnBbsnI1AEHOlQ4xLB6R+I+wtsCo5vdEb1EX1z2:DlMPBbgI1qlDL6I9bvCBEl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173929, "uuid": "cf59daf6-73ae-4e76-8d40-43465b8c6ed7", "value": 305836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173929, "uuid": "3ed236ff-4d37-4bef-9f3c-07d115e33ec9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173929, "uuid": "3b430e57-a6f9-45e5-8d29-e793bfb9a8cb", "value": "Isaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf9303a-923c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617207486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207486, "uuid": "74673820-ed6e-4f67-801c-444d4749073f", "comment": "Malware payload (IcedID)", "value": "b33d1b7fda3af5ca6bfd492496e1b9ac", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207486, "uuid": "03fd280a-4610-44a4-87c0-dced62101574", "comment": "Malware payload (IcedID)", "value": "51d15d204f92de944b9656ecdf5c3961db5f118ddd6777d9474b909b8be66044", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207486, "uuid": "a039b35f-a17e-4dd6-8ad2-0014e54e8876", "comment": "Malware payload (IcedID)", "value": "ea67a63da10785db03b812fe64a5df4971054948", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207486, "uuid": "c8771e01-56d2-4625-a2c0-31894631a43d", "comment": "Malware payload (IcedID)", "value": "7398f40c1547856a2c9f6e5a75734138b081286cb0ba6469e4f01246cac45b0ce1d24a9f7b8489f2fee1307fbb72b95a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207486, "uuid": "ac039710-7283-479a-9697-bcfec1a0b1c3", "value": "FBB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207486, "uuid": "770b830d-35b7-4512-a252-d806e5c026c9", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207486, "uuid": "79cb68db-a35d-4681-bc64-b0af01e0e29e", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207486, "uuid": "15483f52-07bc-4561-9ad0-b1d2f670414a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207486, "uuid": "1e860a6e-e70b-4436-b150-a2e676852f47", "value": "document-1292805689.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176028aa-923f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617208523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "f68817db-0532-468e-ba7e-3a502b861c2c", "comment": "Malware payload (Dridex)", "value": "0a93401ba77815b37c6301abdd7dc528", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "2b66c345-b43a-4095-b5c5-4b706b5869fb", "comment": "Malware payload (Dridex)", "value": "51fc19f8dd98ece514232b2db2f5fa918f279ec2209597d0c9a6f95ea9311663", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "44b51906-52c8-4df9-a2bf-530a4cf9d7e2", "comment": "Malware payload (Dridex)", "value": "23c162713424774e2c90a4468a12197c20df14b3", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "622eb22b-2762-49b5-8dad-b94886f2b2a6", "comment": "Malware payload (Dridex)", "value": "7069ab84ef1cdc42d6e44ddef7c2b63a2f1914ca8f8fc9740e872cd63a698673a897b6255834aab4486c8f36cb54357b", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "04842d42-425b-4c6a-971f-83edf78ecec9", "value": "3184E003A7D54032EB731F34087397124BEFB9954A748DAAA69D211D1F773D08638BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "83077a1e-9b99-47fd-a254-c7d2dc3573d7", "value": "02e581d639f814ba43d9c6c8be6f316e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "3323348b-eadb-46bd-b589-2377600f4c38", "value": "6144:m6vYH/guLTgMb1oFtIaJmGDtDplcJqiD4IU2fQ/TxHu+trHayYm:m6vYouLTgM5oFt/hRDfkL1U2Y/TxO+tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617208523, "uuid": "000b0ab4-6172-47f3-8eb5-224e6c9aeb0a", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617208523, "uuid": "825cd7c0-dba2-412d-ad51-96ba846f97a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "bc5e6fe5-3144-451f-9571-7455bed7fa74", "value": "51fc19f8dd98ece514232b2db2f5fa918f279ec2209597d0c9a6f95ea9311663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c99e488-91c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157019, "uuid": "6e3020ce-cac5-4459-b2bf-b49504d58f72", "comment": "Malware payload (IcedID)", "value": "1909f8e98018d4dd29bd9ae984572b6a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157019, "uuid": "5e84a7d2-a6cf-434d-b0af-999b8647bff8", "comment": "Malware payload (IcedID)", "value": "523f6c0cec7cf1c74e96f247d66020893c172cd43a164995e8b6a965fee192d2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157019, "uuid": "95ff8398-e392-42a6-89a9-2ec74db3bfea", "comment": "Malware payload (IcedID)", "value": "9d3c9fe76590ca9e0a49868000f9bc5025097acb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157019, "uuid": "f4e089c6-ddaa-4561-b287-661aa699104f", "comment": "Malware payload (IcedID)", "value": "62aedd409f47d469f6022d2725fd6bb9c8b30898329b0f69ea7b26252018a0a34f3ef6a6b18e09ad88c01f258c80feb1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157019, "uuid": "659d1870-fafb-4b18-9ed4-797fef508f2a", "value": "EDB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157019, "uuid": "96673e7e-468a-4fd6-9002-6a25b7260826", "value": "3072:e2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ezxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157019, "uuid": "c8a8b916-458f-4bc3-93d9-60ec7d01f124", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157019, "uuid": "f2c3078a-6e86-4f3d-94b2-a6f317f4efc5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157019, "uuid": "c8511ad2-fbe6-4df0-a8b8-6e690177c514", "value": "document-841510219.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea712e51-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217038, "uuid": "f3a9d1cd-e851-4ec3-b381-b53c91bb8071", "comment": "Malware payload (Dridex)", "value": "2d616fcdeec922f9d13acdf7e1e7a196", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217038, "uuid": "3a2f0c5b-fd56-4f00-a86f-dd1b3740d54d", "comment": "Malware payload (Dridex)", "value": "5248fbaaf87274dfb70142a7545db2c7a37379f8ec15031f367edd28c84ba93c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217038, "uuid": "06b1ebe2-789f-4ed1-9b4e-afd144740d23", "comment": "Malware payload (Dridex)", "value": "68effa4dcf6b15920fc4e368e0a16d5081caa62a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217038, "uuid": "54d72697-4ab1-441c-b8d6-f6028737a8c9", "comment": "Malware payload (Dridex)", "value": "807241d4b94b7195bcc49cb224087c3b6f58dd0a40ec534a8006435fce790214df79fc2c9651381db085b5274c31a758", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217038, "uuid": "f266328a-4758-40a5-82db-eb4fdd201810", "value": "1714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217038, "uuid": "2f852b22-dc7d-4966-bbac-783985efcc09", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217038, "uuid": "cb222fbf-b0d1-4f8c-b949-dae2d4c098d2", "value": "3072:/opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:QpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217038, "uuid": "32e97504-70e0-4a10-861a-5cb394b37734", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217038, "uuid": "ebf3a07d-e97e-420e-a263-dd72b561a9d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217038, "uuid": "d91bb149-f32e-4ee0-b724-bb3dcf3f7bd6", "value": "5248fbaaf87274dfb70142a7545db2c7a37379f8ec15031f367edd28c84ba93c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1773a9d6-923f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617208523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "a3dfa72c-6a85-4af8-b609-196183ed8453", "comment": "Malware payload (Dridex)", "value": "d832d70f78937799ed08056442f04442", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "80a0f6b3-4507-472b-a05f-cf8445cb5125", "comment": "Malware payload (Dridex)", "value": "52545ce7c36e648bc9d8e78cde413a0d2b7e45dc4084b28646191f73fe8a010f", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "3af1acc2-e61a-43ec-b97f-1658647ebaca", "comment": "Malware payload (Dridex)", "value": "29d48c7fa4aaa0ff0fe3ed3e10ba5c23cf7f4d80", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "e4d442ad-80ec-49bf-b52c-4e7b6cc29234", "comment": "Malware payload (Dridex)", "value": "e7871ac2439cb0b29013636d5e9a2a24fb961dade7e86ffe6d34d025982661d575828ae953dc23fb77d5ea0b00b93f23", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "8b25e613-13a3-4630-84d4-141fd60d9cf0", "value": "7F84E003A7D54032FB731F34087397124BEFB9954A748DAAA69D211D1F673D08638BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "ca085e65-eab5-4a5a-9586-9dc0262fee67", "value": "02e581d639f814ba43d9c6c8be6f316e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "b872b004-6e27-488b-8933-baa95a0eab3f", "value": "6144:I6vYH/guLTgcb1oFtIaJmGDtDplcJqiD4IU2fQ/TxHNDtrHayYm:I6vYouLTgc5oFt/hRDfkL1U2Y/TxtDtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617208523, "uuid": "e7b6952f-52aa-412e-bba5-bcb3ed15d1ab", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617208523, "uuid": "14bc962c-3686-4b7d-ac55-371e8d380b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "71b1fc9a-6b35-457f-b2f0-7e62ae006370", "value": "52545ce7c36e648bc9d8e78cde413a0d2b7e45dc4084b28646191f73fe8a010f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1909a661-91d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617164288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164288, "uuid": "00baead2-3d41-4153-a12e-9094aaacd57c", "comment": "Malware payload (IcedID)", "value": "7cd5ad4a7d639033c3c2932a9871fea2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164288, "uuid": "d97b3e82-823b-4e25-8c59-fa69f4101525", "comment": "Malware payload (IcedID)", "value": "52a51cf9cf84c97e88591337112460f625160e33a62750a7342304284d465cdb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164288, "uuid": "5958ba4e-c6fa-49b5-a504-3c6517eadcc7", "comment": "Malware payload (IcedID)", "value": "d08895493daaf7657b8701da1c24ec749be65baf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164288, "uuid": "9e995bb5-c114-49d3-8813-88dda099e70d", "comment": "Malware payload (IcedID)", "value": "a7a4f93966c6660ba7d31ae2a983f6838e8612492278c8bb00b90edd6c7ac2e5ca42d82f7609dda8218015dd3cde55f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164288, "uuid": "9bc14367-f2f8-4bf4-93a8-4a1b1e15109e", "value": "C7735DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164288, "uuid": "25617b4f-134b-46e1-819a-ffb9269d121b", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617164288, "uuid": "8f89e1a4-267a-4c73-8d8e-bb618180c5d6", "value": 80122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617164288, "uuid": "35caee5e-f71e-43bb-a503-ac93c31455fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164288, "uuid": "8278e5ac-0e18-4f9e-a8ec-0584a51513b9", "value": "7cd5ad4a7d639033c3c2932a9871fea2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501cdd27-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617218067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218067, "uuid": "6fc05f1e-b1db-4a93-a988-1e9c52921644", "comment": "Malware payload", "value": "5d3d7e5181163ced80a34dd619a3f1c9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218067, "uuid": "bb03c504-7331-4e1a-835d-26e074d51e7e", "comment": "Malware payload", "value": "52a8803fc9b58978f419bccf29b17df1107145d1670b426b99d5b60c70f6c43e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218067, "uuid": "f6efcb1d-31f5-471d-a56e-855b13d9d82e", "comment": "Malware payload", "value": "3b839f5885babf4e2d4399907ae76dc06a540c4a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218067, "uuid": "227dc067-a3c6-48e8-92e0-e9cdfddfd8df", "comment": "Malware payload", "value": "06e4cd6c2ef3a40d26a98519d4bbe35729d516d3bd12820b4d45a279e2935cc3318db5dea0845b01bacfa90b9f5370b5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218067, "uuid": "7fd2765d-02ff-4da0-8c54-47c440caf13b", "value": "7814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218067, "uuid": "97585f63-ccfa-4cee-86f4-25a3d8a458d6", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218067, "uuid": "c2341d4a-1967-420b-8b5e-d45f593174e3", "value": "3072:3opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:4pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218067, "uuid": "35d6dc01-900f-4804-92bc-1493cbb4cf04", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218067, "uuid": "574312b8-eb9d-473b-aad1-be08646c4e01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218067, "uuid": "66315be1-bbee-451c-8e94-f9143eafcb6d", "value": "52a8803fc9b58978f419bccf29b17df1107145d1670b426b99d5b60c70f6c43e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b15327-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222956, "uuid": "23d13267-b79c-4163-ba60-0d963923683b", "comment": "Malware payload (Dridex)", "value": "e6022e23dce089335205eb825d64776f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222956, "uuid": "308ca1e6-a1fb-4264-9015-4e70b42d853c", "comment": "Malware payload (Dridex)", "value": "5314b3b87c6af511435214ef255debdb0fc88e087f40992cde6d300faf545790", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222956, "uuid": "68901aa6-5863-48b2-945f-9723c55c9c6a", "comment": "Malware payload (Dridex)", "value": "0b8226a5e6bf2c33ba65cf395b7617e49d39994f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222956, "uuid": "3eedd072-e4af-4d70-9823-7752368e1a25", "comment": "Malware payload (Dridex)", "value": "8ba2d6a7b5be35d8939295e686b2aa0bc2e257385102d7dfdc7a1d4f2ff289f7f8a71874292a9cda69d2c1f145eca8e2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222956, "uuid": "7c697970-024f-4cca-943b-84bfd17c71ca", "value": "62248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222956, "uuid": "e054751d-fcd5-4f4f-888b-d1065ce61bfa", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222956, "uuid": "a1b9bba3-5e85-427c-a388-0782616886c4", "value": "3072:H6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:HoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222956, "uuid": "ac3c793e-44d5-4810-806a-cd98010c4b61", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222956, "uuid": "fbc3ef0f-46e0-4a72-a8ad-e2e908756d94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222956, "uuid": "d4ef9db0-579d-4487-a196-5c1d6972e16f", "value": "5314b3b87c6af511435214ef255debdb0fc88e087f40992cde6d300faf545790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ecea72-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230855, "uuid": "35ff1f09-bcb8-45ed-afc8-a86300b73419", "comment": "Malware payload", "value": "45907b177c287df876785b99cff05093", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230855, "uuid": "0a6d08f3-2cda-4b39-9ce9-461ca386df81", "comment": "Malware payload", "value": "535fe9e7dfd3de6509c1423f03c927fd68f8e2eab856c264194868d756b5fcd1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230855, "uuid": "0a6ec607-5f31-4bec-92f2-cfe5f63d228a", "comment": "Malware payload", "value": "ac6fcc831031133500905ebdd1ac39e5f500dfb3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230855, "uuid": "db543bfc-9d6c-4372-b55f-8aa10188137a", "comment": "Malware payload", "value": "3f954743b4aa300ccfaa7b9df45ddf451dcebdb614b237afcb6af76529c72d103e0c2c2c1a0c73de7315fe6c0b3bba4e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230855, "uuid": "258e9043-fa2f-42ce-a016-01ffce8c2381", "value": "78248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230855, "uuid": "d5c4cab3-2451-4750-85dd-056f3f1d97b6", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230855, "uuid": "7def6df5-06ae-4398-a640-c97ff2f29342", "value": "3072:Y6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:YoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230855, "uuid": "b2d438ef-d1c8-4c18-9236-26f3ecbca506", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230855, "uuid": "74efe91c-0b7d-4922-bc2d-2c410ea4c581", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230855, "uuid": "2cde5588-e5bb-48cc-b15e-f5a05fae81c5", "value": "535fe9e7dfd3de6509c1423f03c927fd68f8e2eab856c264194868d756b5fcd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b19cfc1-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202114, "uuid": "b6725235-7295-49ea-b420-55d6e5008438", "comment": "Malware payload (IcedID)", "value": "14a0b48a207a57e19913cfcbff9e4e26", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202114, "uuid": "4d3aeee2-bedb-4c38-9008-499606a64509", "comment": "Malware payload (IcedID)", "value": "53b3e2282bc83e0b5fe60e544e88315fab96cac81f2f7771c12914a87142beeb", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202114, "uuid": "3fb3afa6-f496-4d8f-b45d-a6caf9a2a5b9", "comment": "Malware payload (IcedID)", "value": "4fcac8ef351fa554e244ff0474617f906b35a669", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202114, "uuid": "10397b2e-c90c-442f-b191-153840a603ab", "comment": "Malware payload (IcedID)", "value": "c3c1c294f40794178e446dc8e925637bf798b4043c29fcc7e160ba8193dfd99a1ea51f06a02e7e23bb949ec5b3d75e97", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202114, "uuid": "e459f2d5-75f8-41f5-a636-e66dd9cfed55", "value": "68B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202114, "uuid": "0c8afee5-a8fe-4665-bda1-7cff5dd9a3a8", "value": "3072:42S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:4qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202114, "uuid": "bb1d29a0-65b7-4052-9bd2-6c9bebf7f26b", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202114, "uuid": "203fdbc0-4598-4628-b5dc-88da7bd522c9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202114, "uuid": "6f31eb1c-0ecf-4675-85b1-61f7d90b0ab6", "value": "document-801229445.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1cd45c-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200052, "uuid": "a36e0436-e3bf-4071-a8cf-5417fa73ba05", "comment": "Malware payload", "value": "6473266a437c7b384169bfff3a974888", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200052, "uuid": "f5e32030-f7e1-467d-ae49-7a365035d226", "comment": "Malware payload", "value": "53e9bdc7fbe8eb5a5cb61a7290acccf557b15a00ee34406f3df93d7cbe61e442", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200052, "uuid": "92d2becb-b54d-4f6a-a79a-ac1016e78e75", "comment": "Malware payload", "value": "4dc4b56c8e29afb76742b6ebeb748cbacba33644", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200052, "uuid": "a5d64c12-92f3-4b49-9fe8-aff0bad33b89", "comment": "Malware payload", "value": "d7e1fb2372437fab4ae6866e58e587ff4b5759ba826b52c80a9ea2b919a2c862c58af1880d9733ce0db43152eea99c83", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200052, "uuid": "dbe1dd1f-f7b0-4f41-a47f-58b90ae14e9c", "value": "6BA2C7A1F9333C1B0C72116F794660E9F5B74122822078D1BF8E919E5B7588872EF5DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200052, "uuid": "95dbd222-4074-4249-bf36-ff73d9efe00b", "value": "384:iMLIImxHVhFxazdqYeQHQWVgfQRrWkDPSzt7Q/FcVJ3D0uMQV/G2qlNU:bLnmxHfFQgdWVgQRrWaPc7mFc3D0uRGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200052, "uuid": "01cf9a11-0fbb-45bb-9816-93c755b0d79f", "value": 21717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200052, "uuid": "fd08ac57-aff8-4ff0-b4a1-d71fc836cc21", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200052, "uuid": "6a93cb33-7eaf-4431-8649-bf566becd4ed", "value": "53e9bdc7fbe8eb5a5cb61a7290acccf557b15a00ee34406f3df93d7cbe61e442.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f0a758-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218341, "uuid": "0feeadf5-7487-4da0-aae4-188cd242020e", "comment": "Malware payload (Dridex)", "value": "f177c26f093dd196e1933b71e2555580", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218341, "uuid": "602b44da-ebee-47c0-947f-ec99345cce07", "comment": "Malware payload (Dridex)", "value": "53fd273f6b89d2dc5139af7ec8e411df2710d974c5b44e5246d5550834eb5381", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218341, "uuid": "fec2066d-e23b-482c-9085-37735ea9d22a", "comment": "Malware payload (Dridex)", "value": "f8bcd109408ff188554855e7d0c96c828015cb99", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218341, "uuid": "215175f8-2405-42ea-90f9-b5e53c163e5c", "comment": "Malware payload (Dridex)", "value": "c4d28441f33402a60abe951013c2127a491fca37e306d56060e4f7f9054e344e2ac4e35397ef933eeca21ab3b448cc94", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218341, "uuid": "adbec127-6750-48c5-ba85-31a18a097ac6", "value": "5714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218341, "uuid": "529dba82-d099-483c-9841-571b583244f1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218341, "uuid": "5db8d97f-d6aa-4f70-9536-3b3800830b03", "value": "3072:Topj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:UpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218341, "uuid": "9e4acf72-02dc-446a-a523-c71a7e15f188", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218341, "uuid": "f469a968-5c76-496c-8d30-bdf72ee1ab71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218341, "uuid": "b06f2b45-e260-4ab7-8c12-d013e9afcf5e", "value": "53fd273f6b89d2dc5139af7ec8e411df2710d974c5b44e5246d5550834eb5381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f5e171-924e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617214942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214942, "uuid": "47d31830-13c0-41d4-abb9-6c86ffeeb563", "comment": "Malware payload (RedLineStealer)", "value": "27459da7b255eae98bce2d56aae439cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214942, "uuid": "34f1f670-21ad-4a99-803a-31f5cd40eefb", "comment": "Malware payload (RedLineStealer)", "value": "54329e92940f21e4cf24c14a70f3e4874d91d7d15b74097c9fbd56b89f87738e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214942, "uuid": "db4533d5-c033-445a-9038-8c651163557c", "comment": "Malware payload (RedLineStealer)", "value": "be2fd70ba16cd84327c344eb49d2f644c83ad64a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214942, "uuid": "ccc26ddb-939b-456f-aa20-5e4e96d83085", "comment": "Malware payload (RedLineStealer)", "value": "66260e86a1eded7cfd0388003411e05b58bf62b86731a815e353d7293cc5a458f4b5b81b81321d993807d1af9497bddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214942, "uuid": "15d226ea-f579-45d0-b97b-14280565e6a5", "value": "2664E000B2E4C433D0521A750864D6B55A36FCB19F39A6CB3BD42B7A6E353E04A3B797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214942, "uuid": "5838e2f8-21bc-495a-ad76-af7548828455", "value": "2729c7fa189d9a609b8dddcf570936d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214942, "uuid": "8b1a2c5d-aa58-4b08-a98d-8c1891f8da00", "value": "6144:6tAvSIOQLwlSqBRuJfLDOlRgmHSP7EKKaCD/tIy48wpiqx2O:JvXD8l1BRSOlHHmLOIy9wpiqxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617214942, "uuid": "7c105ab2-697c-46c5-8455-1fa81a7f3d37", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617214942, "uuid": "141a1622-f123-4090-b740-637394250b15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214942, "uuid": "8b32be3f-a9da-4806-80cf-5976adf6c858", "value": "27459da7b255eae98bce2d56aae439cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437450dc-9238-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205591, "uuid": "1a5cb7e6-733b-420c-91a0-d0e0b210c984", "comment": "Malware payload (IcedID)", "value": "93166e331b9abc876092f5cee69eba07", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205591, "uuid": "f8fd7210-c461-4803-92d2-e6408dc6b6f7", "comment": "Malware payload (IcedID)", "value": "543b43ee58d071019412e0702a8a9004018b0ff91ba9d62c7883e2d011225709", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205591, "uuid": "70d4695f-b9f7-4357-9b83-ce904d024c83", "comment": "Malware payload (IcedID)", "value": "c4eb3669b0f2e70a0b01bfa255afe8c0432ceb3f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205591, "uuid": "f3e7b51c-35f9-4885-b8b4-6c1efc074c24", "comment": "Malware payload (IcedID)", "value": "2c622506d7126fa495cba17878894b6915ba9044c636d980ed3f52357a785667110ef6ecf5ab1225da73221e69399b97", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205591, "uuid": "a02ea61a-5e69-48f5-a93a-6211230366a8", "value": "27B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205591, "uuid": "0311eff8-d7d3-4293-b05d-8bb8a5c7d1a3", "value": "3072:g2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:gqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205591, "uuid": "a2511ba2-f3ce-40ab-9c01-013a37ec31c2", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205591, "uuid": "63064836-8d9e-4402-87f8-9bcffc3bd6bc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205591, "uuid": "dcf18cf7-475f-46cd-a60a-52e985986a22", "value": "document-1071773305.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04eba6d6-9247-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617211928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211928, "uuid": "e5d853e4-36d2-439b-84b7-ba13cbaacef6", "comment": "Malware payload (IcedID)", "value": "4e42bef8426a9bc4d56edd42ff7eeca0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211928, "uuid": "9e8a89ce-eeb8-46de-a8d2-2ee4faf18c1c", "comment": "Malware payload (IcedID)", "value": "5458a4fb09d4fb08467b3c1cce37eecac72b68d2f3b15a701df053e5b284fc5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211928, "uuid": "3bddd6a6-dd4c-497e-b3c5-463e97ce15a0", "comment": "Malware payload (IcedID)", "value": "23d3d606a27f001a284025825d86f7bb020faec4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211928, "uuid": "ea1201f6-6a55-445c-a080-91f13c2886fe", "comment": "Malware payload (IcedID)", "value": "1543d424aca1a7a747c24be97c10faaee9f169f814dd770849344a04349c841b4dca2230a1880dac87e8909f28174a59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211928, "uuid": "3f893f5e-6a61-4843-b496-5833198aee55", "value": "E4B37BCAC9710643D4379933C1F26B28E526FB60B3A395FBC0487266C593690EB72776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211928, "uuid": "b53792bb-fa62-4ba7-b8e3-a76933412a5f", "value": "768:YcaM04GKf146QXQRno2wI6PudG9Sktdxp9AOCs+Apj0mjJbBRgYc/WVI2C0v:mxKf0A+2R6QG9txpSd2iErR13I2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617211928, "uuid": "c7454f69-9fd1-475a-ba9e-3d781e21044d", "value": 114264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617211928, "uuid": "286b8dd7-e59d-4337-98ca-003033f9e8bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211928, "uuid": "76aaccc3-cbbe-46e5-825a-62ca769ce202", "value": "4e42bef8426a9bc4d56edd42ff7eeca0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4604f846-9258-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219339, "uuid": "fd88e56c-b1f0-4a8f-86e2-87a2a48f42f5", "comment": "Malware payload (Dridex)", "value": "979bbbe54fee5ab6e000351710ff118f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219339, "uuid": "66048bcb-9603-4560-a6f5-eaad1f874621", "comment": "Malware payload (Dridex)", "value": "54649b2e9da5707b43e717c6b78caec50f268b5789ed9f0290c559a6f53310d8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219339, "uuid": "91a58e9e-e02c-43af-b6ef-8bf29f42d3ba", "comment": "Malware payload (Dridex)", "value": "b249615e28246d16c5074ebef7b0dd146cccd994", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219339, "uuid": "ef9e8da9-0802-439f-8b84-34028d29835b", "comment": "Malware payload (Dridex)", "value": "01e4ec5031a0aca00dd66574ed1182f393a15770f0ed7a7b0df22c291e1f65fdca2d0128d92308a4047b9f4f29a495e2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219339, "uuid": "04884f8b-941e-429b-a2fa-bd5eb0399088", "value": "FA14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219339, "uuid": "118787c5-03ba-48df-9b21-e201c3563608", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219339, "uuid": "bf5ed036-c7d2-4b37-aa70-53f7965f19ec", "value": "3072:qopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:NpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219339, "uuid": "086b91ef-6052-459c-87d6-fe8e492be0d1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219339, "uuid": "d7be89da-3312-4044-af4e-61db8359626c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219339, "uuid": "89312d17-51d7-447b-a4f8-b1e6bb2df4d5", "value": "54649b2e9da5707b43e717c6b78caec50f268b5789ed9f0290c559a6f53310d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632155a9-9265-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617224971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224971, "uuid": "2b92a543-bc4b-4b9d-91bb-1150d020effb", "comment": "Malware payload", "value": "cb2a038ec5ece59d183d4ea5bf5e0ee2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224971, "uuid": "30c81542-9906-47db-b47a-f030525aa3f5", "comment": "Malware payload", "value": "54d60aa0f5faee8a71b5fde58d98c8d8a8d62736f9d0e8d826b77c5877507ad5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224971, "uuid": "a9b95dc6-0ce7-4731-839b-4d19adc4264e", "comment": "Malware payload", "value": "0446d420ba3a3fdeac63e4c23d87be473fbf5042", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224971, "uuid": "c71ada2f-3ede-4d5f-88c2-39d95ff3e587", "comment": "Malware payload", "value": "5f59e69e706c0d026f850ae7eef4691d310765cfcac6e69293bf9c506b5981b4d1101141f0320af35df40577101723a3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224971, "uuid": "dd345170-161b-4f42-aedb-fc0f3faec02a", "value": "54248C5FE339F486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224971, "uuid": "81e54cee-1662-4103-82e8-729ea9282c18", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224971, "uuid": "94b3f4e3-6403-478e-8252-3acffe30f0b8", "value": "3072:E6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:EoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224971, "uuid": "4c033e1b-d35a-40a6-bf9d-04693e0f0b8c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224971, "uuid": "6403c28d-a684-4a40-9dce-fb7ce7ad1310", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224971, "uuid": "758d51b5-121f-48e6-bd95-87ca7d3bd9ad", "value": "54d60aa0f5faee8a71b5fde58d98c8d8a8d62736f9d0e8d826b77c5877507ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1779096f-923f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617208523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "e64b7a5f-304e-4148-b354-250f78e5d94f", "comment": "Malware payload (Dridex)", "value": "b43cfaa13ec81c2e07c2a01fa3c296be", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "6839398b-c207-415b-9f37-04fe8335fa11", "comment": "Malware payload (Dridex)", "value": "54d9c19915996cd9cf3f452987abfdd640ddd074bc6afb88546ea4e411bf4e68", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "9a6be00f-521f-4b13-8cc8-0702d31a4b56", "comment": "Malware payload (Dridex)", "value": "14c38317d7ba59499b7361edd01f5f52cc73928d", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208523, "uuid": "613a559b-db3e-4e83-b338-e583e4c6dc37", "comment": "Malware payload (Dridex)", "value": "0f5f9cea7e302e11c32f3c22a23c976fb2a425ec5ab1f6d0f4328445787192467cd7ccbfa31d0f8578828260c9935973", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "91489e5b-3e79-45b5-926d-6d75a0bf4801", "value": "D284E003A7D54032FB731F34087397124BEFB9954A748DAAA69D211D1F673D08638BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "a6830647-4b2a-478c-9d7c-3bfb38abb43e", "value": "02e581d639f814ba43d9c6c8be6f316e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "b1434d53-9555-48f3-90a1-56db628154a1", "value": "6144:o6vYH/guLTgWb1oFtIaJmGDtDplcJqiD4IU2fQ/TxHwYtrHayYm:o6vYouLTgW5oFt/hRDfkL1U2Y/TxQYtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617208523, "uuid": "b9d91f9b-3fd4-4455-8faa-7685538809ed", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617208523, "uuid": "daebc98a-bc5b-4fea-8909-8e85ab77f9c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208523, "uuid": "24ca958c-7689-403d-b54d-6bef53378b19", "value": "54d9c19915996cd9cf3f452987abfdd640ddd074bc6afb88546ea4e411bf4e68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73d5222-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218240, "uuid": "dd987c99-32fb-4644-938e-47aecf132b77", "comment": "Malware payload (Dridex)", "value": "51fbadd920448dd850af853a7f72aee3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218240, "uuid": "10b4f177-3cca-4431-85ce-25ae4dfc715a", "comment": "Malware payload (Dridex)", "value": "54e8138e218efc0b1618904d63d68e64a34b2eee681357df525112d10e6621b4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218240, "uuid": "eae34af0-2082-4f42-8660-383acff953be", "comment": "Malware payload (Dridex)", "value": "977c77146433bb962102a36aaec146ebeb88678d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218240, "uuid": "aa5d9f0b-36d4-4b24-a6d7-f4c868edc6b0", "comment": "Malware payload (Dridex)", "value": "d559cabb4b56e67eb709cd3a3f8c95b556b8714d90e5ef400516d978e6ba28d31f9c44ca3fa19a5139f2f5f4d519923a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218240, "uuid": "8e13de11-9189-489b-b436-c44ecf7c228a", "value": "0B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218240, "uuid": "92c041d5-2d53-45b0-87da-148ca321e0f0", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218240, "uuid": "88ea52fb-73ae-45af-9a68-4aaafad8e271", "value": "3072:yopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:FpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218240, "uuid": "120e578f-003a-4458-85f0-8566f46dde50", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218240, "uuid": "df769b91-5223-4d6c-953d-7f4dd0d71e44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218240, "uuid": "4f191e70-9c14-4940-a340-65c3c41c3b4e", "value": "54e8138e218efc0b1618904d63d68e64a34b2eee681357df525112d10e6621b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f36096-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199312, "uuid": "66d5c132-c914-486e-bf3b-73e935e78572", "comment": "Malware payload (IcedID)", "value": "3b7890e7e5a4b5e32fff8eb74b2f01ce", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199312, "uuid": "f0e7dae6-e0b1-4ef0-87b0-2872998bbd34", "comment": "Malware payload (IcedID)", "value": "54f85192faed3e2b4ddfcb8d0641ba6096b80725b15d346304786f35eec70afa", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199312, "uuid": "e28cf2f0-173e-4ab3-a94d-be59a3cd3c94", "comment": "Malware payload (IcedID)", "value": "cd689047cb76afada1519d2055b30e43e786f858", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199312, "uuid": "a7459975-a549-4aab-b51d-c0aad987a8e5", "comment": "Malware payload (IcedID)", "value": "48f5155850acf134f8294dcad2d4271848301dca76ac5d6131b352cb376e3aac5b876801c3092e04e89775ec3bb4edf7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199312, "uuid": "c8a3a80f-b0f0-4467-b99c-fe8a3d12adca", "value": "2BB3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199312, "uuid": "7665aac7-f35e-4ae9-82ff-793970ca886e", "value": "3072:O2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:OqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199312, "uuid": "612d2d36-f788-469e-9518-8a302d4b1d86", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199312, "uuid": "726f7068-9fc3-4455-adc9-2e96584d26c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199312, "uuid": "6499419a-be83-4d83-ac8a-0235c13cb5b7", "value": "document-598750899.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61c01e7-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216574, "uuid": "e36dc862-24c4-485f-925b-2637e77f362c", "comment": "Malware payload (Dridex)", "value": "1295e9cd10183935c936fdc1d41cbcfd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216574, "uuid": "ba422342-d9d4-479a-bb67-e6f7f881a28f", "comment": "Malware payload (Dridex)", "value": "550173f833501095f1b5c5f8af4859ea85475961ab7cd16241a2fe7248b7e8e5", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216574, "uuid": "261fdc54-d149-4959-9c77-97c387058524", "comment": "Malware payload (Dridex)", "value": "8138b04d6bea8f7944c7942229c6cba698205d65", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216574, "uuid": "55624ed7-2f09-4f00-9e21-00e71e09d0ec", "comment": "Malware payload (Dridex)", "value": "7957c77c881f126ae95e77386cb7b0048475fd2f125728d64a8cb34cf43a1abaac287bd7f1e2604f7b216ec1ddecdc0b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216574, "uuid": "1598e3dd-789b-49ab-b324-f81ee4f9c3a8", "value": "AA14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216574, "uuid": "4e016538-8729-491e-ad2a-32f74bc2dd7d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216574, "uuid": "042baaa3-d450-4a48-8891-502aef838265", "value": "3072:+opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:hpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216574, "uuid": "bcaa37ad-4a1f-4b37-8b35-b742d7226dcc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216574, "uuid": "f3c91d0f-1f13-4b70-b9c5-1d3cebe5ba90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216574, "uuid": "42bf72c8-cc9a-4cfe-92b8-5bf23c10464e", "value": "550173f833501095f1b5c5f8af4859ea85475961ab7cd16241a2fe7248b7e8e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444abeff-91d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161354, "uuid": "95fe537d-a513-49c4-9215-42ad8f7780da", "comment": "Malware payload (IcedID)", "value": "a70307f23e0866d004ef38db175d28c1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161354, "uuid": "e35db209-34bf-4e38-8186-603035a0f1fe", "comment": "Malware payload (IcedID)", "value": "55047f8ff45882f01bc51f9c67d25c6d052e30abc420e9150e30b1d4e962dd66", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161354, "uuid": "66e17949-f4f9-4d94-80dc-76abf0b7bd09", "comment": "Malware payload (IcedID)", "value": "d13712848191f8753fa53beefb0a7347c543239e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161354, "uuid": "bc806231-34f2-4d8b-a752-088fe1853e44", "comment": "Malware payload (IcedID)", "value": "69142903d531f7eaca8b27232e3f8418ad57ccf1676a1fd274a589926df84aed093a6852b4a2a244cef69209bbc615dd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161354, "uuid": "c9f19d23-0d44-4248-861b-85c867649936", "value": "BBB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161354, "uuid": "ed2ea561-38ed-46a8-9b33-5c476288bee2", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161354, "uuid": "521716a6-f79e-4cc5-bd6c-5d075a1f142e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161354, "uuid": "adfb7801-a50f-42b6-a6c4-abb75074b1d0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161354, "uuid": "6315a3aa-dcca-415f-a6cf-8bd7eae27b90", "value": "document-643561196.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ab7a24-91d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163150, "uuid": "33232ac6-c379-4bdc-9477-7f7e618d1f20", "comment": "Malware payload (IcedID)", "value": "ea2526a7c03be2e0fa521d61cd01ee22", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163150, "uuid": "ba3c0205-4d46-4407-b49c-9a197aa38910", "comment": "Malware payload (IcedID)", "value": "550f87b8bb8aa9ef40d22eea337832da32a2a5972e4245f4eeddcd0395dfd015", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163150, "uuid": "7df84a9f-9be2-4632-bc64-e614d99be23d", "comment": "Malware payload (IcedID)", "value": "e22a5bbea39ac25736fa32237cf77165a304be13", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163150, "uuid": "720cda47-bb75-4697-9a99-b453131b4b46", "comment": "Malware payload (IcedID)", "value": "725f1d8e71a1afae92c38434bc67a8f366a7fbe338242d41e0f46546076542def1f7a0c5f30702c6ed1fd430112e9afa", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163150, "uuid": "5e488303-5db3-40d6-ba12-2ffb6d0f665e", "value": "C8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163150, "uuid": "ea5d7e5f-1e50-4266-8a39-be38c56680b1", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163150, "uuid": "b09c94cf-41cf-4126-8e1d-a94b57b934b1", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163150, "uuid": "23d55f09-091d-4a63-aaee-5c58b6130265", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163150, "uuid": "979653d5-a406-4577-aca8-935601da4513", "value": "document-176589572.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cdab8c-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232812, "uuid": "9a5a2f52-a63b-4e01-8706-673a5b88e29a", "comment": "Malware payload", "value": "2a445ef444507d0d823174217c6b75cc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232812, "uuid": "2a25f157-393a-4e2a-b766-0cc8623e29f9", "comment": "Malware payload", "value": "5511fec253084a210abbf9f851e1253bd3ff4b9f3efd26e6d4a014729e68bdd8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232812, "uuid": "6dadd7f2-f12a-4b59-9ecf-e69e725b1191", "comment": "Malware payload", "value": "e0ee1515af89961437d9ba485bf4ba8587f8bc27", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232812, "uuid": "9be3854d-a5b1-4101-8b73-04987f0101af", "comment": "Malware payload", "value": "93a1e046babd8017ba5b2dcfdb0e3e67e373147e821f4c14df7d17350af5e246e4055839ee64ee961fb2c0663828a5ee", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232812, "uuid": "98d5b794-9736-4583-9086-ae89640a90f3", "value": "4F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232812, "uuid": "9b71286a-a5a6-4616-94ee-3b6a1a1cacab", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232812, "uuid": "0fd7ac15-97d6-4267-b1d1-a2d51b1a97db", "value": "3072:2opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:JpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232812, "uuid": "f57bfc17-00e7-4034-a772-c6d25d43d716", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232812, "uuid": "38273bde-d5fa-4005-9709-ced4e51b4e43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232812, "uuid": "8af7ea39-feea-4964-8d95-56fac60d043f", "value": "5511fec253084a210abbf9f851e1253bd3ff4b9f3efd26e6d4a014729e68bdd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b11a5d-91e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617170168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170168, "uuid": "7d2cc9e9-ee85-4a2b-ae82-d19e77342fb2", "comment": "Malware payload (AgentTesla)", "value": "8f7e642e7be5d319076f9f48b6d33e41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170168, "uuid": "a11f6c2a-d539-475c-af5d-e1fca1686b78", "comment": "Malware payload (AgentTesla)", "value": "553f8d4b64f3f490db02424ac3613857f2fa288a63442a78414fa5393feaf2c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170168, "uuid": "db259174-0e13-4449-a875-aa98c872fdf4", "comment": "Malware payload (AgentTesla)", "value": "eb2bc4bfe281bf1aa7935a79fbc2a9e76c3edaa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170168, "uuid": "4cc4f936-a613-4886-96fe-b9ddbd9cd54e", "comment": "Malware payload (AgentTesla)", "value": "b818d63f9098cb24d338a3ae8fedc70aa3b429b7f1d21af3a5653dd1048e6a480ddbf8e4acb4348104ab96888c161ad7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170168, "uuid": "d29986db-8c23-425e-aea5-e36ab0222249", "value": "3205DF253346FE93E47A84F948CC1B42B2F713C5121AF5B97CA0569492C22D7BBF26C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170168, "uuid": "f4f27763-bf53-46c1-9ce5-84d849de306c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170168, "uuid": "09a1bc5b-56a6-41f6-9265-0a5546fdc4ff", "value": "24576:ABhEStCFJpw1AqHwB5ogeUcltwG9nObhZe11x:Sp8FexgZe11x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617170168, "uuid": "19dca6de-6b63-402a-a365-70f1bab78c89", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617170168, "uuid": "12116b61-5e81-48a4-987a-9c3c8834c6d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170168, "uuid": "53516cf6-2462-4fdf-9a23-95effb03f8eb", "value": "$$$.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c4f61b-91de-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617167046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167046, "uuid": "ad912ca3-d32d-4c32-9198-bdf950fea703", "comment": "Malware payload (Dridex)", "value": "fef534b184aef7a29a1d957367a3df26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167046, "uuid": "eb99c4bd-022b-498c-b63d-1df806b76b31", "comment": "Malware payload (Dridex)", "value": "554783223e23221ac3572f3c31f2a1fe6f543aca41d61ec11fc3e04b953b7956", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167046, "uuid": "236454d4-f011-4780-986a-06965eec4b77", "comment": "Malware payload (Dridex)", "value": "f561acc1b67b2efd5c4c7bf342567d599adcc851", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167046, "uuid": "e26476a5-d65b-4811-966c-c514ad9ee632", "comment": "Malware payload (Dridex)", "value": "49db83dca1825f3c6ce423370847ad9f90373c530a8168fa72546f2be24649636b1231961ccc10829f99c0e09960bd46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167046, "uuid": "0462856d-e3c0-494e-b7da-6e9e78dc0e38", "value": "8303E14DCD448E9ED0238574B12C09FF818E5585CAA0F59B19BAD31D6B08DA1A3BF7CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167046, "uuid": "79938abc-1d65-42d7-b1b5-4ba470010d7f", "value": "768:zrd8uGBcIsepU6qQMyewK0d3vEmXb8tT/ws52b:zrd8JEQp1K0dtXU/pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617167046, "uuid": "24cdfb83-cdc2-4b55-88eb-cf68d894ab07", "value": 38546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617167046, "uuid": "37553d9d-78a6-4cbc-97c0-329ea8c46b0c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167046, "uuid": "4a413aa9-2922-401c-a1bb-f71c86511551", "value": "enel_ursnif_italy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2833c52b-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217571, "uuid": "c861fbae-6ef3-4151-ad65-87b767698b00", "comment": "Malware payload (Dridex)", "value": "a84a68398b559f444242a3be26271de7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217571, "uuid": "be7f3a30-98a2-4bbc-9257-c6e7925aca73", "comment": "Malware payload (Dridex)", "value": "55879661fad43364abd301ea5b0e863f478abd71313e60a2719b0d2ceafd5373", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217571, "uuid": "2e2fa5d2-66ee-4467-83f1-4ff70e01d084", "comment": "Malware payload (Dridex)", "value": "92db223bbd221b4a2b3ebd8fc986157b97a5f9c3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217571, "uuid": "f283299a-d15a-4ad6-907b-30cd4408fc5f", "comment": "Malware payload (Dridex)", "value": "c5e1229200a701d49f4f84eca77476752d1a2accb6cfb7e85f083d910aafca1e7cff85c6c65aa0908c59cdaad75afe67", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217571, "uuid": "7582e40c-fb3b-4ae2-a5ba-40d85abd9936", "value": "C314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217571, "uuid": "be4a3606-9cb5-453a-beae-ccd11fdffc4d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217571, "uuid": "e7b874d6-eccb-427d-a748-77ca9339c8ae", "value": "3072:3opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:4pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217571, "uuid": "ae40d3e8-b0ef-43c2-942e-f3f58392a1f0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217571, "uuid": "7fdbd8b4-52a3-4bdc-b3e6-be0008611a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217571, "uuid": "dad2e9ac-3826-4fae-9178-3d48e58a5718", "value": "55879661fad43364abd301ea5b0e863f478abd71313e60a2719b0d2ceafd5373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d792fb61-91db-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617165896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617165896, "uuid": "fa61ea2a-304e-4938-af81-5c38e8a5fb9c", "comment": "Malware payload (IcedID)", "value": "ea6441cfb39e7aa23fec2f9318387568", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617165896, "uuid": "785e2842-c0bc-438b-b353-c28ccc668703", "comment": "Malware payload (IcedID)", "value": "559c55ecc508157652cbe57091cbce5f4c6b4ca2c09c3a617f9fa760c8bcd693", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617165896, "uuid": "19e8ccd9-06f6-4340-909a-b509f45dbcd9", "comment": "Malware payload (IcedID)", "value": "f937086c5b6c28e6d9dc6fc11e61073bb7865a59", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617165896, "uuid": "f4c126d5-9f47-434d-a835-122f7a48bbd5", "comment": "Malware payload (IcedID)", "value": "fc786041b9c739307a81424c2dd41e6f4389a6e4fb43afadeb9762ef74edb536dbec90fae05c471a18b5bc51737ff837", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617165896, "uuid": "f4d12244-215c-4bc5-8b51-1feaa46db40d", "value": "50735DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617165896, "uuid": "abb45d27-7be2-4f13-9815-74123b84f42b", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617165896, "uuid": "e6782b92-ffb2-4695-a8c2-5a0d93b30a36", "value": 74245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617165896, "uuid": "4cd1489f-d67c-48c8-a76e-7e31e4d529c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617165896, "uuid": "3f32eb0d-3465-4a8d-a873-2ad74aa78453", "value": "ea6441cfb39e7aa23fec2f9318387568.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0a300b-9213-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617189877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617189877, "uuid": "2f2c99e2-7e43-4e7c-875d-1fd18665bf68", "comment": "Malware payload (Dridex)", "value": "d860c18a6cc2d148c16c4924328c91c8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617189877, "uuid": "3dc55f9f-777c-4ed1-8e73-272b9f0f63a3", "comment": "Malware payload (Dridex)", "value": "55c76691a2fb34536e24b1ba3a2516cf5b44bf9e0d5bbdcf8c1cec97e1e137d4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617189877, "uuid": "46e01a32-ebb4-40d1-bffa-209dd713304f", "comment": "Malware payload (Dridex)", "value": "9af4b1640684cefe3df818bbc6e00d29f0f81545", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617189877, "uuid": "cf5621db-ac95-4c94-9859-695a39f17425", "comment": "Malware payload (Dridex)", "value": "16185809755fd07f98805791adcc2361f1b90b0f63e009d3e88b354b241e9807202b8c2846774a854112d5bac0c14879", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617189877, "uuid": "d00b3cfc-fcf7-40ca-9b75-6fdb2340d7e4", "value": "4014BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617189877, "uuid": "561a4fed-3115-47af-95e3-fe27820713a5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617189877, "uuid": "18920336-177d-483a-a01a-2e5a5f1cd299", "value": "3072:E3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:gJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617189877, "uuid": "b55b5701-04d1-4f8f-bc16-202050197f07", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617189877, "uuid": "06499885-20a8-4319-b5d9-b0620b4ab38a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617189877, "uuid": "1bddb711-0701-47b2-84bf-425bcd19fa9c", "value": "55c76691a2fb34536e24b1ba3a2516cf5b44bf9e0d5bbdcf8c1cec97e1e137d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0902f1a4-91ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617174139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174139, "uuid": "7575b62b-411e-4bba-bf0d-48b75934a936", "comment": "Malware payload", "value": "b21f6724198f32941b6dec8e63a3acd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174139, "uuid": "e2a5525a-94ed-46b7-a59e-93beeeedf267", "comment": "Malware payload", "value": "5619c8395d506c05cebd14d6145c87a87e52b265a2442aa6dbea431f94c22eef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174139, "uuid": "288185ef-8d42-4918-8e3f-c5ab622c79b7", "comment": "Malware payload", "value": "97decceedc4e24d03c45cadafb88940695ccfcae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174139, "uuid": "d78f1d37-b392-42be-9580-30816c89b075", "comment": "Malware payload", "value": "320c610bbeef8f87c76d516c642daee38a560ab3716dd3fbd949bf135006a5c91af02af8db31c02e1110c822124856d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174139, "uuid": "35119ad0-8030-44a7-8f60-be81258c49e7", "value": "C355DFE8350075DEC81BCD3689641C209A61BDFA570BD603901776ADAA3EACFCF951E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174139, "uuid": "9d94f02f-cb15-4500-ae23-a5d36309f63c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174139, "uuid": "d5ed2d53-86c0-4cfd-9966-09c2e8b69753", "value": "24576:Wui3H9U2GU/8moxmAAXgUUdPdvzgS3c0x3:WNmD9XPdv0S3t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174139, "uuid": "8b91a90d-e2bc-4ff5-b8b5-eb7a0b2cd7cf", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174139, "uuid": "dd59e3b8-bbc8-4be0-b252-c5be194d4d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174139, "uuid": "76ba6b02-d972-4acf-87d2-894c198322bf", "value": "Order_015_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8b6146-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223027, "uuid": "e8368789-a553-487f-b2be-6c0a6f1f8ab5", "comment": "Malware payload (Dridex)", "value": "de671c9cfa31a2b650cf9a3b3a180c5f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223027, "uuid": "199ced73-c60d-4c59-8ee0-9408e6e922cf", "comment": "Malware payload (Dridex)", "value": "562cd0ffd37cdee295d681ea72f7868c9d040fbf77bc65a10c482eb608876872", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223027, "uuid": "0615d80a-2abe-46ef-a54b-2bdd04a136e5", "comment": "Malware payload (Dridex)", "value": "e456885f2dc880d2fb3312734d8ea98601a11f70", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223027, "uuid": "fe48972f-1def-4fab-9e56-66980768b688", "comment": "Malware payload (Dridex)", "value": "fd8148119a3598d32c7c7d6645d2cdb5a801f20ea6c2fff3655747831b85cc394223912208bcf73bd9bccd3710938e58", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223027, "uuid": "83f77da1-5917-440b-823e-9a35849acec6", "value": "56248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223027, "uuid": "af5feb22-8f9f-4653-a823-065864845348", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223027, "uuid": "417d067e-5f97-4226-822a-689e2ed44387", "value": "3072:K6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:KoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223027, "uuid": "4ab64ca0-15a2-4c05-ad63-214005ce0262", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223027, "uuid": "4214763c-4e78-4bae-b58c-f86d72aecb6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223027, "uuid": "2c96a211-beb0-452e-bebe-b6447d09f4f9", "value": "562cd0ffd37cdee295d681ea72f7868c9d040fbf77bc65a10c482eb608876872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85e9f14-926a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617227369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227369, "uuid": "58ac88ab-5db6-42ec-b00c-f9f2dc10825e", "comment": "Malware payload", "value": "d518bfe27adddfb5cbe766188f3aab89", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227369, "uuid": "e7a5c4b3-d557-45cc-acb0-f2a8b1241cc9", "comment": "Malware payload", "value": "563d0093fce42845f1a75f36e485fbaa29c2d840516169063c313481873f7876", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227369, "uuid": "63898d83-52c9-4a8e-a29c-44437a89b4f9", "comment": "Malware payload", "value": "c18ad2d4d9cdf629999375a6d3badc77dc25fb87", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227369, "uuid": "1af87d3a-c5be-40a3-b40b-5ee0ace5c61c", "comment": "Malware payload", "value": "78a2defcee83739b36098cd590a33456d35708afb9ae02d39d3e22992b4671e7c89de7a296703bd50594134834cb8a82", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227369, "uuid": "2ee6db23-9078-4fa1-be14-77a46097c494", "value": "91248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227369, "uuid": "609ffad3-f954-4f59-8925-f0241ac5a5ec", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227369, "uuid": "6fde2f35-f03c-4112-afba-2dc596c894bc", "value": "3072:A6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:AoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617227369, "uuid": "1beb249f-d516-49c4-a4d9-d10fbded9d83", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617227369, "uuid": "00bfdaee-0023-494c-bfe6-c234a0da3da8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227369, "uuid": "ccf72754-d414-4f68-a07b-24f019fe41bc", "value": "563d0093fce42845f1a75f36e485fbaa29c2d840516169063c313481873f7876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7ebb13-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202121, "uuid": "aec721ab-ea2c-4c05-a6d8-93cfd8f32051", "comment": "Malware payload (IcedID)", "value": "725e362685ad6364c4e113b175739827", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202121, "uuid": "87927517-8eff-4184-a114-6adfea52db0b", "comment": "Malware payload (IcedID)", "value": "56883fe4f521564f80a4f64fdbdcb305b988572b1c719c16459c4340548df962", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202121, "uuid": "38198b82-b4e2-4776-83b1-b1bd9fd4f5ed", "comment": "Malware payload (IcedID)", "value": "0108797f2f22d5d4845b63fb02b81a703e8bbb1c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202121, "uuid": "7ca326b1-63c1-4aa8-9c65-4fa9a10e09bf", "comment": "Malware payload (IcedID)", "value": "bb11a54a07dfd92c1bfb50ce00e664e807b5361a6167eb0fd6c7113936dd79980327f2a777026e73702bc1a0a8d9b54a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202121, "uuid": "365cabf6-e791-4139-a143-211435c7f1e1", "value": "1DB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202121, "uuid": "3e41f655-2ee4-4492-bbfe-0ef5bcb6c6e6", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202121, "uuid": "1f16c368-5c86-4c69-bc89-e609c6ac9456", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202121, "uuid": "866179e1-6788-4673-93dc-2296397d7abe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202121, "uuid": "35bc0917-acda-4bc6-a44e-2a301481f980", "value": "document-366276282.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf830d9a-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200215, "uuid": "2f83c83e-a284-44a1-9939-35252b3bcd9b", "comment": "Malware payload", "value": "b63c8453828f2d4ab610bc66093c0fe8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200215, "uuid": "cd7fbe48-abfa-461a-9800-5c1a73143949", "comment": "Malware payload", "value": "56c1ca15affcefdd7cf6211d0fd143e360736f97e6f3b1486ae57d02a0352b45", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200215, "uuid": "35757e48-bc41-46d0-888f-c0b371815af6", "comment": "Malware payload", "value": "e1644e1347026572e8ac8187c5276535d438147e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200215, "uuid": "4ad26c3e-fd9d-447d-9b33-20ad81dcd225", "comment": "Malware payload", "value": "ba10708d645c8b1b6b2d0d0c79b3daa12eb9eb6e5b32bc6c0f27985d9adc9f522e4ccc95b5a77905c175d3839c31e2b4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200215, "uuid": "ef37da5d-1853-488d-ab6f-991b4726ba64", "value": "0FC2F9356F0604110D75F26B759309AAFAF98033CF95B1C07D5D806C2F7BA9C82A97AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200215, "uuid": "5a73a245-6de7-4129-a348-f887db8936bd", "value": "768:yaGZ+MauzS1ipO0ba6QeQbHCdmrT+5030GE2Rs:3GZ7jzGn1nTmV2Rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200215, "uuid": "c52a92f6-57a5-4b7b-9b0f-a5d346b93f8b", "value": 27569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200215, "uuid": "a3306897-ae6f-4b09-9e4a-a5df176af837", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200215, "uuid": "55409eb8-d395-457a-ab98-91a30282bba0", "value": "56c1ca15affcefdd7cf6211d0fd143e360736f97e6f3b1486ae57d02a0352b45.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cd040a-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216656, "uuid": "a48fad7f-251b-4636-9895-61389d1f89a7", "comment": "Malware payload (Dridex)", "value": "81c88d7cc09091fd993810b15356030a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216656, "uuid": "ff849c55-9312-4cda-a192-c43b51b72854", "comment": "Malware payload (Dridex)", "value": "56e34eaa64810ce844cabdeac633e2ba34bb8d7908e8bca18ddcaee6c7ffeed4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216656, "uuid": "37c807bb-f533-4e50-b285-e405da500226", "comment": "Malware payload (Dridex)", "value": "d01e1f6c17c2ed39638807ad05709b25474705fc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216656, "uuid": "d0d92746-0f12-49c4-95f4-d2dafa9ad9ab", "comment": "Malware payload (Dridex)", "value": "86ff8c2d467ea654e81a668268ecd84d7a69b58439c7e89b7ae04ee43904f3760490c4eb76e6b1f44958502163460763", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216656, "uuid": "85101a77-03c2-4bb8-b217-000b5fca230a", "value": "4114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216656, "uuid": "3b8afe5b-2566-4d18-b7d3-415155cc3fad", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216656, "uuid": "761cbb83-47a1-4bc7-9f03-7970a0b81c50", "value": "3072:jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:kpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216656, "uuid": "80568ef3-d9be-49d0-9440-4c6f7ad745d4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216656, "uuid": "1f7d71e2-89e8-4917-8333-28a141360603", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216656, "uuid": "27e0439a-5d61-4ecf-bea9-b9b8ee689991", "value": "56e34eaa64810ce844cabdeac633e2ba34bb8d7908e8bca18ddcaee6c7ffeed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb86d42f-9222-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617196424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196424, "uuid": "542e1cb7-42c3-4992-b950-a2f665eebbbc", "comment": "Malware payload (AgentTesla)", "value": "45c8094596f457b68eb96ad2d594fcfc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196424, "uuid": "ec510b7d-57d7-4275-ba20-d40436423f25", "comment": "Malware payload (AgentTesla)", "value": "56fbdf0da1ead1829c6afb69b7b79b20e9302d21940452ad119f8bde4a360294", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196424, "uuid": "ce48230d-0d94-4db7-9e4c-45d88a2c731f", "comment": "Malware payload (AgentTesla)", "value": "6cc79fa61a4ba4ce7bffcdabc17799ce88fdb02e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617196424, "uuid": "557832db-263f-4898-bda3-25c160a2b692", "comment": "Malware payload (AgentTesla)", "value": "1591d5224470a142424084c9daa2ff48efc0438c02f05cce5156afa050aee004821c809ea4527682817d9abb1fd7f2b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196424, "uuid": "4a75cd77-b15a-4276-ba68-35c4581105d9", "value": "4A63CEABE9F0321CCC3B4AF8CC8E7167F55DC412548CE388644C939BA357EA4994D9B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196424, "uuid": "1327d547-5650-4ec0-aff0-87847aaadffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196424, "uuid": "99eebdd9-e219-4e46-b845-30ebfc0f19e5", "value": "768:ch/MsoFQoNpbVHG1sVkiVZDv65cUJSIj8jnbkalAvm/PalOpXwhS:cxLGThnjAvm/PalOpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617196424, "uuid": "789051ce-e01d-4d57-8912-6ce95c4dddaf", "value": 71352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617196424, "uuid": "c1b01f47-7765-45da-870f-203723f4d4ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617196424, "uuid": "c5033a6c-5c35-4af8-9b4f-72182cf75f94", "value": "MAN Enterprise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8af8d1-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617174063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174063, "uuid": "fac0045f-2662-4ab1-baf8-f06c3a20370f", "comment": "Malware payload (AgentTesla)", "value": "8af67d60192a44820605a5ee4ee420fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174063, "uuid": "1ff17539-5592-4c52-bab0-a3bf57fdb40c", "comment": "Malware payload (AgentTesla)", "value": "570c0394104f3b8a1dcae244814fe851e851c7f7d740d6a24715f2c1c51d35ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174063, "uuid": "6750ce17-1ff6-413a-afe6-e55e968cac08", "comment": "Malware payload (AgentTesla)", "value": "7d48eda62a23401864174e1e7b6d3744e360d34c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174063, "uuid": "04a376e6-f675-49a5-bc47-fe88c524a15d", "comment": "Malware payload (AgentTesla)", "value": "4d0e966a9c4d61a68c9fb14bba1cf63d4b60476e25e6c13823f4300364552a9e828371c12aefdd29394e8b02f7936ed9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174063, "uuid": "50baca1f-8b95-48e3-b23f-2ab8ca0b8a05", "value": "8A15D02EBB617792D52E1E3BD41325C483F4C46373B3F39B69E029E41911A4D8A1F9CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174063, "uuid": "5d168702-a3ec-46f2-a48e-4e3e889d7ca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174063, "uuid": "75069d98-e89a-4372-9500-e825c9b8cb3c", "value": "12288:LpbHlIFNz6Rnvyx6yQOpkrgCVTbaakxaM9qBxaM9qv//TJuNE6b6r7iCAhHNRqhY:LpaF+nQKHTsxF9SxF9aoNE66iaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174063, "uuid": "302d2929-9676-4628-b748-4804bd7f7e1a", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174063, "uuid": "9e9ce0e4-e66e-4bec-8631-6fed4796af87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174063, "uuid": "6541d44b-b71d-4883-95e5-1e4310b92f28", "value": "PO-NO-1005.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31978ae7-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163470, "uuid": "6af8a8ec-254f-4f9f-bf72-02e794ee9703", "comment": "Malware payload (IcedID)", "value": "ecea32bc7c6362f63893c5cbb48f97f0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163470, "uuid": "061a7a72-3dfb-4515-9ca8-9cb1ea54d34c", "comment": "Malware payload (IcedID)", "value": "57494b5bbe886b1fa00dc81f3f835be03769ed2d7eddd7833991ef57d2c45a2d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163470, "uuid": "92565d67-bb66-4f41-949a-6720506d8265", "comment": "Malware payload (IcedID)", "value": "1cae476bd8b20d25120064a1ad5b8fef683bce0d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163470, "uuid": "3214a4ba-02cd-4d4a-8504-fad8b47bbb04", "comment": "Malware payload (IcedID)", "value": "5029799ae53e929af736e3c7b68f230bf873ef165ffa82db45f040f39fd216a8f3894f0dd22bef6c3cca1c20deaf26e2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163470, "uuid": "4e7c4f91-582f-4610-86fe-a29c0cd7505e", "value": "E7B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163470, "uuid": "5d906a19-a4e1-414b-b7e7-b85202b157e9", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163470, "uuid": "5ecb0d70-f2ea-491a-9ee8-195a42b60550", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163470, "uuid": "b077df12-6508-4767-852d-a6103326744d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163470, "uuid": "bbdcbe35-6f9d-4736-83b1-052433c5eac4", "value": "document-41061790.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf10ebe8-9271-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230306, "uuid": "708313e9-3b42-45cc-b64b-b99f708fdcaf", "comment": "Malware payload", "value": "c01540c5f1794f1817e013d1370cf6f0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230306, "uuid": "6cf05bb1-eab7-4581-8359-2f6325a1b60d", "comment": "Malware payload", "value": "574adfa84133d95dfe0c011b4033234cf23418926fb148c691d5fea5d410fee4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230306, "uuid": "addec63c-1d63-49d7-b235-0de9ed0f6de6", "comment": "Malware payload", "value": "c67d4f482e0f4444efb76442ad10afff56815731", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230306, "uuid": "6cbfd64a-5302-49ad-a780-a50f98e436c8", "comment": "Malware payload", "value": "5426d215afd2c0b548343dff8f96a65a3afcc1eac7ff02f09711aad26fb90d0f03869925026ac016f47563908da70798", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230306, "uuid": "7ad77d97-b429-4304-882b-df14aab799eb", "value": "B2248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230306, "uuid": "cb84db20-8487-410b-a68d-68dce1a04f9d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230306, "uuid": "dbc9108b-3de0-4711-980d-139f291dcaeb", "value": "3072:t6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:toMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230306, "uuid": "4c20fcec-660a-4546-a6da-0ee78aa7a9ea", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230306, "uuid": "a9b15b43-f6ec-4218-89b5-00557d6f5f0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230306, "uuid": "5a38eca6-00dc-4ad2-9ad8-63988ebb6c92", "value": "574adfa84133d95dfe0c011b4033234cf23418926fb148c691d5fea5d410fee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a474303-91f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617176289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176289, "uuid": "ec4555aa-fe44-4e23-8629-ae1e6aaad52a", "comment": "Malware payload (Formbook)", "value": "48f264ba784a88ef38095ab61b7caa55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176289, "uuid": "1cb1a039-6408-4661-bc69-ee341598940f", "comment": "Malware payload (Formbook)", "value": "5755f598a66b494a7692bfefd7ff348d7d1d8ae6fdd7e799bdfe7f6cbf642c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176289, "uuid": "ef6e9e17-c575-4e12-86b5-ea6f1efafd35", "comment": "Malware payload (Formbook)", "value": "7ca1fc89acd56f314dae7e8ba0e41227ca342f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617176289, "uuid": "a243c02f-7353-4368-90ac-7236699007c8", "comment": "Malware payload (Formbook)", "value": "ebefe722ffdb63d04d8299cd34ed54ef4275bd3f98d57469e18e81ca5d42bf038a7108d9bf86fcc41f04ae6aa1fe4c82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176289, "uuid": "17b66362-487e-432b-a0ae-568da8ef2306", "value": "6734121621E2CBBBD1128A323D36AB76B7FD8014431226D71FB49F170D22252DE563AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176289, "uuid": "d17ca3a6-7a19-4b4e-9731-e8252853361f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176289, "uuid": "f56e5cad-9d69-4283-be58-4a68209b96f2", "value": "6144:PAPjd+LCu3vIf+lGWhtHhg439jvk9m+7aT:WklAG88t2u7uJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617176289, "uuid": "8ce8bc6c-2678-4bf4-b98d-6227c5399b33", "value": 243825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617176289, "uuid": "efe551bf-bad5-49c3-ac5a-2470a61b58aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617176289, "uuid": "979a2780-1da7-4f3e-9240-a27c085beaec", "value": "48f264ba784a88ef38095ab61b7caa55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a87895d-9265-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617224849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224849, "uuid": "dd050662-962a-4795-be04-62640634cf3d", "comment": "Malware payload", "value": "38b5e50ea58f0ce9b8b08ebcc809d274", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224849, "uuid": "0068a84d-8ad7-4b02-9dd4-52fbcf9b6ec0", "comment": "Malware payload", "value": "5767e5a824d0dbb88949080df37dd9f06456abd168df23cf39d8173bc7e8228d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224849, "uuid": "4a0158db-732f-459f-affe-1266744c09d3", "comment": "Malware payload", "value": "2abf97fb08e98547368fa388890e52845c99408b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224849, "uuid": "cc81684a-6e3a-48e3-a1ba-f841bca00bd6", "comment": "Malware payload", "value": "2afb9f63d5d8177a2dff77268b7ea981b95db5320038e8074cae1b87119fb260d32434948a8e5b556fd0c0fd949609a6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224849, "uuid": "41791c16-e995-40a0-ab52-99374d432bbf", "value": "77248C5FE339E486FEE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224849, "uuid": "49b54405-d519-4938-9fd5-46158469137c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224849, "uuid": "3511ffbd-d478-480b-ac5e-b337bc78f94a", "value": "3072:v6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:voMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224849, "uuid": "5c4c72c9-ac29-46a9-94fc-d32c38d2ac29", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224849, "uuid": "a627a1d7-f40a-4906-8e99-6826af1ca9a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224849, "uuid": "ee5e177e-1310-40c9-a1e5-cbbd3b934c5d", "value": "5767e5a824d0dbb88949080df37dd9f06456abd168df23cf39d8173bc7e8228d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca3601e-9234-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204076, "uuid": "df6b03e1-7a77-4ea7-840f-34ce289198df", "comment": "Malware payload (IcedID)", "value": "21d48e12b933d927d8299181bb2f5761", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204076, "uuid": "97ac2005-9e18-4732-82d1-10345657e97f", "comment": "Malware payload (IcedID)", "value": "57ba88baa06b8af69e1ae45f6ab7805dec0519f1e5dfa8d72e339cbb6a197647", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204076, "uuid": "d9c055e5-0a0f-45bd-bce4-b067572a1027", "comment": "Malware payload (IcedID)", "value": "46c14de2a14284da31eab088382aed4ed0299f04", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204076, "uuid": "5586c7d9-6c5e-4d32-b01e-6eebc03b06ec", "comment": "Malware payload (IcedID)", "value": "79a8426bb979287db1498d237f8f4973a91012f15875328f85aebf26fca996912f6f88545204ce5bfd428be52b6bfe38", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204076, "uuid": "b698eab3-37e3-42b7-a555-60d97c1c0f42", "value": "F3B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204076, "uuid": "01a5ef05-1c79-451a-89fd-8ac5453d6033", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204076, "uuid": "c0e34a7b-c421-4bcd-847d-8e9b8347edaa", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204076, "uuid": "dfd510e8-c21f-4801-80b8-2672b5e74af8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204076, "uuid": "5d7cff20-3acc-4e32-a4e2-4f067c97c6ab", "value": "document-1318212155.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701dbbd8-91d5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163145, "uuid": "693d850b-34ae-489c-8d46-6a6eb5e0054f", "comment": "Malware payload (IcedID)", "value": "e0de4749aa38a13aa2095d15ba2bdd9d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163145, "uuid": "3fd0b4a3-7265-438d-b050-a09b307e794b", "comment": "Malware payload (IcedID)", "value": "57cdc9a5e48d821f53dc0c48922dc1f9a9ba0c71bba961f2dddd37e684b24863", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163145, "uuid": "e06b4f4e-5d84-4579-9771-a2857e907d71", "comment": "Malware payload (IcedID)", "value": "73e0cffaddc560fe4760e0e7daae038190a546bc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163145, "uuid": "123bef82-54fc-4b12-b05d-47720ea66633", "comment": "Malware payload (IcedID)", "value": "cbf7fe8c9607dfea0b4cd93e7b18456b48ebf4ed712812249a59117938067d90badc31844f55291d9cbdc4e845e040cb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163145, "uuid": "5c5269a4-0173-4fe9-9491-c8231085d301", "value": "B8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163145, "uuid": "28cded9a-8797-4f4d-83b7-1ad8ed13e2c1", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163145, "uuid": "be48c995-9858-4a9b-93cd-35251de2b2e4", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163145, "uuid": "9d7ef236-a757-45ed-93a1-546eb4c48948", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163145, "uuid": "1daa7f1f-937b-42ae-a08f-1633a513178d", "value": "document-1047670956.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98912d16-91ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617173092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173092, "uuid": "138925f0-8d3f-43f5-9c6e-c70bc30bd790", "comment": "Malware payload (Dridex)", "value": "f23bbdd3ffed3a2ad012141a74e1670f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173092, "uuid": "691361b9-f7bf-4214-98a3-5cf417d93675", "comment": "Malware payload (Dridex)", "value": "57f1d49d80f45b1a217c8f83c0877b4d92b338fdddce168071b57375792bd6c2", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173092, "uuid": "5f80b76f-56c0-4bb0-b2ce-90fbd454f23b", "comment": "Malware payload (Dridex)", "value": "6b78ac38574bf5047e90197e2653befbf1d55797", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173092, "uuid": "f3814ca5-ba99-4e69-840c-1a96381acf46", "comment": "Malware payload (Dridex)", "value": "65e8d8531227ac3c298bcfec970b20a924fd67ac1fc0178bdadfadc8a6ce000133ec94674216d41b604f327cb00c1273", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173092, "uuid": "c93506e1-d65a-4ec3-8a67-8d123618d1b2", "value": "E923F1F5C642A99ACE974CF2E12500E1B91E5A50C050E6993AB4F3CC1813CCE9B97FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173092, "uuid": "54b76f84-83fd-4e78-81ce-c8dda64e9363", "value": "768:lREuMBtNb205F2YC4QK/Nn5r0SGylKLVpfgfZlqVnm1vlac6ktLEDX:zE805bQK/NN0wSV8qFmmDktQDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173092, "uuid": "fbf87354-2ca4-41a1-a69d-93758c89dc25", "value": 48300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173092, "uuid": "b1138739-d84c-419b-bc63-d416ba67e890", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173092, "uuid": "5c0e3d8f-3e4f-4279-baa6-20a4c2c066b9", "value": "ALTISYS-MANU-30032021-380512-0181.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a100a8f8-91cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159792, "uuid": "348b5b91-5ba9-4f27-9e15-1ac6f3c88063", "comment": "Malware payload (IcedID)", "value": "743e66367efcd381abf63a91c478e36d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159792, "uuid": "ec957400-2cee-4c23-b3ed-870ae8af113a", "comment": "Malware payload (IcedID)", "value": "57fcbcb726b5d646bfa960ba725e54e35e2ab88c33d855bc5b3bc39331683995", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159792, "uuid": "d3a0ebcf-f6b3-4a88-81b4-9700578c7392", "comment": "Malware payload (IcedID)", "value": "5ced87bb9b1f3e869583a96dc8dc21f9d5088a83", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159792, "uuid": "e769e60d-d9f0-4c06-b87f-11134e1a9f6e", "comment": "Malware payload (IcedID)", "value": "4db14b41daeeb0502488984e11d43b96f90ffd19a27cb140d9206916d3f931806e954add07a2efac7c21dd7d49703fd3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159792, "uuid": "9e95bbf8-0ba7-45b5-9f97-47f802f5d58a", "value": "B8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159792, "uuid": "5aca6572-dab8-472c-aacd-7c4fa573ba11", "value": "3072:y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:yzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159792, "uuid": "7b8148a6-c99e-4b68-b199-690374f519e6", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159792, "uuid": "0134a97a-a56a-4098-95b0-db84c628bcce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159792, "uuid": "dea9a20b-8b99-459a-8338-d6b7423f9bf6", "value": "document-1922772753.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc82f290-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218732, "uuid": "e0944d27-f5d6-4eca-a0a5-dc140bd2d474", "comment": "Malware payload (Dridex)", "value": "93e0e4f9aefc1b66cac9eabf12f538f3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218732, "uuid": "c4d63b4b-a4b4-4c31-bfe3-448cc0e6223f", "comment": "Malware payload (Dridex)", "value": "580a4f14f92ba2bc8e3a7009f1240db567f3b51702df6752323cb1bb22c182d2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218732, "uuid": "fad666e8-4966-4116-bb5c-d7e48ade90b6", "comment": "Malware payload (Dridex)", "value": "375b255c362882dca4bc5ac8d6ec7fe191abe1a6", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218732, "uuid": "b6de4511-b050-431d-83d2-ac475704a564", "comment": "Malware payload (Dridex)", "value": "84f9f8e5715690eee08e58859ce40df827d026a7105c103fa733b82ad1c3c5edda5a4689181583742b07a73f18ee1a6d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218732, "uuid": "38c1ae7f-d123-4c02-8744-935133178103", "value": "4E14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218732, "uuid": "87b0fbe9-054e-447d-b42f-30d8a685b297", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218732, "uuid": "3bfd83db-a263-42e4-b5ab-021ad3c1c3e9", "value": "3072:uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:RpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218732, "uuid": "317c742e-c2f3-48f6-8338-626108f37efc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218732, "uuid": "b2dae3bd-b054-4748-9cc3-1184a5dcffb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218732, "uuid": "24383c3f-a94c-4711-a8dc-4e478b8ef172", "value": "580a4f14f92ba2bc8e3a7009f1240db567f3b51702df6752323cb1bb22c182d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d95009-924e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617215181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215181, "uuid": "6e95ff26-e921-4c51-b72a-e64b48f3308b", "comment": "Malware payload (AgentTesla)", "value": "61112d94cef0ba979abbb5a670279b80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215181, "uuid": "e46cb7ae-9f36-459e-b9c5-8fdcb307f341", "comment": "Malware payload (AgentTesla)", "value": "586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215181, "uuid": "3b92a8f0-7378-460b-9b27-ab7cb7cba2b4", "comment": "Malware payload (AgentTesla)", "value": "a851759d44439fb99f73b31ac63d4f610c8b5ebb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215181, "uuid": "7ac2cfa7-f627-41e1-bb36-4e66b1fac658", "comment": "Malware payload (AgentTesla)", "value": "fdeb737e3f6e7c8027e3fcaa57796af9ff63b102623623fc37645bb37975f59d4ab948842165a25fbef7b6a8fd03ac0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215181, "uuid": "3889c031-bb50-4f0b-9939-e0993f59b79f", "value": "7DC4BEE595889701D92B57F60D12DB2033EFBE2ECA67C4097EDBF2CD4956A834923603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215181, "uuid": "d41cd1d6-26b0-4e43-a5ad-63c3177ce7a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215181, "uuid": "b17f46a9-f52d-4006-b916-d69b978b758f", "value": "12288:CCJxxBny1ArqoJV0AfqGC/kfP6I5uDvjFfo7F1ixlrLC7lf+x:CCH0at3u9e6rLC7lf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215181, "uuid": "041115ed-a945-4797-8bf8-72893f496c8b", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215181, "uuid": "f9cd7c4f-23e8-4c79-9723-4f2e34879381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215181, "uuid": "ce904666-7bf8-4823-8aab-4968a708fee5", "value": "61112d94cef0ba979abbb5a670279b80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8540bb64-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223740, "uuid": "4eb8a33c-209b-467f-aa8c-821b306540f5", "comment": "Malware payload (Dridex)", "value": "63e72f32d65b751dcace7b8d92deb1e5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223740, "uuid": "cc9761a3-6e55-490d-9114-6ad8d0e6c731", "comment": "Malware payload (Dridex)", "value": "5874e7cb3392c7b8357b10370ebceb9ca210c590c24e22156623d7fe04ed3495", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223740, "uuid": "2a79c828-4201-4102-b468-78e546cd4fdb", "comment": "Malware payload (Dridex)", "value": "b04aaa76f905f2664b04e45fb7d5a1271745849d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223740, "uuid": "4f79a91c-bd36-4b1d-b3ef-679e9814abc0", "comment": "Malware payload (Dridex)", "value": "6f2e6ad359c368c3d146687ab2dee898f379dce7ca74db78b3aef00065e27a9cba7c84487a0e6b97c880576e3f340aeb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223740, "uuid": "df31ff79-63e1-4cf3-8d7f-844d82cb4ed0", "value": "D4248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223740, "uuid": "b2e734b0-3a1e-4791-8014-db9c096a287e", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223740, "uuid": "23c0e131-243d-4d98-9465-ec157c68580f", "value": "3072:i6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ioMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223740, "uuid": "be02fa74-5ff0-479a-a9c0-5ad364cb6a02", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223740, "uuid": "85832bfe-0e53-4bd8-9845-d043125dedbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223740, "uuid": "7380c76b-cea3-4328-910d-011895ad5ffa", "value": "5874e7cb3392c7b8357b10370ebceb9ca210c590c24e22156623d7fe04ed3495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb44d4fe-923b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617207188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207188, "uuid": "78bfd172-8994-40c8-ac45-d4508d455ba5", "comment": "Malware payload (IcedID)", "value": "b24a730b2681c703f28986cdc17316d1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207188, "uuid": "b5e3651a-0f4e-494c-ad21-d0a29b72958f", "comment": "Malware payload (IcedID)", "value": "58802a20888a8e4553602a2ce4df4d2839f718d79f5af1ec52dd0e9f5800a96e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207188, "uuid": "4199c13d-ae0e-4bc9-88a5-eaef97ce83e6", "comment": "Malware payload (IcedID)", "value": "fe2dd17db39b576589faa1b976340ab6447bc723", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207188, "uuid": "96f01513-610b-402b-9062-83304da2eacb", "comment": "Malware payload (IcedID)", "value": "19a4b1d8a7cc48a7c67fbfc01abfae5bd7e717f710d96e936dc9ef56c037b471178deaab14d7239ff93ca2fb0cb3bc70", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207188, "uuid": "f8ff13c2-c493-449d-81f1-41f459cb7607", "value": "59B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207188, "uuid": "10348440-652e-4259-8015-13842314637d", "value": "3072:o2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:oqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207188, "uuid": "93241e8d-9c12-411f-a455-d4eb1e815145", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207188, "uuid": "2da32632-3989-4e1c-b829-2bfc53137cd3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207188, "uuid": "53344e10-beb0-40e6-934e-d027a692fb1e", "value": "document-1926199244.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77203629-91ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160151, "uuid": "488cc115-d106-4ff9-b795-ee822d5939b8", "comment": "Malware payload (IcedID)", "value": "7880ea3e00033dbabd7c8c52504dc986", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160151, "uuid": "758bd82c-8399-48a3-8d5f-eb3fb3ac0e06", "comment": "Malware payload (IcedID)", "value": "58a66254c13d29dfa0bcfb223d650ca86cc69f7830fbf8dc96d9f2ccf248b1a0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160151, "uuid": "12480eec-045b-4b9c-976a-305f2202c7e1", "comment": "Malware payload (IcedID)", "value": "43c37b01ad3d1ef7f1e5eb37558bd17d06f38c89", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160151, "uuid": "98491acf-4057-45d5-81d0-3ac5b41ad222", "comment": "Malware payload (IcedID)", "value": "9b948ec9f48f235937295660e73b89e74f98b792c0fc3deb9ff0767d05cd4885757c1ce26ad3b795bc4458a804f5df19", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160151, "uuid": "0777c1e4-8253-4767-9dcf-6e8410bf380b", "value": "ECB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160151, "uuid": "17d17d64-4d12-4703-a6f4-7d402efdd4df", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160151, "uuid": "488bc6f0-20fc-4b74-91ee-e3ae397ac56d", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160151, "uuid": "e19903db-ec03-48b2-b726-bbac2acaaffd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160151, "uuid": "99e8d2e6-9c96-4456-87df-b410d721f197", "value": "document-1290227566.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abed5f1-9248-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617212529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212529, "uuid": "f9478d8e-48ff-4bd7-b662-e5628005f8f9", "comment": "Malware payload (IcedID)", "value": "96b04b5429bcd658cb9ccff1e6f07ef7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212529, "uuid": "94119686-464c-4c44-9de8-4f4e451af9f9", "comment": "Malware payload (IcedID)", "value": "58bc58f6ef2de14b82c7cb16ed749afe520728c1177ee31d8601dd2363a82c8d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212529, "uuid": "5443fa38-fb54-4643-838e-01592d7622e7", "comment": "Malware payload (IcedID)", "value": "3dc56a28380cdd219005d5462c8aaaac7c45c025", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212529, "uuid": "80434072-11c4-4e64-ad04-bc0123842bd5", "comment": "Malware payload (IcedID)", "value": "bbd41402b229d124f661e31bcf23bffbffc7782806c1627e2f653ba6d2e8175260ae69d97471f4a0f8585033b4477b60", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212529, "uuid": "4d957f64-8588-4d47-a3ea-9927e39aa505", "value": "F9B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212529, "uuid": "36a1caf6-b28e-41c0-a3a0-4ee9657f4fc2", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212529, "uuid": "faedbc5b-d374-436a-bdf7-66d72c616f4e", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212529, "uuid": "678de85b-ada8-4e31-848f-6c4e0934fd95", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212529, "uuid": "74c5d091-beff-44f4-97d0-83e741829d7c", "value": "document-1680135502.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e7ba4e-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212970, "uuid": "92d6203f-a7d2-468d-9d87-a0444fce4a3a", "comment": "Malware payload (Dridex)", "value": "753d5c401db65034a77eda3dd3701c21", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212970, "uuid": "0f23487a-c6ee-4a81-bd0b-eb2b55c9bd4f", "comment": "Malware payload (Dridex)", "value": "58ca830e12d69c2ebcb721dada1ffa2f57b35fea27c9ac881218e2a1863c4e57", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212970, "uuid": "3317d848-e124-42d5-98fc-ea96a4c5c0ae", "comment": "Malware payload (Dridex)", "value": "00c978a08dd3a45222736a6bc23ae2a04ae5132e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212970, "uuid": "c88fc895-4bcd-4e43-b4bd-865d350fe62e", "comment": "Malware payload (Dridex)", "value": "f85f6f0b05806327c005d67708d346797c9c6d7da9581d04bd138c711606d7e1de90395f8e6d5f79a7daf6c97437abb2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212970, "uuid": "7389ef51-2c31-4899-93cb-67d14729f9eb", "value": "36248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212970, "uuid": "e38c7ff1-831f-4dda-b4fc-2817133e414d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212970, "uuid": "2608e570-49b6-4d43-8313-cf50e6b3e4d7", "value": "3072:y6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:yoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212970, "uuid": "513ac6c5-867f-4e3a-ac00-034521c89b5a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212970, "uuid": "8cc38d70-1a86-4a9f-be1a-42f46dfd60ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212970, "uuid": "0a39862f-dd90-45f9-bb7c-a591305b4525", "value": "58ca830e12d69c2ebcb721dada1ffa2f57b35fea27c9ac881218e2a1863c4e57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c124588-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217738, "uuid": "d67a7072-cade-441b-bf9a-5aa69ae3cc77", "comment": "Malware payload (Dridex)", "value": "6accfbb80851ba763084981a20d7d867", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217738, "uuid": "a2abeaea-0723-4080-b0a3-0c033a67e66e", "comment": "Malware payload (Dridex)", "value": "5991c731fa3b8f2290a6ff4f3804a27b65d5576949bcbd3635df5fb1d9fedb95", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217738, "uuid": "75e916bf-94df-4321-9984-2807db78981a", "comment": "Malware payload (Dridex)", "value": "6b8802f834066dab4db784c0f4b3dcf3acc02d6b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217738, "uuid": "48f2443e-5a07-49f1-9768-eb15fefb819e", "comment": "Malware payload (Dridex)", "value": "b8689322140d15fe2386f4e5597704517f3d357856ea62d9b0932c6fe4afe9a11711c4bd4ec92cf8e295182056680416", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217738, "uuid": "81004347-869c-48d1-a4c9-3f8dbb30a4fa", "value": "6A14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217738, "uuid": "18c5307d-57d6-4534-9d33-e123a88d1d2b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217738, "uuid": "855bae23-e396-4134-bcb7-2cf58886404c", "value": "3072:Nopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:CpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217738, "uuid": "18f7d1fe-716e-47e3-a493-514d7b332a8d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217738, "uuid": "5db273c0-4398-4dc4-bba3-9834ab9f5ec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217738, "uuid": "50ba6d35-005f-4b5c-a688-a1efef0b62ec", "value": "5991c731fa3b8f2290a6ff4f3804a27b65d5576949bcbd3635df5fb1d9fedb95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d68763-926e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617229088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229088, "uuid": "8dd59a85-96e6-4441-beb2-f7d229f4cbc7", "comment": "Malware payload", "value": "e124480ce143c6e2fde468e2a1d8cfd1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229088, "uuid": "8132d7dc-8889-47ba-89c7-6260928b2620", "comment": "Malware payload", "value": "59a8a7a2312d5077e36f719a852b214c5583d22cf104045d4cfef222acba18e5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229088, "uuid": "92c91788-e185-4568-bc4b-424c2e2bc612", "comment": "Malware payload", "value": "38fbbca96942f680dc33bb3e3e4ad052ea586c5a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229088, "uuid": "8e69f569-9575-4e09-8f18-b7329dd23f38", "comment": "Malware payload", "value": "ab732eed189aeb709810bbfd634271178187c04475e0c90058d863ba9332d95bd6835497a3109e3d2ba69fc4d4bf2080", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229088, "uuid": "a594d78c-1c28-4766-b4fa-c3d71adcf64d", "value": "73248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229088, "uuid": "c2810ad0-2826-4560-8fb7-5e177384585a", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229088, "uuid": "8c9c1f3f-7a81-4334-81ca-f4fd4ba8b931", "value": "3072:96TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:9oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229088, "uuid": "a6ce58fa-e894-41a9-a6f1-6eb61d55acb0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229088, "uuid": "9adadbea-2669-41a6-826a-30daa30afa5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229088, "uuid": "dea7282e-158b-443c-a1df-2054bff8664b", "value": "59a8a7a2312d5077e36f719a852b214c5583d22cf104045d4cfef222acba18e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e70a7e-9265-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617224806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224806, "uuid": "37f6afe0-a316-4437-b963-ed1c9eff39da", "comment": "Malware payload", "value": "5a0425bfbeae52df2de40d7c067b9b0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224806, "uuid": "881ce266-75fb-44fa-8983-9cb909446f9e", "comment": "Malware payload", "value": "59eec971cce51e24be4612177f661563dc41a4274eb38731f2612d5528adbcc6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224806, "uuid": "88a66ae6-a0f4-4eeb-ae0c-ee4ff5e6f87c", "comment": "Malware payload", "value": "672d427f85a3494abeb3694694095660b556569f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224806, "uuid": "f315823c-5d34-4e51-ac34-485d2b19b5c6", "comment": "Malware payload", "value": "11d02ed48080e29c32c84dcabc35493b3cd9a13ec1ec610477fd4b6ee319f687ea5267e261496b697a3985cde6e97684", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224806, "uuid": "2de728d0-049e-46d3-b57d-dc35c81a6f1c", "value": "C105BF2BB3D52FDAD99D4EBEC91718D183E7D85F9333F2A739F018D50482680662E249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224806, "uuid": "858f7a22-6b25-4226-b4b6-05ae8d6b43a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224806, "uuid": "94cabd27-8197-4fc8-aca2-20dd8d744999", "value": "12288:17LDDLyannvyx6yQOpkrgCVTbaakxaM9qBxaM9q9otNL6bVrJ:UannQKHTsxF9SxF9b6hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224806, "uuid": "62bce1c2-42b7-48b2-baa3-a495aea950e4", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224806, "uuid": "1cb4419c-dd3f-498f-9910-7e77646813d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224806, "uuid": "df5f815c-abb7-49fb-8fc0-17c4f849450b", "value": "soc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8418aa-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213208, "uuid": "00823157-4609-4347-8d87-911af2606b72", "comment": "Malware payload (Dridex)", "value": "d60912b54a809e60ffc408ab20f7d7fd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213208, "uuid": "8fec4915-0396-4038-8e83-a92cd44f58bb", "comment": "Malware payload (Dridex)", "value": "5a14e8005d0e79f2d6c9e635e5abfc8516ea49f8561ddb84eabbb2652e58d526", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213208, "uuid": "b3ca69da-fb5d-46ef-9379-58ddb769e628", "comment": "Malware payload (Dridex)", "value": "e8486a99ffda554bb7291013cc156352d3175d2d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213208, "uuid": "e03821c6-88c1-4890-ae06-e3226919eede", "comment": "Malware payload (Dridex)", "value": "f8aff28dd92431d1c918078f9ec2bab23c82cdc591369b3b75979f5a5c41e43c3ba93db33b2882029ab03aa50e8a3658", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213208, "uuid": "ee4dfd76-913b-4653-a58c-326bd9807fea", "value": "99248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213208, "uuid": "fce8eafe-cc84-4f1e-a0db-99cbfa426e1f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213208, "uuid": "733b61e5-d22d-4916-ab51-aa6d6c7f3444", "value": "3072:86TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:8oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213208, "uuid": "1a95d9db-b7f1-4170-91d8-ba3913ed828d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213208, "uuid": "277afad8-3754-4b37-9bd0-e91130d3fa50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213208, "uuid": "3eed4972-4449-4d15-9d53-0eea3977bf26", "value": "5a14e8005d0e79f2d6c9e635e5abfc8516ea49f8561ddb84eabbb2652e58d526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da1235e-9240-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209017, "uuid": "2be577a3-1185-4b69-a9cb-09bf7ecba99a", "comment": "Malware payload (IcedID)", "value": "087993b8f9dc8fc0f35be642283a05f8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209017, "uuid": "f0b820d2-8652-416e-accc-08b4b76e02a3", "comment": "Malware payload (IcedID)", "value": "5a1c4e4f33ba47a12b927e8245519bc9546b02ad130764a3f629b70e543b5a8e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209017, "uuid": "58f12570-830a-4b10-b4d8-dbcdc150bf5d", "comment": "Malware payload (IcedID)", "value": "29bd444380fcd7d71cab4d811a3cbcd3d2b73604", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209017, "uuid": "748237a7-77d2-48e8-af78-24659941cb8d", "comment": "Malware payload (IcedID)", "value": "a722f68c01e530bc8cd57e1f78c4e5a29c7f2d42cadde1232dca7218fc447cc128c5022a593607877de0da4a2a5cebac", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209017, "uuid": "db2e61fd-5dae-4ce9-954e-7cec01220238", "value": "53B3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209017, "uuid": "1df29844-fe1b-42c7-86c4-b63e7fb41709", "value": "3072:O2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:OqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209017, "uuid": "56934682-cb0a-408d-a9a1-e4d8be2a06fe", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209017, "uuid": "40b1fbbf-4ff8-41d3-bfdf-da0b5dd8bc2d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209017, "uuid": "c21a774f-625e-4f55-bc24-673df374244c", "value": "document-73813844.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a781a4-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232487, "uuid": "73df3952-c504-4f68-a264-b65661268ad6", "comment": "Malware payload", "value": "8491d7b3a14bd5cab70fa904ac23e5d3", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232487, "uuid": "b2449567-53ab-4c92-9073-9725e642a98e", "comment": "Malware payload", "value": "5a9831ee9d7d4cabc3964066ad327f549a032d0945a74f639569b5be3e8af011", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232487, "uuid": "8814f0d2-e65d-4b86-87f2-f83cdd258da3", "comment": "Malware payload", "value": "fe558eff1ec7b83307782f2ab94ea19cda43577b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232487, "uuid": "6e607a37-ef84-46ea-a5c3-42e137ca8d73", "comment": "Malware payload", "value": "aad933c2a0f2512d232ce4df750fb90ab48f8d0ace16b272fcc35e1ecd53496c142a89b72616ec5d39bbefbda80b90d0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232487, "uuid": "d0262d40-2328-4f6f-bd8a-1c9510141e07", "value": "3814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232487, "uuid": "cc6ee716-3ec9-4874-8d5b-33da14b7232d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232487, "uuid": "00631754-48ab-4632-8521-8966bb3c6c72", "value": "3072:7opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:MpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232487, "uuid": "26054e1a-45e1-4228-b203-9b6305e97eb8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232487, "uuid": "a7853a89-a8b0-48e2-ad34-28d7a46d0a03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232487, "uuid": "da1fd938-bd92-4097-928e-e2989abfac2e", "value": "5a9831ee9d7d4cabc3964066ad327f549a032d0945a74f639569b5be3e8af011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2056c389-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204673, "uuid": "93f5c7cd-6b67-4f56-b468-ada29d5a17de", "comment": "Malware payload (IcedID)", "value": "719f88bfa436811e803a38fd29fbc357", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204673, "uuid": "2518cae9-92c2-49ec-9523-97e56d3ced56", "comment": "Malware payload (IcedID)", "value": "5ac9be8ebedcd597ea3bd9754dc2625d850fcd7dc0c596b2cb2e923cd8bb4725", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204673, "uuid": "e2cff631-a883-49c0-83f7-5d8c0d8f5ed8", "comment": "Malware payload (IcedID)", "value": "ba98da97712b2d93d567fa8a9ae54106c9e8891d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204673, "uuid": "54dbf1b1-ecf8-4c6c-b3f4-508658e9a11e", "comment": "Malware payload (IcedID)", "value": "341dc6fe89b242a556e771c12b0008971799d376e7da002dd5b78aaa110c1742925d2fcc59f79928bc4158fe2be38da1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204673, "uuid": "ac55f565-fc67-480f-b821-c49b72591999", "value": "68B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204673, "uuid": "20e9c034-f7bf-4180-82fc-f6f06e72319c", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204673, "uuid": "b609367b-a55f-4069-939e-c4ad5ed637a2", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204673, "uuid": "12f9580b-4f8f-4254-9952-c336ecc3aaf2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204673, "uuid": "4708bb92-921c-43c9-9bce-7737200ddf4a", "value": "document-392825070.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1d901f-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217851, "uuid": "dcf8655f-9a73-4af2-be71-acfe295052a7", "comment": "Malware payload (Dridex)", "value": "f24ecc235f7831b555a77538b1a176e8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217851, "uuid": "94ca9f5f-11df-4e2c-80be-225be809a45f", "comment": "Malware payload (Dridex)", "value": "5ad8cb0d89e4ddb54457e6ce9871c07085e8c1b7c7c784e23fb251cb61c1870f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217851, "uuid": "1caed008-f11f-4c54-b847-29ba8678c7bf", "comment": "Malware payload (Dridex)", "value": "4f74a7b17f2b3d4064bf4f060ce770797bb31c5b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217851, "uuid": "a8189964-33e7-48af-826c-8d8a8d46e08a", "comment": "Malware payload (Dridex)", "value": "af48de84c16e00c674735e2d48fb74bfd01f62250346c47e41c299aab5619bcbc914ef2419a9ba632960808e58aad8eb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217851, "uuid": "51f85386-f6d6-49f3-b741-92d59f78e66b", "value": "D514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217851, "uuid": "ac955f89-c3e5-4d23-a3b4-5188e6d4c4de", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217851, "uuid": "0a32a6e8-e7e1-4b76-8633-2d2a4d9fef76", "value": "3072:fopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:wpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217851, "uuid": "a44f9aa8-510f-4910-a1aa-2e0ac7145075", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217851, "uuid": "f7610ee4-d193-4c68-849c-c8b76ecc8352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217851, "uuid": "cb36a1eb-d3f1-4a05-8692-69da7cae64a4", "value": "5ad8cb0d89e4ddb54457e6ce9871c07085e8c1b7c7c784e23fb251cb61c1870f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d8ddd2-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232217, "uuid": "4882b751-9f07-49ff-815b-1da574f30484", "comment": "Malware payload", "value": "523e5d8ab26a081a196bdd0acbb9b469", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232217, "uuid": "b1543f37-585b-44f7-b6c5-ea64f57d28cd", "comment": "Malware payload", "value": "5aed316101a506a845a383481d07a0257a09ce04585dfe64293ca6935061887d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232217, "uuid": "24708197-953a-4ee0-a967-3b816a79f3c1", "comment": "Malware payload", "value": "74fc5090173c0690e7b39d6e53f259c01fb41bdd", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232217, "uuid": "73097fec-8f72-4f2b-a367-c624b6c69ad2", "comment": "Malware payload", "value": "faa5410f3e8a6453290c4a89a8b07d52cd894aedb30b7cd3f17bdda0137c491bd1fc2c254b6b9736a3244f74bb74a061", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232217, "uuid": "3eb2e2b8-d627-4e1e-9c3f-556c49af985d", "value": "5414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232217, "uuid": "e7f24304-d2b5-42c5-a8b7-1b981ba36ff2", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232217, "uuid": "8c475800-c578-4b8c-a4fd-78b246b3c1eb", "value": "3072:Jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:OpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232217, "uuid": "e9dd2693-dddb-4964-82c5-1c4396f2ebde", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232217, "uuid": "3d5c4cee-6edb-4518-bb3c-2c1fe504ff17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232217, "uuid": "d9c19852-e781-4050-9b27-a25ce7a44045", "value": "5aed316101a506a845a383481d07a0257a09ce04585dfe64293ca6935061887d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec93d0c9-91ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (ModiLoader)", "timestamp": 1617173662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173662, "uuid": "f309e75b-7170-4545-a951-3b50a4890a7b", "comment": "Malware payload (ModiLoader)", "value": "3eba8fba658ae9221440286524124fb3", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173662, "uuid": "ae18f2c3-df01-45eb-939c-32d1944ac5da", "comment": "Malware payload (ModiLoader)", "value": "5aefb7a2d5e2c777f0da2144e44a6cfa9549ff8e5046bfb806a879f66e353f03", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173662, "uuid": "4b706188-4877-438e-9caf-f922f9214b76", "comment": "Malware payload (ModiLoader)", "value": "134d03653443466466e8d155c2d56aad116a119a", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173662, "uuid": "9c7dc81a-a8d6-47b1-b809-7a23748777e0", "comment": "Malware payload (ModiLoader)", "value": "a0689c232ea8cc19bfe3b5a6c811391846c4bdd0195c565100c70d3ac43ce89a678c597f07c7438cdde0c112d60256f6", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173662, "uuid": "c56af56b-6095-4539-9490-17bdf22fd26f", "value": "908423BF0F2644DBF6263A750C75CF055CFF642104E97EE3F5812A5AB0DB48228E9254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173662, "uuid": "afb6f538-5aea-4665-8153-a250b6c1eaf1", "value": "6144:Tk+x6xTl8A4L+bfts8t+DC1cGLm4prBje15DHM/3A3nE7+xOpjQ707n9:TBcxh8HKC8t+xGLFpB611s/t+xOpe0b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173662, "uuid": "5788205a-4c64-40c7-9778-b388a7eaba87", "value": 371475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173662, "uuid": "27aaad9b-d4ae-4025-90ce-ba55affc694e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173662, "uuid": "13aca139-0c70-4d9e-a2f1-65e50c06db9a", "value": "Lista de nuevos pedidos.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867f0b4c-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213005, "uuid": "bd685227-eb95-4cff-887e-82e27e0d74e2", "comment": "Malware payload (Dridex)", "value": "7190f8d268c9801815ebeceda520b82a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213005, "uuid": "7bd4198f-ec68-4c1b-856f-ef6e3a17fc57", "comment": "Malware payload (Dridex)", "value": "5af231a51d50ba38a67c438bc5b68340c0f266974c0349dfbe4b17cf21850882", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213005, "uuid": "42a93345-df12-42f8-abd1-45263935a3db", "comment": "Malware payload (Dridex)", "value": "983f4f9f1a4af8a645b2ed380c67c440b9a9ade4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213005, "uuid": "5c97661c-b5c3-47f0-a97a-10c2d4827e46", "comment": "Malware payload (Dridex)", "value": "61bb5034ecaa4c542b89365f1fde297a28d215e6bdccf51908f47690be42d020fad3d1338ba5c67d93bee7514e0a5768", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213005, "uuid": "88965a31-f62f-4b35-b474-3bca5bf3fbca", "value": "AE248C5FE339E486FEE3CAF44186A72296A39C92436F580DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213005, "uuid": "9ceb12ac-b68f-4c4f-9182-bb763c23d40d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213005, "uuid": "09f03e4c-c2fe-4537-9b25-b0180a4e06a5", "value": "3072:Z6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ZoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213005, "uuid": "52a5280a-ba42-4a10-b6d3-7dc54b91868a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213005, "uuid": "18b656ce-b66d-4c0a-91e8-224a5ffc390f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213005, "uuid": "0c36a32c-4e2b-4d70-b15b-88be349078a7", "value": "5af231a51d50ba38a67c438bc5b68340c0f266974c0349dfbe4b17cf21850882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846d61bf-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232329, "uuid": "cad3ef7c-bdee-40ce-9c53-73e2cef1e1a2", "comment": "Malware payload", "value": "333829efb51fb21ba62e37d0db5b9525", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232329, "uuid": "36b87e5a-f0aa-4650-b1c6-75fd98a431dc", "comment": "Malware payload", "value": "5bea4e716600163b82ca951c15a3bf014dd55483e8aa323546b51d52b27ec9d3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232329, "uuid": "1a48fc45-888f-416a-b0ca-57e3df897e24", "comment": "Malware payload", "value": "acd5f0df5247c49accf1f671ed6469c4db8b553a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232329, "uuid": "d7b2979c-0723-4167-b49d-3d99122e6945", "comment": "Malware payload", "value": "6cd10058f7e8ec5ae81f937530cdfe5384b463680c3016a4b138f64f7c44b44e08ad0faa28bfb2c3c6990770829dfce3", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232329, "uuid": "353b01cc-31f7-47e6-8266-26bdde9863f4", "value": "3414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232329, "uuid": "2892cf7b-7b0b-44bc-9827-0ba2cd0daa65", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232329, "uuid": "5666d86e-bfa7-4ad6-867a-db856e1291d7", "value": "3072:8opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:DpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232329, "uuid": "807195b4-1dd2-496e-b8e4-ef5ffe9be643", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232329, "uuid": "74cd504e-15bc-4b63-9155-39fe3b56d305", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232329, "uuid": "3ea8e410-165e-48bc-a209-1492f68f27c8", "value": "5bea4e716600163b82ca951c15a3bf014dd55483e8aa323546b51d52b27ec9d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c2c8e1-9268-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226269, "uuid": "5c653628-3711-4dd7-8663-d1307b3fd0f2", "comment": "Malware payload", "value": "626b20331216983e642006250c309711", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226269, "uuid": "7cdab9bf-e5af-4c62-853d-025606cfe417", "comment": "Malware payload", "value": "5cd68ad7fff633d998a1b2c03d47e37e64c8e35791ac733b2f67709c5476203b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226269, "uuid": "5bd8bf44-c24e-40b9-ac15-da4aadbe8249", "comment": "Malware payload", "value": "322acda90b9e135fde871e82c8e4dfd18014834a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226269, "uuid": "85293b35-34e2-47c4-b320-d05e221bad2c", "comment": "Malware payload", "value": "529e7d6dbc49ee8bee9815457551054fd6321f0d6c0ce5365e326ac03cd74af7b8732b7ac0665b5da6357714f46e507e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226269, "uuid": "74ba464d-f79e-4fd9-be72-51c47280e31e", "value": "B6248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226269, "uuid": "d2c1178b-dd41-4287-9237-bb3cd69a233c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226269, "uuid": "d1ca2d62-a44d-424b-ae64-ff25e436bad0", "value": "3072:E6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:EoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226269, "uuid": "09e40c40-5f04-4f13-b58a-fe6ffa0f296b", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226269, "uuid": "f69d20a2-794a-471f-b0bb-610daefb81ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226269, "uuid": "bbb0cd92-7a5a-4c57-acba-2d63656b9a12", "value": "5cd68ad7fff633d998a1b2c03d47e37e64c8e35791ac733b2f67709c5476203b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4899e3cd-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617213330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213330, "uuid": "164b6121-dd7b-4307-96ca-532c6c078387", "comment": "Malware payload (IcedID)", "value": "2cfde2cecf6e15dcacb1692cc265ff75", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213330, "uuid": "bcebc332-c06b-431c-8052-b1305fd874ba", "comment": "Malware payload (IcedID)", "value": "5cf2cca8c3db109cfc9182debb5a9176d70e059732cbc24096285303564c4fea", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213330, "uuid": "c4d69279-cae6-4b00-8bfd-f180e588ec14", "comment": "Malware payload (IcedID)", "value": "36932b14537705a285fee658bd047e8e1b8f5b02", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213330, "uuid": "601a9aca-84c6-4b24-96a9-dd595613b06c", "comment": "Malware payload (IcedID)", "value": "8f3192c0f3186ac4d094ad08e7be7c30f6638fb373e85a6d5d9a39e0878fbf06cdf479039d0da8d7e2bbc959ce9a0806", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213330, "uuid": "fece9b39-e759-4f98-ac43-0e6cc127196b", "value": "05B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213330, "uuid": "6effb464-c56e-4a2b-a2d3-b9d73b8d9fde", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213330, "uuid": "72c0c5f1-7b1b-443e-9567-d3e1ab983028", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213330, "uuid": "33dfdba0-f042-481d-a90b-d25600978b31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213330, "uuid": "43af2d26-c887-43c8-aaff-d990bb2f5c33", "value": "document-1830713810.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bd5600-926a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617227120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227120, "uuid": "5d205040-da32-430a-93e2-a15946769f25", "comment": "Malware payload", "value": "21936261998324d0edd4be69c972ee37", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227120, "uuid": "87184243-5412-41e3-9004-4d8dd67b03d7", "comment": "Malware payload", "value": "5d1ff8d7a2316a63909a0bf56996e2a2f93834d0db469c0a252b913c5f413d89", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227120, "uuid": "ad39e8f7-241d-4cea-b713-22ef414f1c54", "comment": "Malware payload", "value": "912081a97fa1faeef6d1b2097f4a0adcd8375b8a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227120, "uuid": "919b7f15-3e53-47de-a5af-f8bacb18f09d", "comment": "Malware payload", "value": "66450e77021235be1bfbd4ec73c1c1caa026d67b5e001039d68c1ad45b6ba2455bcb338e76f63d85c6d96120dec61a09", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227120, "uuid": "a62b0671-43c5-4f55-9c09-45bfab90c2c3", "value": "04248C5FE339E486FAE3CAF44186A72296A39C92476F680DA0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227120, "uuid": "3d74e0d0-a169-4f9d-9259-e0f47c823f08", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227120, "uuid": "5f374c41-9e10-4a19-b96a-724e78959244", "value": "3072:Z6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ZoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617227120, "uuid": "3f754ff5-3512-4da7-ac71-75a376898421", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617227120, "uuid": "03367a8a-ddf3-498a-a441-63363ac01044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227120, "uuid": "faae50f9-f867-4be1-8905-3ecd818c6773", "value": "5d1ff8d7a2316a63909a0bf56996e2a2f93834d0db469c0a252b913c5f413d89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608815d8-9246-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617211652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211652, "uuid": "e955492f-dbf3-4e00-a765-811f779cb66b", "comment": "Malware payload (IcedID)", "value": "ba980761c328a5c8cac6cf5d2e478204", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211652, "uuid": "401569b5-158a-4109-8bcf-64cbd32eada6", "comment": "Malware payload (IcedID)", "value": "5d23025ffbcefd01f985160d61681a812a9cf118b9010bb80117fb68d11ae228", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211652, "uuid": "d79cdc77-5225-45f3-9d5f-0fb4c8da8af7", "comment": "Malware payload (IcedID)", "value": "8170e07ef1de2577775cd4f2d742a5d34cbfa075", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617211652, "uuid": "b5eadfa0-0de4-478c-be0a-c5aa76866c1f", "comment": "Malware payload (IcedID)", "value": "871f8b2ad6e96e37f7d2f49f4fff4bece9001fb562fd868656ae43d4c38c944c96b60f422b0c4611189d11599d140889", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211652, "uuid": "44a7cc74-0771-4651-9e16-e733fc2fdc47", "value": "C3B3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211652, "uuid": "72a4a1dc-89c4-4d46-8766-46a4e2210d56", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617211652, "uuid": "5e7fd7c3-dd96-46d8-a5ba-7abbfe4c4e28", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617211652, "uuid": "fe3124d1-9b5f-48af-9f0f-02850a698b33", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617211652, "uuid": "8999d7ea-f05e-448d-b6fd-bd93e5233664", "value": "document-1514757151.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3211fcd-9231-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202772, "uuid": "ff7c3520-a39b-436d-be1e-70d25b4c1abe", "comment": "Malware payload (IcedID)", "value": "246d3aa0e607756b46c9d948341e0bc9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202772, "uuid": "336f46c8-2503-4432-8595-befcb0d0021a", "comment": "Malware payload (IcedID)", "value": "5d27c74c2fc5b9e63d1f267493894126a377257aec7626e4f3b9479c4559d59b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202772, "uuid": "303851fa-db7d-45ee-9f10-dc1fc9b7ea42", "comment": "Malware payload (IcedID)", "value": "556bf67bb991af27c5e98b1dd8aefcf0cc04c40f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202772, "uuid": "fe114d13-6a2a-4140-9614-bc235d4ff349", "comment": "Malware payload (IcedID)", "value": "d59136638fc7e621a23ba7b0cc3fba917f25067b1feaca55e7fc7c903c40e1feae88dec9a7d55121535d31e098e50c3e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202772, "uuid": "a48f98e8-d524-49fc-b288-d50b1338afe5", "value": "ABB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202772, "uuid": "27f6d66d-29a5-4b17-be18-3928b6a5b556", "value": "3072:c2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:cqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202772, "uuid": "d0eee777-f8d1-4339-91e8-a1a39fcaa62e", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202772, "uuid": "284fb55f-865c-448a-8e04-eb7646f698a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202772, "uuid": "ab296def-17d8-434c-94e2-d052cd83e23c", "value": "document-977315539.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dcb05a-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158592, "uuid": "501f7285-2e85-4bf6-aad5-552937fe6d6c", "comment": "Malware payload (IcedID)", "value": "46b698f518f7895d34af273fd4f8c54f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158592, "uuid": "c20d24e9-a6c8-4e2c-90fe-35ad7dcd0c22", "comment": "Malware payload (IcedID)", "value": "5d42c4e4e8b5c97f013a4be9649a719b1858afc720166575e27ce22379ddf0c5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158592, "uuid": "ecf04fc3-a357-45da-93a1-9ce2e9437d72", "comment": "Malware payload (IcedID)", "value": "c74a7c768b95e389e35a0477b468730d16668547", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158592, "uuid": "d6c60dc4-2356-462f-a03b-d3f0c9c38469", "comment": "Malware payload (IcedID)", "value": "5aaa04120075f31ecdb68565a6b80bce5d46732c17f9a74592085d7d59f5451e9de31d1c30f10c3dc3ac56ab97473c9d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158592, "uuid": "8bef5341-bf63-43d5-8495-11036c490d6c", "value": "13B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158592, "uuid": "c816b202-c1d6-425e-8fdf-e9407fe29347", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158592, "uuid": "3a8b1c3d-b14b-42d0-b402-1a9ab19a1663", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158592, "uuid": "71cab1ed-4002-4c88-8b5e-d9d7dbc8531d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158592, "uuid": "2523f452-b1b5-4a1f-a48a-719dfcc6502a", "value": "document-273937165.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2c5032-925b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617220636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220636, "uuid": "f26edde5-ce80-4f07-bd0a-e608d3755a72", "comment": "Malware payload (RedLineStealer)", "value": "1d8fe9bd29fadaf2b999f09205980b32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220636, "uuid": "7a792e85-821d-416e-a20b-88448cbbe894", "comment": "Malware payload (RedLineStealer)", "value": "5d4a9105e1c5445baa4bf0ad0ae48b5f188be3b509d95a7323f0ac9c1dcdd3ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220636, "uuid": "b436dbc8-00b9-4274-b022-859fd4946c6e", "comment": "Malware payload (RedLineStealer)", "value": "dab457cb0c641b2dd61f217093ba567116020240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220636, "uuid": "cdf30c3d-70c9-4d1d-817e-d4aa9d3ac973", "comment": "Malware payload (RedLineStealer)", "value": "41fa3927d5a7b4f46a313d92471654f00940de30b56a497cc81c8342b5415d503983ea615b9c54481e30d4ee0c06d76e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220636, "uuid": "d7443bdd-3458-40bd-9020-5ec88d846a97", "value": "D0558203ED4CE301E9E05A3741EF2D3827E659E68673520B6F0DBDB916726469CB232D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220636, "uuid": "cb0b3bca-ddfa-49b2-8c63-ef43ae4f1918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220636, "uuid": "81ed434c-b50e-4ff2-8cf9-a79d12244f8c", "value": "12288:mIsW1cH6sL5fCuTLkFMmfe8UxBJ0Znv3E3oT+RFuQGi6vn2Sm9BIPrPH3qCrxhe2:moCH6sL5fjLBaHhvbfrnbPrPX3xsYHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617220636, "uuid": "897c55b9-0e01-40c8-967d-b4ed197b620e", "value": 1295208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617220636, "uuid": "57dea677-a38c-4c4a-836a-d2069e747408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220636, "uuid": "484b55e2-97ba-4e41-9025-4104b2a3c7b7", "value": "1d8fe9bd29fadaf2b999f09205980b32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35dabf27-9244-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617210722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210722, "uuid": "61f9f74c-7000-4c9f-9313-72cbd2dca15f", "comment": "Malware payload (IcedID)", "value": "f2d5a308639e0f6da97d8fc3daed0dfb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210722, "uuid": "046b0003-5c60-4445-a93c-8288332117a3", "comment": "Malware payload (IcedID)", "value": "5d8cd0de2bba3dc6b46cb875e0f52d3a914ca90fd56baa79517b64eff7a704be", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210722, "uuid": "b1c807ca-50ae-4b6e-9e59-c4e09136202d", "comment": "Malware payload (IcedID)", "value": "6c56da6750b36153246ef8e8969f1b604b711277", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210722, "uuid": "09022da2-d8cc-45ec-a83e-07d9fed4d329", "comment": "Malware payload (IcedID)", "value": "3c3614ed1f70a94bb8121c21ba90059ac7166a45f5b994434ee4a765e97f0fe0d207f3d51c7914f6b9587966d238a9aa", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210722, "uuid": "34372e82-1383-4e90-8066-d9a3d6c09955", "value": "5DB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210722, "uuid": "ccefef95-437c-45bd-a4ba-9e8ca94fd130", "value": "3072:s2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:sqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617210722, "uuid": "38c64c5f-cf5e-4eb9-b7a9-e6c126aca7e6", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617210722, "uuid": "112d3b18-e3c6-48ff-b493-ea89484baa4a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210722, "uuid": "3f83b258-ee55-4033-8ce1-5b4fd2586331", "value": "document-1241308638.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2fb0ea1-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216596, "uuid": "d2039a32-375e-4cdf-8258-8ca3decfc528", "comment": "Malware payload (Dridex)", "value": "49bfd75f86c0ad8693b714e72a38195a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216596, "uuid": "5e70fd60-3695-4828-95e5-74c392ccccb9", "comment": "Malware payload (Dridex)", "value": "5d9cd6e95ec9775648f5ea0e1a9619528e003f713df5f3e5c5f8bc9e05606923", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216596, "uuid": "4402b2c8-4028-431e-a041-26bad86d7a39", "comment": "Malware payload (Dridex)", "value": "1d9481cf7a26a56ddaaac24a2ec5363e94aa9319", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216596, "uuid": "aa911b9c-8974-46ee-9f87-b30821c63ba8", "comment": "Malware payload (Dridex)", "value": "ebf7acc355ff0713f381c684d5b499c71892080a3029051e3d86062bbf2ff856b7d6fd8d5875ca9f0e85ddd7be5e5dfc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216596, "uuid": "ca747ee0-bf53-423a-bb8c-c0a0dcb8d3be", "value": "B314BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216596, "uuid": "18abd5ed-bed7-40c6-8f2d-e47d3f98a0f1", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216596, "uuid": "2fa267ae-a3ad-4666-ab79-460f590c4a5e", "value": "3072:aopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:9pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216596, "uuid": "e756f255-f2d1-4342-9c07-af1b01705c18", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216596, "uuid": "4e2a0971-9d28-48b5-9102-8f7105ba0021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216596, "uuid": "2c413b9d-ba0e-450c-967c-004f994fc4b0", "value": "5d9cd6e95ec9775648f5ea0e1a9619528e003f713df5f3e5c5f8bc9e05606923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207c7f5b-91e2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617168595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617168595, "uuid": "998e3282-e3df-4ef7-a80a-201a0424307c", "comment": "Malware payload", "value": "41891284d10900c3b7af726e1191a05d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617168595, "uuid": "4280aa3b-3587-41ce-88ee-11e75ab08727", "comment": "Malware payload", "value": "5db421d962ad46e68987b56a9cc44703e31cc3b902fdaff2ea76c89b6032c49e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617168595, "uuid": "65f7cfcf-e594-4e67-8b44-8016fb4817bd", "comment": "Malware payload", "value": "bf63b17e0e5f5caf790af78e111f625fedb1120a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617168595, "uuid": "835245b6-4a22-4fa2-8712-e4bdf02ecdde", "comment": "Malware payload", "value": "6063e4f4b9338f21beb37c150c6eeaa8d510df6ded8f44d2a29258aca5f4f9e14aebbecc675c6291a85b58d7d25e22b0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617168595, "uuid": "723f4301-9590-4871-a998-4924e0b13e04", "value": "86D4236812F7C4BAAC2F5B304B00D73CCF3B8BA8652E69865AB7C64706391F19DD6845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617168595, "uuid": "0c85a018-6d24-4120-bd31-8481920887ab", "value": "12288:jRXfvSfUsbzC3IftX4VHvBjsZEevFexUu4efMb9WgU:tSMsllapniFZubMRWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617168595, "uuid": "3dfd8414-5d2e-4200-a425-b61b45f40590", "value": 610471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617168595, "uuid": "f0e6cdac-de75-4c25-92e7-1c5dc25b034f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617168595, "uuid": "a8f75b9d-2fc4-4763-b201-a5147cb1835f", "value": "PROFORMA INV PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afcc4f1-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204664, "uuid": "58d8ba42-96b8-4d28-ae1d-a9d404e8df07", "comment": "Malware payload (IcedID)", "value": "6584dd90fdb7953adfc4cb8b33148440", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204664, "uuid": "ace76496-666f-4965-9055-1756084f6797", "comment": "Malware payload (IcedID)", "value": "5de121a680d01a895a9bcaab0d6f1691111049b4528da47a5252cff34520ecaa", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204664, "uuid": "49aab2ec-9306-44c2-94ff-f0169c355397", "comment": "Malware payload (IcedID)", "value": "e40e286bdea0d80d2947217ed2716705a8a1dc1a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204664, "uuid": "14205531-2160-40be-b687-e14920fa1a6a", "comment": "Malware payload (IcedID)", "value": "e8491c1065b6ea99d5b950e0c6d1829f094d3095ff5524c583a69de32c6241918028f61b6d92f6eb7be53c339abb9463", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204664, "uuid": "89fb0a6d-8324-4a97-b4e3-36fc60e2b6c1", "value": "E2B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204664, "uuid": "534cee91-168d-47d2-9756-2a7abe186ffe", "value": "3072:w2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:wqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204664, "uuid": "7cbcbc8b-bc20-40c2-ae08-7cb6081d3abf", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204664, "uuid": "bb364749-d8ed-48eb-b758-d3b10fad2298", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204664, "uuid": "bfa726b5-42f4-441b-b485-d7b20e92e10b", "value": "document-1914952143.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b6403d-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199305, "uuid": "d1ce2f66-3c4a-43ae-9df1-fe5f945b369e", "comment": "Malware payload (IcedID)", "value": "ed4e06514805dd8a319203136c60ad22", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199305, "uuid": "d4a6e632-9a0c-4191-ae0b-d9bd8c6ab756", "comment": "Malware payload (IcedID)", "value": "5deef4bca0bd5b71060c4effbf1583f382e3e5959c734f825203b9eda9f4e301", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199305, "uuid": "d7ac75f3-c5dc-4db4-9631-f9c33dd1705d", "comment": "Malware payload (IcedID)", "value": "9a7e303997f36c2045081b37c1f22b60afd0eeec", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199305, "uuid": "32c3ad76-2d00-4891-b382-4fe18884fa50", "comment": "Malware payload (IcedID)", "value": "40c283ec11cf8951a226863ee4d8ae18fac210aea4ffd8dc178541140007d0ed4f5c929c53b137fe038dc79b74ed24b0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199305, "uuid": "0b9b7ed9-136a-4f16-ade2-3a80d9e2fe55", "value": "0BB3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199305, "uuid": "f827124d-b0ef-4a5a-94d1-9bb5d554f6ed", "value": "3072:82S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:8qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199305, "uuid": "b78ea339-27c3-45d8-a45c-5785e6705397", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199305, "uuid": "3996bb4c-3cda-4248-a11e-81701f3671f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199305, "uuid": "ffbc1593-c1ed-45c7-a7f8-d155a13bf0c2", "value": "document-1890117285.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b2af06-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217572, "uuid": "380940a9-7d42-43cf-b89a-3fda25e3f4ad", "comment": "Malware payload (Dridex)", "value": "1bd4aa5813978df9da16199a25d53769", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217572, "uuid": "42aec2e0-e6d9-4ad1-b604-811272160191", "comment": "Malware payload (Dridex)", "value": "5e14612a91efd105b261061d07adcc2ee32e7a06be4248372aa80af3293a9f3c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217572, "uuid": "2782d20a-8080-428c-b39f-32e15f819bfd", "comment": "Malware payload (Dridex)", "value": "d773a2c0cceba9d2f6f63381e51c424a45416a0c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217572, "uuid": "48c77206-182e-4c11-b8d3-2249bceb36b3", "comment": "Malware payload (Dridex)", "value": "1619d84d469244b3c25ae6c6c3dff23eea985e13716c61a6e217931c7c3b80261104f757494994d75f3ed383088749a8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217572, "uuid": "0d6a28db-4464-4109-961a-624ecd31dfd2", "value": "EB14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217572, "uuid": "65d72b14-c18c-496c-8c9c-5b9c828f8263", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217572, "uuid": "2ca73500-0733-4513-b819-112784d085a5", "value": "3072:Nopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:CpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217572, "uuid": "0de75aa8-6acc-42c6-acc4-8b14cd66d9c2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217572, "uuid": "4d9a11af-88d2-4c72-9e40-2e4327ae8e66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217572, "uuid": "f2ba067d-2e13-4182-bdf7-78b49656ee93", "value": "5e14612a91efd105b261061d07adcc2ee32e7a06be4248372aa80af3293a9f3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87963f77-91e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617171345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171345, "uuid": "ce33577f-ed72-4b49-866f-2d1c7e4f7a99", "comment": "Malware payload (AgentTesla)", "value": "ec050d074a4720bc9bb5f849776cf534", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171345, "uuid": "f1cbdb36-5b73-4894-acfc-654d10e3129e", "comment": "Malware payload (AgentTesla)", "value": "5e796a047012900a9285238560714d885b98faead457934c0c9b268108a3e563", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171345, "uuid": "31dda59c-cd79-4105-b573-8018910b08b8", "comment": "Malware payload (AgentTesla)", "value": "6a5ec298439fd3e29aba1a011b935191ba45e97b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617171345, "uuid": "9254e4da-ebdf-4a25-9d2f-3e416e29272f", "comment": "Malware payload (AgentTesla)", "value": "28f06338b9b6920e99e6d3f8654f8f5cd3eb0a8a28f416564b50f3d4be201877ecaa43bdbc78f5737822ab4bf4bb9a14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171345, "uuid": "644c7ec2-b54b-4430-8666-7c9f627e475e", "value": "9CC5330E7BC46774C33E597C64ABC41C5A6BFD4667C45D8A139EB9205A32A3232CB34E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171345, "uuid": "f9f3c680-642e-4479-a50d-b1ffe514a026", "value": "49152:wZw5in0j4L3SBkk4dLuBzV3l6AI4WJwIX4i0LJncscvpuPZqu:wu4n0qXkyu/wTxpoi0hcswuBqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617171345, "uuid": "93308481-50bf-4a64-b93b-9ed0253a117d", "value": 2664960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617171345, "uuid": "9ef791fa-8090-4303-816a-c55065149cda", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617171345, "uuid": "d64eb3e7-bfb7-4cd3-8ff5-02ff6a2d63c5", "value": "MAR30_receipt.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737a8c68-91f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617175607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175607, "uuid": "f13ff6d1-25ce-4422-81bc-75bb1cb16795", "comment": "Malware payload (Formbook)", "value": "a4a01b44d94bbafb4be073bd285fafe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175607, "uuid": "7f2785ce-cb78-487a-b5bd-bcf6a7ddbf9a", "comment": "Malware payload (Formbook)", "value": "5e7b6e81d3f73322d73bf013d67f76e211f0e539296e00a53d93585b0c167ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175607, "uuid": "d983f02a-a8ef-4b2b-9e0e-68d6e34b3ef9", "comment": "Malware payload (Formbook)", "value": "64aebdc6c7b600ae539a1759a255ec93a66e0523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175607, "uuid": "34c5ac1b-a1ed-4f43-8426-605f447f90ce", "comment": "Malware payload (Formbook)", "value": "4f5ddf4db124bedb4fea901f2b803950389caf35e28632e8077b02f84775baca44852278df8a778e21dc05de2e79c007", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175607, "uuid": "f153537e-bad3-4506-886f-2158ac1149a6", "value": "3724121A16E0847FC56B187012B5A726B279FE0A1611B61B67847FED3C0318F4B3B79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175607, "uuid": "eb580ca0-0e26-40ad-ba5c-4c0e267b385f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175607, "uuid": "5adb460c-c3b7-4845-932d-e0c5d22062d9", "value": "6144:vAP4FlJLxZxARLQCB2/u5I+JWlrSuYMowzpP3MWr:lFlJLlwU3uvWl7YJw+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617175607, "uuid": "197ee283-2a7a-4b51-9a96-848774ed69a9", "value": 221512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617175607, "uuid": "35107605-00c2-43a9-91a1-912adf360ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617175607, "uuid": "9ff2b676-5494-422c-a2d9-fb5c92bf760c", "value": "a4a01b44d94bbafb4be073bd285fafe7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59151602-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213358, "uuid": "ab733605-77bb-49cd-8c68-ade48204ef5a", "comment": "Malware payload (Dridex)", "value": "b6850a864b49fee0de21c8618b3261dc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213358, "uuid": "44f022d5-c617-48dc-9be9-05790bb3a1a4", "comment": "Malware payload (Dridex)", "value": "5e86124ce1774abd2a320675fce78d3a2d291f2ef9b4343c988559e3a5f87ca0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213358, "uuid": "514ff335-7afa-42f5-b717-c645d07fb1a8", "comment": "Malware payload (Dridex)", "value": "271852a1fccf2448f08223589b53caa72fbb5f71", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213358, "uuid": "581cf87f-c467-4c5a-b68e-34cd2bdb3caf", "comment": "Malware payload (Dridex)", "value": "a05aef107e7a7469372aef2c4239aa9c6dfcdd44f3b56154c1d0bf58eebb9a07eddfe07983f21c837af9af179f45b20b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213358, "uuid": "78ad7053-b450-4b08-acc1-38b6d21949fe", "value": "37248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213358, "uuid": "cedc8029-add5-492a-b1ef-2833d847ded0", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213358, "uuid": "73cdf508-cfe1-4410-b4f3-30e1f724eed6", "value": "3072:y6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:yoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213358, "uuid": "0e31d28c-8ad4-41d8-9ac7-aac6d9e0d731", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213358, "uuid": "33c09ca9-90fc-4ff4-966c-96c1122d47a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213358, "uuid": "9a86b824-a37e-4a17-8e8c-44dc2c4a974b", "value": "5e86124ce1774abd2a320675fce78d3a2d291f2ef9b4343c988559e3a5f87ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f6d708-926f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617229263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229263, "uuid": "3291de8f-f084-40ba-92a8-88f0e7076a95", "comment": "Malware payload (AgentTesla)", "value": "dddf96565a2934171b1479b96bc04cc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229263, "uuid": "344125f9-f5f8-4b05-b4ff-9c6da8cfcd2f", "comment": "Malware payload (AgentTesla)", "value": "5ef3c86e05749f489fa0e6ac47f42142b9215750f5764fe4d02bffde19b56f54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229263, "uuid": "962b4158-31ef-4b22-92df-c249f6e22764", "comment": "Malware payload (AgentTesla)", "value": "56afc1e47ebcca7a42ef9aff258bc273829068bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229263, "uuid": "b13dc662-6884-4b5e-95ba-173e174cb2f9", "comment": "Malware payload (AgentTesla)", "value": "5053eeb837922139ee64862957bc69e4d4a57a3fdc305bd471c5839cda3c56ea557094eb7ff2ccb0c269fb08f4ffe2a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229263, "uuid": "dffca11c-14e4-40b7-ae0f-e245b4b5f8d5", "value": "2523CAE849A915F7ED6DF9349B81A00EA631EC3725048AAB51C782C3C5D2B933DD007F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229263, "uuid": "c1f8d3b4-e6d9-490d-bc91-70e4a0ba19b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229263, "uuid": "be4af094-86f4-48ce-bd0f-23f71e14f7cb", "value": "768:gPlhNDfJrP4gYyApArbGflKGflvx/FIwJGun51WGflvx/FIwJGun2XozhAb:gPlhNTKgYv+hX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229263, "uuid": "882fc3d9-aecb-4310-a6bf-69d3e8bd7a3c", "value": 47904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229263, "uuid": "47b7a3ca-548d-41ee-84b7-aa228c70fdc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229263, "uuid": "093f4a25-7c96-42b6-98a7-1d59de8ea284", "value": "0987500000000000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29162d18-923d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617207694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207694, "uuid": "14a90fe0-032c-4901-80a6-f6c8447570c4", "comment": "Malware payload (Dridex)", "value": "6c956f9cf93e91baff2f08bd72b735f0", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207694, "uuid": "66b819f9-7ffd-42dd-acdb-43aede5b6542", "comment": "Malware payload (Dridex)", "value": "5f21e05769f21a0664fa7a630c02b8a82a3fbd80bc36ade66838005f52ba38da", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207694, "uuid": "beb0ee1b-ca39-431c-826d-009437c7b3aa", "comment": "Malware payload (Dridex)", "value": "6c9c1a2ca0f3c328023d7f4320712bc8badf1f75", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207694, "uuid": "50555d4d-6dd1-4b72-ad68-c629eb6be190", "comment": "Malware payload (Dridex)", "value": "0786a9385710f4fc7d65a63d178635e09b34e47c1022e73f37d3b9b7b0df956e0dfc36267745bfd5b650b5b9bd63727d", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207694, "uuid": "24084a20-935d-44b9-a82d-2f82b9a9a1f6", "value": "9E84DF42EAD54431EB726F3808738B514BEF79D18E308CABA29C205D1F676D0567CB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207694, "uuid": "b2208e15-5736-467a-a2c4-765ac70a1404", "value": "f80d389dfa6eb310b9592775bddbb2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207694, "uuid": "77405953-8509-45b6-b374-6ad64e8f2556", "value": "6144:0Cyzi1Gu+B0VlPM+iHlDx7YVUggVSkMObhe+UqN2oCh5pGiN+zT:DYi106/iHlDx7YG7RTIZQFi5pJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207694, "uuid": "490794c3-e7f8-4fd3-8785-84350ee4eda7", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207694, "uuid": "d93d7e10-3c46-4d20-bc15-0474e9653e55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207694, "uuid": "e2415566-caca-4da5-97da-9dd300167ed4", "value": "5f21e05769f21a0664fa7a630c02b8a82a3fbd80bc36ade66838005f52ba38da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0d2e6a-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617174119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174119, "uuid": "ee0b6eac-0356-456f-a940-92cd00abe914", "comment": "Malware payload (Formbook)", "value": "56ae942ed65be90b2dc9b50afbe738b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174119, "uuid": "bff8c817-3f86-429b-8c51-3e5e1b9ed413", "comment": "Malware payload (Formbook)", "value": "5f31b8fc53f4628aa678d164b995732bea8affd218185d69f1ad86e65bb7757a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174119, "uuid": "0434d862-4db2-4cdf-b08d-cbd4b4a8b025", "comment": "Malware payload (Formbook)", "value": "c9587c8d495c30ac67585000c790c660f0b7eaeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174119, "uuid": "5b4e0e39-be7a-4946-8ef3-5c557173bc03", "comment": "Malware payload (Formbook)", "value": "d0ce114f763783894f6dbec58709719be236d5c73d7ff85e237478b2f694b600f09d06d03b0e6ebdd5f7673a2cf02543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174119, "uuid": "4a6717c5-45a5-46b1-9919-40af0108e1e6", "value": "7E05BF823141DCD9E40329F6586ED5601168EEDE8127CB0D2746FF2B64E774A2CEB78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174119, "uuid": "8f35b191-96fd-48d5-82be-4c2bd63667e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174119, "uuid": "7c6151c6-85b6-4304-8d6c-bfbe954dd97c", "value": "12288:c8+ku1B6oRHR6ddl91vJ0BmRhZhtshtdnEhYcwzu9FXSiyyjK:3+kkcoRH4R1vJ0YRXhts1VyFd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174119, "uuid": "ad1c1c67-b718-42e2-8754-06ddb662365d", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174119, "uuid": "9d4c3675-2a70-4a4b-8842-5014f0df7a29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174119, "uuid": "5d6bc3f4-aa67-4f91-b7cd-9bfeacc21bb4", "value": "Quotation.zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6da71e-91c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157021, "uuid": "c5deffb0-71bd-4ed2-9057-497e997c5438", "comment": "Malware payload (IcedID)", "value": "09f556491fa9468d939e02c0fc24191e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157021, "uuid": "0e795b22-8b5c-4ee7-8a5f-74c7a1b2df66", "comment": "Malware payload (IcedID)", "value": "5f4d84b8d3a65e7d597a02ada71a039a47497d88173f1e16804c4c54f017835b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157021, "uuid": "8e59ce6e-7394-4189-ad40-d1c526040eb2", "comment": "Malware payload (IcedID)", "value": "c45c2f4f580e3b1f8247c17f2d3af71d096dfac5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157021, "uuid": "d12cce39-dc29-4975-9181-cebeef8a9590", "comment": "Malware payload (IcedID)", "value": "e8d07d13965810044cebf322d6f7474ba14130b45927bc998ba494db94c7658f98f4dfa2eb541e1615c8b6accc47a929", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157021, "uuid": "499c6848-4dec-491b-a8ab-0ac7077b1da9", "value": "0FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157021, "uuid": "d37ed37e-e2ea-4852-a61d-a17f4fb5f27e", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157021, "uuid": "e7f4f968-3adf-4abf-8818-26b1a25d6925", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157021, "uuid": "f552e069-5cd0-4ade-ba7e-2f306dc0e451", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157021, "uuid": "d969adda-eb7c-4f44-8a12-5ed4ea2566c0", "value": "document-554804156.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea0255a-91ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617173370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173370, "uuid": "9e6ad1aa-e09b-4ae8-82af-6a01f1246346", "comment": "Malware payload (IcedID)", "value": "70df0c0cea895574771067e68c68e723", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173370, "uuid": "7d323ae6-35ff-4577-a23b-8911bd9e6e04", "comment": "Malware payload (IcedID)", "value": "5f7dd80d6db54940d0d0018b0765f89d14a80d82c8ca1014b306c4c0824fd50c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173370, "uuid": "2ebd0fe6-8bcc-4692-b57f-e7994f885989", "comment": "Malware payload (IcedID)", "value": "f38fd5fdb3d4656b554eed3c85916d23c0ab0240", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173370, "uuid": "9dcf5463-45ef-4c5c-a5e2-bacee7e71b03", "comment": "Malware payload (IcedID)", "value": "a01bf87ff24a2fa14f3abbe1fe3f72b3f5fe0a0d18910e67a9dffe917f117ae9fea7326052639f425c537e79f1729fa4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173370, "uuid": "d265a9a5-8b15-4d1b-af01-d3ebbe18f163", "value": "1BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173370, "uuid": "74537419-3941-4f43-b6ef-e43d0466204e", "value": "3072:M2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:MzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173370, "uuid": "9d3e2a84-d9dd-46b0-ac17-cf620e36bc82", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173370, "uuid": "6bc2310a-eb45-46a6-bfcd-71fb08918eff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173370, "uuid": "10dc119f-d2ed-4730-9407-870a69525d65", "value": "document-30522410.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc3d5df-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218464, "uuid": "d7d4ad97-11e5-45b3-bcb9-451c72860206", "comment": "Malware payload (Dridex)", "value": "c5d27026558ce3d907f562d90f9234b1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218464, "uuid": "4d6e5ffd-4e8a-46b6-8e11-d40ea4331135", "comment": "Malware payload (Dridex)", "value": "5f94683ffca288ca8fd04f5d4980a8be96f628e195ee7313dadda11c0743e8d7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218464, "uuid": "ab59b4ce-ddc7-46dc-9bb0-97d2015b6b7b", "comment": "Malware payload (Dridex)", "value": "e6f3184794bb18b318035bce6cbfe4fc29622790", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218464, "uuid": "d1833537-8901-4184-98fa-1673d3efa576", "comment": "Malware payload (Dridex)", "value": "706ec76b40c41182befa81965db5d8a99e4cbeef58108d2a281d4679d6909a08024b41a07ae44821a613b382304c4882", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218464, "uuid": "e6b83c55-2d65-486c-b3da-a58ce9067868", "value": "C714BE4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218464, "uuid": "eb93b808-3397-4e37-9857-420814d8a4b5", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218464, "uuid": "491aa867-8ece-47ac-aa3e-6fe1711dc71e", "value": "3072:Gopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ZpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218464, "uuid": "a30b693f-4a42-4f16-872a-80a08b647e82", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218464, "uuid": "83f88a28-6fa7-4b3e-b996-aec30493292d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218464, "uuid": "fac77556-299a-49b4-8562-f7d0611387c5", "value": "5f94683ffca288ca8fd04f5d4980a8be96f628e195ee7313dadda11c0743e8d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50ad3f2-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617173972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173972, "uuid": "f78b4b10-544f-4d50-819b-096da176c00e", "comment": "Malware payload (NanoCore)", "value": "44f943e20c73a71ef0dbca5a4a1957c4", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173972, "uuid": "7c3f4290-4284-4406-9ef0-7e2b266becf6", "comment": "Malware payload (NanoCore)", "value": "5fe57128126d6799f3a721301b906cd68d0fb3667fb80293dc1961a972020301", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173972, "uuid": "ee0ff60c-4730-4d4a-a401-bd72064b50e3", "comment": "Malware payload (NanoCore)", "value": "7a797c81e2e34d72440dbe76d58541504ec176f5", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617173972, "uuid": "1a436f17-271b-4725-a1ab-cde34832513b", "comment": "Malware payload (NanoCore)", "value": "64a92c574219eab86feeb8463494dffa913fbc9adc1979dbcd4cacf49a9a4d1f8798f396ca620db58a95fd670adc3c77", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173972, "uuid": "8720af99-877c-4c1a-bd4b-282c6acbe78e", "value": "78C423E42FF6D8631C1B7BD3A06067BE998D2939502C86177D3869F123D4ED3B50A1B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173972, "uuid": "4d206048-4f29-4a36-8286-caa1af3b7f20", "value": "12288:k+bGf3Is1Aynx9NTZqx+Bgp3NfGUItIwLf//Buhi:FGf3B1N9Zi+q9fGNtRLf/Juhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617173972, "uuid": "bb69a5ba-f70a-4093-8a57-168ce0357baf", "value": 572599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617173972, "uuid": "b07da880-1e49-472c-b323-f4a270655df1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617173972, "uuid": "baddbc8e-7b69-456c-bb0d-1df622e15b1f", "value": "QUOTATIONs280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00890938-91e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617170260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170260, "uuid": "4d26120e-ac29-4ac2-b6a9-02c4c58e5542", "comment": "Malware payload (AgentTesla)", "value": "771c33490abd22c3693880c9629113d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170260, "uuid": "f85bbd0d-4af8-4b07-af43-2686b7d821ae", "comment": "Malware payload (AgentTesla)", "value": "5feb824ac22902db874500c14ed90b21ac0cfdcff3c3ce161db23a8cf40d6244", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170260, "uuid": "6e350f23-4748-414d-a1df-088a23510690", "comment": "Malware payload (AgentTesla)", "value": "0e2024c54c1185d5176c443944cb7222fbde09c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170260, "uuid": "a35f1b75-7611-4369-a690-2bc91bce475a", "comment": "Malware payload (AgentTesla)", "value": "2b8042a202ffac46b9e60da7b4e1e28f9f1d5a20329d5ed694225fb38e220dff5782be5ff8d255a9646ed189a8414f77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170260, "uuid": "668fcec2-74ec-45c9-997e-be1388d97d13", "value": "7605E0247346FE97E47984F588CC1B42B2F347C5120AE5797CA492D282C62C7BBD3AC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170260, "uuid": "d3899f16-0d6a-47dc-8e67-5e8c859ed5a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170260, "uuid": "3a729338-e11a-4f49-b372-d4f12e8eaa85", "value": "24576:pBhEStCFJpw1AMINAKyBZFIYqLwJc+D/Tb:HpajA+Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617170260, "uuid": "e2c27166-8cea-45ef-badf-354e49253f7c", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617170260, "uuid": "172eb8b7-6c1a-4389-ab1d-58f3810fe42d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170260, "uuid": "e1419fb8-2a63-4842-8935-1f5529ab9eea", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c517f0c7-924d-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1617214828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214828, "uuid": "2408f8c4-6f78-41e1-a6d1-f4b385c790b4", "comment": "Malware payload (CryptBot)", "value": "8b7c0e72faaeb4a09fb445476d929fe1", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214828, "uuid": "9e4aa396-0cec-4e34-a942-2ed59dd9ba68", "comment": "Malware payload (CryptBot)", "value": "5ff8c7ade325a6a34543acf75e21e91387eaee3c0f264f5ab98b657cafdfa30b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214828, "uuid": "9d692ad0-8ba4-4a9d-8f1f-68d36a35aefd", "comment": "Malware payload (CryptBot)", "value": "55d7c914697359889100747e4e69636adf24243d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617214828, "uuid": "04656f0f-98c3-4676-a0c6-6840835a1c48", "comment": "Malware payload (CryptBot)", "value": "668a1ddaec612766329932729923da2ce59cff5bc8ae0a4fc01909a19322ce7559d141177576e0a6dbfcc53246699582", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214828, "uuid": "785f433d-cc70-4b30-a711-831620ac6116", "value": "EAD40101B6D5C873D59642754821E3B24A32FDB24B30A6CB7BC57B2E5A362D0873B787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214828, "uuid": "51b4d5d3-4c6c-4a0b-b54f-dff881905c4f", "value": "502aa3b38338aa092a67a446a205b8f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214828, "uuid": "7215b4e8-df3e-41bf-9c23-75bed799dc1f", "value": "12288:J/T709NZymjvpHApmCoKYETo4L45KI3CejWGf:JrGNZhjvpJKYETo4LvyLWGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617214828, "uuid": "a9ab3e7b-99e8-42d7-bebb-41c146d9ccb2", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617214828, "uuid": "d3488d11-9ef1-4024-84e9-f4f92e07f4fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617214828, "uuid": "fa9c0f05-452e-4eab-a0be-12aa3151ae9f", "value": "8b7c0e72faaeb4a09fb445476d929fe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc92fc6-921f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617195137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195137, "uuid": "e6321b95-f997-48a9-8945-cd103f024a54", "comment": "Malware payload (AgentTesla)", "value": "f106f4c486c27f559eb50cc3539e759b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195137, "uuid": "d00ef03b-1837-47ea-8cba-06798926a6b9", "comment": "Malware payload (AgentTesla)", "value": "60178061acaeacc7a85a1cf1a9f38b4a4b4757e7b117b824a646d12ffd67c6d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195137, "uuid": "be8fa4f0-8a17-49f2-a0f2-883525dafdf7", "comment": "Malware payload (AgentTesla)", "value": "7baad8aa138896bf2292bf4456924283cb219c52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195137, "uuid": "0d36fbe3-75e2-4f82-8eb8-33bec468d021", "comment": "Malware payload (AgentTesla)", "value": "e600598fb03fbf844928701a50339820c695734547cf1f2285b76196c4b5b1336524feca49e756d2251e3f07c942373f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195137, "uuid": "226ff340-ef9e-44b2-9f80-553d8caa6f2f", "value": "C1A40100B2D2C073E5510AB64930C6A24A37FCB25B356AC777A57F6E6A312C19B37783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195137, "uuid": "891f5032-0575-4c2e-b09a-743cd1f1bfab", "value": "ec18f4d9317b5556304720b9775af997", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195137, "uuid": "4d0a3475-42c2-49cc-a458-12f3402887c7", "value": "12288:Kbz4M7UyJ/SaZnmDmkH2tFdC8NcQYSC0cC+qD+jxgk19:KowKaZmDSvdC8NAm+lt19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195137, "uuid": "2d8a81b9-440d-4fc2-94b9-5708cbf3e9a4", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195137, "uuid": "29ce5398-0187-4892-a8e0-9fcdba6b0f26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195137, "uuid": "576558cc-24ee-416b-ac33-c14be7c31d64", "value": "f106f4c486c27f559eb50cc3539e759b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c491405f-91d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161569, "uuid": "f4498e40-3d41-4361-8e9d-73239bb6f61f", "comment": "Malware payload (IcedID)", "value": "ad4d943073084d2da7188cfb0d87d84f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161569, "uuid": "95d7ff1e-f285-44d2-9b6e-de37f234c268", "comment": "Malware payload (IcedID)", "value": "6033bc660d576346c76879528cf7754c420771603764bbacc5ccc7dbc1ab7b4b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161569, "uuid": "20ce45b9-ca09-4403-9ebc-ff0e4fac368d", "comment": "Malware payload (IcedID)", "value": "010caa98e3f22db74f457115869b62a6a7e9cfcd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161569, "uuid": "ac3d5b3e-2040-43fb-b45f-4feef66dd707", "comment": "Malware payload (IcedID)", "value": "1decb8eb7681c0414ddf506618151c58326de0551d0d2d3e7475edb8feb083cc4a576c882fd9eb8b5af03a0ae8b02855", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161569, "uuid": "197aa756-b357-41c6-9b20-a575fb274de2", "value": "66B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161569, "uuid": "5490dad9-2d85-478a-a0a1-6f486c0ea514", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161569, "uuid": "0cf50d62-0822-4068-9e4a-7a03272fb929", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161569, "uuid": "0dbfba44-d63d-45e0-864a-f3bf85aa5dfb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161569, "uuid": "835a63ef-0c6c-4344-a4de-ff2c3be5fa90", "value": "document-804885672.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a19c98f-9240-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209011, "uuid": "eea0e732-bbcd-4401-b51f-a201111786ae", "comment": "Malware payload (IcedID)", "value": "87469a97daba744818b10bfdc6590d45", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209011, "uuid": "fdf69269-39e9-4c66-af6b-31cade936bd5", "comment": "Malware payload (IcedID)", "value": "607fb2a9c07d381dc1291d8468b169c9a00effa9fe71d19aca592719701849e5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209011, "uuid": "997c8e63-45d0-4aea-93be-b02aa2218c6e", "comment": "Malware payload (IcedID)", "value": "2adf6c5e29c41d1521079fb0e269c180fcff0f7f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209011, "uuid": "e84468bd-3696-49b3-9eb7-0369e91e4577", "comment": "Malware payload (IcedID)", "value": "692ccd4ac2fcf98f36afbe3d6f10d1755125528b2c2150ea6abf970c8116afc0ef574dedf0c2d3518a017da8701234a9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209011, "uuid": "4a1a416b-b52a-4457-8b6a-3bb9e4e2c922", "value": "59B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209011, "uuid": "c650a9f3-2a5d-47c2-95ca-74681778b42b", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209011, "uuid": "579faec9-0170-4cb6-994c-4baae6370720", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209011, "uuid": "3f156ac3-2cec-42f9-a865-b50d8241c6c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209011, "uuid": "18769c34-2c49-49d2-9e1a-3cd69d40d629", "value": "document-2049175517.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e8e01f-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199293, "uuid": "8df2e917-c7fa-49b3-aa11-a268c75d5e93", "comment": "Malware payload (IcedID)", "value": "41c9b264803288de6c049684b7fac48c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199293, "uuid": "981dc3e6-a2a6-499d-9a0d-dd151888ea4b", "comment": "Malware payload (IcedID)", "value": "60a8c680fda3afbb21d4981c5cce560e94b1a78a499fdd93b6548065f49ca894", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199293, "uuid": "c1be9a79-46d7-4668-a44b-2efcf85bd8da", "comment": "Malware payload (IcedID)", "value": "43b41157a745f0fead5345ac58667b139c4c20fc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199293, "uuid": "b8c4104c-64f6-48c6-aa8f-ae92ca55ecb6", "comment": "Malware payload (IcedID)", "value": "4fb41af6b751f4f7a34db747af6103b0d6e4144a3f415234a1c07f471933ea72ddcb9d581d163bc1a611747c5381dcbf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199293, "uuid": "5d37df43-ca25-4610-8ec2-c1b67c653cc0", "value": "63B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199293, "uuid": "be807fb3-f91f-43e3-a3d8-83db59ce1b41", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199293, "uuid": "0161df6b-2628-4959-ae27-e8ca7a101dff", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199293, "uuid": "e50672a0-1985-48ee-9264-26e8f2c5417b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199293, "uuid": "ed131485-ebba-40bf-9ead-5ce1648d8f7a", "value": "document-2147304545.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ba978b-926f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617229262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229262, "uuid": "77edc6a7-4b72-430e-ad23-ba62e1dadfdf", "comment": "Malware payload", "value": "08fc49d03cae3b6efcda35fccce8310d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229262, "uuid": "cf116c97-13ec-48b6-8561-f0150d097946", "comment": "Malware payload", "value": "60bc1513c619bd68bc04b7e6db60793b026f5986204c33c372a6a4fd1f9392c4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229262, "uuid": "22493ef3-c633-4732-9b89-42453ec2a870", "comment": "Malware payload", "value": "9217ee835197ea9547461e180471e7381d011e65", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617229262, "uuid": "75c0bcca-7816-451e-8acf-7ee1ea3e24a8", "comment": "Malware payload", "value": "d084e18d47bbf50045018c2e87781c795de8a942d3a2f69fea144a602e9d48bc9a18fbdac48591d15b3c03e81449dff8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229262, "uuid": "a328cb69-6884-45b6-ad85-4d0da3ae8566", "value": "B114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229262, "uuid": "ac2a7901-8c06-4fb9-95ae-385c18c9fca4", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229262, "uuid": "bad1cc0d-6ab2-4f86-9935-557be5f69965", "value": "3072:41i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ki78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617229262, "uuid": "376672d4-aded-4d46-9dd9-8907371b86ef", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617229262, "uuid": "44227959-1f57-4ce5-8e85-d8a19efa0ec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617229262, "uuid": "07c93d76-11bd-48cf-93ce-ea26cb67ad61", "value": "60bc1513c619bd68bc04b7e6db60793b026f5986204c33c372a6a4fd1f9392c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8520284-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617174031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174031, "uuid": "5d4bb6ad-69b9-4e33-9bc4-034221c09601", "comment": "Malware payload (AgentTesla)", "value": "960736ac73913d1474ccb7fa89dd0977", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174031, "uuid": "fabc3a8e-3a97-4baf-80b2-b2184deb98b1", "comment": "Malware payload (AgentTesla)", "value": "60bcecff15e6b80448abadefc1829525e4629472543ff159e0be6ee7d1cea7d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174031, "uuid": "4e1cf61b-a9aa-4706-a030-2f37e88fa6f2", "comment": "Malware payload (AgentTesla)", "value": "84aa072b6d3e3a23ae9cc1caf3a7fddd056d5a81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174031, "uuid": "bf4ffe01-7964-4eee-9a64-78629839cc93", "comment": "Malware payload (AgentTesla)", "value": "77977aafb17e32ec711bee0dea359a26244c8316e279d0f315509c77b7035b79335e3587a0664552b8694158559cb594", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174031, "uuid": "7844dc5c-4dba-45ad-9871-ab0d1c4b2ca3", "value": "2415ADA83640B9DFC917CD3689542C20AA20BDF6570BC603A01779ED993DA9EDF941F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174031, "uuid": "08c4f35e-0b53-4b8e-bc69-d83ebe55b3c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174031, "uuid": "f458e5c9-5fd7-4128-ba89-7789f932b0b0", "value": "12288:U8sILxy6qdN5yIQBLESVhmk1migerUNj19RUgjXhJ0LMV2mQ0E4nxyRf+ZR3nEOl:hsILIjkbB9VhlWerUJnR9RnV2mFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174031, "uuid": "52cd9d77-10f3-4785-bd64-ace856289107", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174031, "uuid": "3c6891dc-e34a-4619-87fd-e7a80c7ec88d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174031, "uuid": "acf608de-22d7-4111-bdfe-d6bbe358e827", "value": "Document_printout_copy_34853936483648364393743836384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86570205-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232761, "uuid": "549fb462-d282-4a4f-9c80-91e919e3563b", "comment": "Malware payload", "value": "eed7f61e4711f1897a49644eaeeeaeb4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232761, "uuid": "d20951f9-dd9a-47b4-9475-bf8be934dbde", "comment": "Malware payload", "value": "60d35183da239e0af167334be17a269b59c4017ef9df5817d388c1cb655a1c71", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232761, "uuid": "bd871f3f-b250-4c75-ac3e-81671c564b42", "comment": "Malware payload", "value": "cdb1e63bb15e092c1ad376fd03e0c532f0b87688", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232761, "uuid": "da2659e9-36b6-48c6-a885-87a443135972", "comment": "Malware payload", "value": "a5f90cf819111fe622eaf65e7596b9c89539232fe8b9eec061e888be43abbdcd925e806b54831901521c23229756b809", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232761, "uuid": "e4c43896-0ea6-421e-8a35-0d2a214ff2f7", "value": "E214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232761, "uuid": "7972a296-9ec5-4b90-91ed-b68eb16574dd", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232761, "uuid": "bf16b95e-b7df-47a0-88d3-1c1a99ef01b1", "value": "3072:Wopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ppjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232761, "uuid": "8501e12d-f1f7-4124-9b05-e87dcbf83f90", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232761, "uuid": "628cdb34-1959-46ef-b4af-58c300cf526b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232761, "uuid": "0a2f8073-87ab-4625-8366-c8b0a5f6e8aa", "value": "60d35183da239e0af167334be17a269b59c4017ef9df5817d388c1cb655a1c71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6ef32f-9237-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205284, "uuid": "2701cc16-0fea-4bf4-ab4c-ec043370d797", "comment": "Malware payload (IcedID)", "value": "f1bc30120a3f95a8834800a55dfa597d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205284, "uuid": "cb8d2f5d-997f-4c67-8e85-c293882356c1", "comment": "Malware payload (IcedID)", "value": "61072401640820b08e3d82aa0c95fccffe9439dc492d3bae34cd0bab2f9ee050", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205284, "uuid": "8bf4063c-66e8-42d8-9f13-6b556ecb82f4", "comment": "Malware payload (IcedID)", "value": "fa84bb152b96da85ee269ee5b9945f36b325c37a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205284, "uuid": "7302659b-4488-4436-9590-3c5f9a6aede8", "comment": "Malware payload (IcedID)", "value": "00bf7faf933bc0df13cef3653e0bba0b90ae58cd45a6b87a849f084ed34bce8c367a61deb553d73a11dbbfc98883ef72", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205284, "uuid": "b3ef5940-d413-4759-a7bf-c3436346e9b3", "value": "BAB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205284, "uuid": "5e1b52e5-7ff4-4425-aa0e-e62ce5ae3c03", "value": "3072:I2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:IqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205284, "uuid": "6369acd3-cc34-4a5b-bb1b-afddfbd7a3ec", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205284, "uuid": "9f126481-517b-4903-b9fb-232cefc6b996", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205284, "uuid": "61374fd8-5ba4-464a-8724-ef6ba89f4885", "value": "document-1890392646.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fd1bf4-9271-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230348, "uuid": "d01a991c-2405-4a12-bb81-1ae5221d1d30", "comment": "Malware payload", "value": "91af02f33956529ed243ce982edf565c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230348, "uuid": "0279e887-3ac5-40e7-94b1-96b53b698665", "comment": "Malware payload", "value": "613bb6d53091f83e659760d8e093df858eee887a137741f8bb8047c840594750", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230348, "uuid": "2387f4a2-21b3-44aa-a7df-4f20f1281fd2", "comment": "Malware payload", "value": "23a092e107a104d69c226d3796a47a3d005e8a78", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230348, "uuid": "68f4aaff-fd71-48e6-81ab-70ec4a3bf72e", "comment": "Malware payload", "value": "62c4744b4168942ba0544d0fa414c245a75ad58b4b741c19a427940838abc3f31e61fee1f9dd9b89e09b436bd3f22d16", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230348, "uuid": "bf0f033a-d15a-47b5-94a3-15b6fe998c85", "value": "B9248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230348, "uuid": "57f1b774-7854-4e7b-9b33-0819334b9db8", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230348, "uuid": "b8369421-7f77-47dc-8760-90e2cca2ba6e", "value": "3072:p6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:poMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230348, "uuid": "56ef4307-34fa-4cbb-ba7f-ae85e02ae7c1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230348, "uuid": "3286e06c-293c-445c-bc28-c1acd6508523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230348, "uuid": "c9ed1ff3-fd8c-4ce8-bab2-cd5d7ef9192c", "value": "613bb6d53091f83e659760d8e093df858eee887a137741f8bb8047c840594750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b18aa3e-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222703, "uuid": "c5ba8c5e-9e2e-46fa-98de-e90b33f32e37", "comment": "Malware payload (Dridex)", "value": "b523336819a3f8cb9097d337d537c55c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222703, "uuid": "1c47464f-637d-4c90-98fc-f220af2f6dee", "comment": "Malware payload (Dridex)", "value": "6158aac0e2dbc717a80d4334cf9a4944f0d6a4ff30430073d809ad8285628c9c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222703, "uuid": "2cab474b-482d-491a-b162-e32f1b06f360", "comment": "Malware payload (Dridex)", "value": "487a8f431dcdc95223a2a570c0940a0ce8983ebf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222703, "uuid": "30c27111-8f0c-48d2-bd76-82cfc179990c", "comment": "Malware payload (Dridex)", "value": "6a2934710078f83662477ca605b49d6354ddc5cbd5644f9f60c0cf6f6f804b72745c3a727b9f61e89f2db1a6d6077035", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222703, "uuid": "c8bc3cee-f1bc-4f36-b619-2e8a42809b36", "value": "46248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222703, "uuid": "b480e9d2-927b-4679-8674-1ba85d594f2e", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222703, "uuid": "226f690b-ebac-4996-b0bd-03887636e228", "value": "3072:H6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:HoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222703, "uuid": "ba12deaf-8240-483a-9223-ea6f937da7ae", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222703, "uuid": "6439d319-7e5a-4c1f-b94d-6e7eb7137566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222703, "uuid": "8def5bfe-20a7-44da-a7fc-b133430a1979", "value": "6158aac0e2dbc717a80d4334cf9a4944f0d6a4ff30430073d809ad8285628c9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3063bddf-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212860, "uuid": "dc93e995-8e27-42e6-983d-5a4bacb54fdd", "comment": "Malware payload (Dridex)", "value": "27ba4d538f210456df4abef90787671f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212860, "uuid": "134c1dda-a2e0-495b-88be-697c7c0ed742", "comment": "Malware payload (Dridex)", "value": "617bb1e89cf636d6e2c8b627bf5c6024af5eb676dcfa5e00a36ee585e2b24da2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212860, "uuid": "5163d89b-d555-40b5-879c-4ce9a1e17de6", "comment": "Malware payload (Dridex)", "value": "a2205b883ba4cfce94efa2e17688a265a7ce42cb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212860, "uuid": "45a3596e-1eae-420e-a100-ec27d6d50ba4", "comment": "Malware payload (Dridex)", "value": "31446a450dbf794d69277d07433e75818ef5013b0b14cabf8c4a9f0e7ebb60a40ca7dee2ba2f7e6da24b1410d48bbb1f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212860, "uuid": "761d625e-a4ca-4bbc-a90a-b92276c3afeb", "value": "2A248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212860, "uuid": "6bed13cf-3322-42e2-b429-1ad8b303dba3", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212860, "uuid": "7d84441d-ecd6-4fc8-8619-08b004993c4f", "value": "3072:C6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:CoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212860, "uuid": "1bb7841c-38a0-4d02-91ea-745386b707ba", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212860, "uuid": "0e05ab6f-45b4-42ed-852a-05936deb89c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212860, "uuid": "5671f414-4c36-4613-85c5-3002ca51b0e8", "value": "617bb1e89cf636d6e2c8b627bf5c6024af5eb676dcfa5e00a36ee585e2b24da2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4902124f-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217626, "uuid": "75a1a750-0d35-4e04-8632-b90f8a4fdf02", "comment": "Malware payload (Dridex)", "value": "867c1c08d35c70f5df0adac8c12c97d5", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217626, "uuid": "85f4827d-a454-4297-aa84-8dcf881d4e99", "comment": "Malware payload (Dridex)", "value": "61809d8a286ee67b98d81b26c41ed7dffecb13543b9b714cc997c689a53615e9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217626, "uuid": "17f4b7ae-4984-4dad-894c-b17b6f4f257e", "comment": "Malware payload (Dridex)", "value": "2f7afff1e608d0b0422531af4c435b19999421fc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217626, "uuid": "5473b662-f42f-4995-bf0f-0e37fefb0903", "comment": "Malware payload (Dridex)", "value": "4a34317a19573399dc1818924e972f9e1bea5c8077fc28dfbbb158d0522f4831acb4f046369ca83b854d81ef01a73521", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217626, "uuid": "20276dbd-9603-4a82-9b54-88985d7e4d66", "value": "D714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217626, "uuid": "48ac5454-6bbd-46f4-b95d-5042fa2e7906", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217626, "uuid": "1282568b-c551-4deb-bb0a-1d59d4f0f48b", "value": "3072:Vopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:6pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217626, "uuid": "6c1292b6-805d-47df-a85e-32224bc9e18b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217626, "uuid": "6920f273-428c-4a1b-bfab-f3b9e1bb5911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217626, "uuid": "b57493f6-5492-478e-8390-a2867226e1e0", "value": "61809d8a286ee67b98d81b26c41ed7dffecb13543b9b714cc997c689a53615e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683d1e0e-923d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617207800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207800, "uuid": "0cb57ac4-197e-4065-85ae-bafe1fc57c74", "comment": "Malware payload (IcedID)", "value": "dc1177dce6a0661a7178c30431fc83ff", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207800, "uuid": "c04c67e7-a03a-4aac-8fe6-edcf37e5261f", "comment": "Malware payload (IcedID)", "value": "62231399fc9956b2bce70fbc82bb81a060916f5cb275322abc83e2aba3fbcd04", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207800, "uuid": "9f2e4cc8-4ea8-4af0-918b-ec2fcb15e937", "comment": "Malware payload (IcedID)", "value": "e4472baea983fad9f2f89e8f999f2f8c0d347307", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617207800, "uuid": "7a5726b9-b4bc-4b8d-a1ab-4c49c8b5a601", "comment": "Malware payload (IcedID)", "value": "1dfa10cdbfc49ba91d874c70b286fff6eda8377c10be3d11526126be991e567d2ec1416ccd6a636a29b77fd8b29f7ec9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207800, "uuid": "aed867ef-7ed8-4a5e-97d6-f69c60290405", "value": "04B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207800, "uuid": "e9076114-4eb4-4de4-ad32-f7524725c556", "value": "3072:E2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:EqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617207800, "uuid": "db045aea-6be7-4dd0-9cd4-f85b92fcd7de", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617207800, "uuid": "00dabcb7-316b-4e39-8caf-c19116a87394", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617207800, "uuid": "c7ff051f-6dd1-4153-8b4f-9a9cc39731f5", "value": "document-638544202.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad4c727-9267-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617225763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225763, "uuid": "99ffcb86-c152-4adc-bda8-d3cfc8cecb77", "comment": "Malware payload", "value": "4bd533ddaf6dffd4a14c13bd7cfa9d00", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225763, "uuid": "afc23fb5-a4fa-4031-a00f-34959b896f35", "comment": "Malware payload", "value": "627057f2791bb1c1931c6fa02f869711daab29583a471a56e02356d45007252e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225763, "uuid": "c5f70657-34df-4ac1-a674-327a02b624b5", "comment": "Malware payload", "value": "d5381d0123d9bd76fa843f7692e07973416a9b48", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225763, "uuid": "120fab92-165d-4dd6-9691-d8bbc80bd5f6", "comment": "Malware payload", "value": "1c41170acff26d1a055a9e14e89caf91f505f6d95b272197dd65cfe3e9636096ee31dffb17d5a97245396a9ddf39ebdc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225763, "uuid": "ef9913c4-3ddb-43a3-bbb6-aaa7db2b4e08", "value": "35248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225763, "uuid": "5be1498c-aa69-4494-9e7c-a63a40b29b06", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225763, "uuid": "48929400-2f19-4c72-a226-8c5cb62d6df7", "value": "3072:I6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:IoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617225763, "uuid": "57750837-b8ff-4790-bebf-0b35fd698ecc", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617225763, "uuid": "5dd770ab-60a6-4352-8e9f-c06c868d8212", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225763, "uuid": "9d8c7b07-1cb1-42a5-a263-830ebfd58588", "value": "627057f2791bb1c1931c6fa02f869711daab29583a471a56e02356d45007252e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef882bc-91c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158231, "uuid": "908b8e3d-2fe0-4f82-b84e-85c41c606835", "comment": "Malware payload (IcedID)", "value": "0b059f5f56b1a9d29ee2f9c8d80f8343", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158231, "uuid": "09cbb123-11ea-415c-be3b-422d1a665381", "comment": "Malware payload (IcedID)", "value": "62abddbe8f88178e3f2da0c8804e00f409ca103048e196d72833963503c8a2d9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158231, "uuid": "70b9e702-96dd-4f5d-9966-6bc3d888e588", "comment": "Malware payload (IcedID)", "value": "c8a08ca4ec8e3b9d559fad8547bc9cfe57d33220", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158231, "uuid": "f0f0ad9f-40c6-489a-95e4-2d3cc2106b31", "comment": "Malware payload (IcedID)", "value": "85cf4da45171173204cabd920b6709b5143578d8e98a4f935cdc07d019aec7592523f124ac9c9717865aff9b46d20cb4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158231, "uuid": "625134f7-69a1-4edf-ae04-7fdfc5845a5d", "value": "20B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158231, "uuid": "639dd0ee-2fcc-43d2-ba66-5b8d145341eb", "value": "3072:O2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:OzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158231, "uuid": "eb2bc0ba-984b-471b-beeb-c32a2599235c", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158231, "uuid": "99b0f7ea-c600-4674-839d-6b7f70b2c25d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158231, "uuid": "1316ba15-551d-45c0-ba5e-da724f5062b3", "value": "document-1183246761.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e9b79f-925f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222642, "uuid": "a6787e43-31cf-4b99-8e9f-a963a9b44a8f", "comment": "Malware payload (Dridex)", "value": "01af9fd3d9a4a7b4591162757c3380f6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222642, "uuid": "d8de288b-ba6b-41d9-9f63-2fc203a38801", "comment": "Malware payload (Dridex)", "value": "62cd735690e2556a6124547db5ddfb46e975b4f532c163653d019d1321f2962f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222642, "uuid": "90023b2f-4bf1-4226-8bda-ba5a786a97a4", "comment": "Malware payload (Dridex)", "value": "f99002aa4dda8e93cfcc5b3d0fc72c8ce979e44e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222642, "uuid": "df66880c-5a0f-42e0-812d-18bf0622237f", "comment": "Malware payload (Dridex)", "value": "178714f7a1bb811c67ac959c12168eef9c9e6666241ab88ab127c03e7fb6bd2aee89b65b30e1030892bd40ea16a4207b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222642, "uuid": "7177c91f-d852-4405-ab88-a423f93e2872", "value": "17248C5FE339E486FAE3CAF44186A72296A39C92476F580DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222642, "uuid": "848e53ba-61e3-4968-bdb3-50ff7cc61f4d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222642, "uuid": "772b9bb1-13ef-4efa-a681-6668809e30bf", "value": "3072:g6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:goMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222642, "uuid": "c203107f-91d7-4c2f-a1ce-36260e7f18b3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222642, "uuid": "c0b99cb6-ae45-49da-aa2f-41125b2464e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222642, "uuid": "1a964d92-778a-4842-8955-06476bfa1a0a", "value": "62cd735690e2556a6124547db5ddfb46e975b4f532c163653d019d1321f2962f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b28dca-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160762, "uuid": "88eb87cc-5ed3-4a96-9799-aa245a323a9e", "comment": "Malware payload (IcedID)", "value": "90ac1713d3bb73fe8e6c112fae21903a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160762, "uuid": "61f88b11-5379-401b-9f5d-9e8f058ba371", "comment": "Malware payload (IcedID)", "value": "63017ae0745ec261ef336948385cf237c1b9b99d22fcb273ac2c0a909eab4267", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160762, "uuid": "eaa84df7-5838-43c8-8f9e-e453792b7281", "comment": "Malware payload (IcedID)", "value": "69bea5c83f2ff5f963d7c712755ec775ec5d3767", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160762, "uuid": "b5746e81-7213-488d-977c-e7f6c5d68c10", "comment": "Malware payload (IcedID)", "value": "5f27d1451fb9d35f4b00cef6b420320e347127de472615042d1ff2060aaa332f3761e72c83a6d0d73519e25882d7347b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160762, "uuid": "5d334ddd-dfca-4a23-ba66-fe0168a2563f", "value": "2BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160762, "uuid": "63b55ae7-328d-4926-94e4-dd43cd7dd1df", "value": "3072:o2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ozxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160762, "uuid": "fa8a8344-9ab0-4949-8ce7-821ba871de12", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160762, "uuid": "fab16d53-be4c-4e51-ada3-fe8aca1d5f73", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160762, "uuid": "ddfbcbd1-1e29-4e6d-a5c3-cc29d64e8296", "value": "document-1490295022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1f9848-91c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617156725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156725, "uuid": "57b28c47-0c7d-45b8-ab3c-d99937118201", "comment": "Malware payload (IcedID)", "value": "09cf5a7218c0d44b08bb589d16f948cf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156725, "uuid": "56c2cbad-56fa-414b-b8e2-0b0e1f5deec4", "comment": "Malware payload (IcedID)", "value": "6335ab0b9211e87193fe8ca54eee9121c780d6c1e1eaf2953b86545b2cbd32de", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156725, "uuid": "f6ae028d-32f3-4795-93b5-c0864e63b9ec", "comment": "Malware payload (IcedID)", "value": "88d6dd9cc19ebb74318a4ed23558eb1aef02597c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617156725, "uuid": "f0c9cf94-decb-458c-a43f-682202e6affa", "comment": "Malware payload (IcedID)", "value": "2742993f042c6c44c480b6f0bfe7f8ae9226c3377ed5b0adce32cb1683806af82887aa25c1672f07614eff35aaeb3a08", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156725, "uuid": "109733d7-286e-45d0-b6fa-4aa5e25536fb", "value": "E2B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156725, "uuid": "6d147d90-1811-41c5-85cf-477d4702f37e", "value": "3072:82CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:8zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617156725, "uuid": "4c1b5698-fba1-4875-b99b-941df7a2c831", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617156725, "uuid": "d4dcde47-3aa1-43b0-89aa-0b0c5a6c2d57", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617156725, "uuid": "b9216f1c-6ca5-4921-8cab-19939b611518", "value": "document-833357801.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca17d89-921f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617195030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195030, "uuid": "ecbb8439-4840-478f-bc66-fbd99d83698b", "comment": "Malware payload", "value": "7e4a050bbced902f8eee873ca6c37ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195030, "uuid": "7c7e9570-7d56-436e-8542-ec3ea60d088b", "comment": "Malware payload", "value": "63cbb3daa3fbb2b799f43c4a7dda4515e65d6a1c56a3009f69d1d1f783e66847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195030, "uuid": "4f9ea184-24af-4e47-ae2d-f93b14207d06", "comment": "Malware payload", "value": "8f6ac85599cfb4e0646b43142490848e8efb8976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195030, "uuid": "3a0b7d78-349a-42ce-9456-b583dba2a484", "comment": "Malware payload", "value": "702b4238071df1a5a0566931e02e0fd58ab9d22b489bf38a95cb941cb95b0e85e334f1aaee1e61decee3db3af574e45a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195030, "uuid": "b5ff906f-88f4-4b68-a359-4d1c48b1c2d0", "value": "6645236035D08031E56360316CBDD3A1697AB8395B72894FE7C11B7DBF226A3DB2A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195030, "uuid": "6ac3ef26-21ce-4757-9648-e77f522c9680", "value": "130312efe8892496180179ce46d20b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195030, "uuid": "2a317014-c9e7-402b-88f6-1814abeea35a", "value": "24576:3TQuKl+kq1gYh8KGWuhR1CBY42tvSbLIJ75GH+stTSsjlX7VygJlfM:1wYmKUhF421SbTestTb5VW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195030, "uuid": "e36a996e-6c7b-4af4-b453-32dd25961eb0", "value": 1249596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195030, "uuid": "24943ae3-5f36-4764-be1b-6d9147b07c0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195030, "uuid": "ef4aa52d-9485-4159-98b0-fd36fec7952f", "value": "7e4a050bbced902f8eee873ca6c37ada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f81181-91ef-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617174267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174267, "uuid": "0c723900-3483-4ccf-be1a-7787ed22181a", "comment": "Malware payload (AgentTesla)", "value": "bf62874df7967619c0866a373fc5586f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174267, "uuid": "5a13ad48-88f0-4a16-92a8-04ccf75baa88", "comment": "Malware payload (AgentTesla)", "value": "63ebe3b6b4c74b82cc098f5ba4eccf9e100b0fde5dcee78347042f357eb1b5d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174267, "uuid": "380f1461-de0e-41f9-8b80-6c5247d0ba76", "comment": "Malware payload (AgentTesla)", "value": "21ad8d92a9d739768ea574af1a3106f324a3f1aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174267, "uuid": "c831e4af-a2fe-4d55-9190-38c9bba438ab", "comment": "Malware payload (AgentTesla)", "value": "e0adbd75eb7d7341310ea4d776da09b2f97cdb1de8a78425b98b638e30c19baf39da16db60535488ecc0a27632a28e9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174267, "uuid": "affd77cb-48a3-4e85-b20b-9386686a12d1", "value": "AD15D02DF345BBD2EA1E4E37C42315E483F6C0A77373F69B58E418D40A11BAA4A1E1D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174267, "uuid": "ca118e79-2689-42d4-9c9c-4b1cdbce8732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174267, "uuid": "67253255-0e4f-4421-b4bb-c2dbc69f39dd", "value": "12288:LL/9y/cDnvyx6yQOpkrgCVTbaakxaM9qBxaM9qfniTKDF4IpY7ky:LL/VDnQKHTsxF9SxF98f+IpY7ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174267, "uuid": "6cd5541b-bf2d-4d3d-9e19-45f6c47f86e4", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174267, "uuid": "b2e06812-0bf9-4878-858b-a7f841f4ece3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174267, "uuid": "ba85eac4-17d8-4e24-8846-78e19e89e231", "value": "Order_011-0421-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd3d564-9262-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223858, "uuid": "8a9d711d-012b-4b90-990b-f69594563486", "comment": "Malware payload (Dridex)", "value": "a473cfab62420eb942bb5e24a545bdf9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223858, "uuid": "4dd13b47-86ca-4bb0-a7b8-ae3ce1b2b5f8", "comment": "Malware payload (Dridex)", "value": "64110ffe7d9a6222ebe30cbf8bd461782ad60628c07eed3372e85fd710569de8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223858, "uuid": "e889445a-17e5-4e2f-a06b-f0006ef9dfe9", "comment": "Malware payload (Dridex)", "value": "ba93b20f8dfb41de2a7b99588fe0a6057951d864", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223858, "uuid": "f114b743-f804-49d1-875e-77dbb3ee5628", "comment": "Malware payload (Dridex)", "value": "2dd3cdb998c33037f5f3da4aa222f05026c8646300b3cfebe61da953f380764828166b94caca8314b7e35dfeba175121", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223858, "uuid": "eb652f88-7468-458f-978f-8e06030dc7cf", "value": "7C248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223858, "uuid": "6786ea54-79bc-455c-acfa-ec429c61377e", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223858, "uuid": "8f166fe9-977a-461a-a5b9-a0cbebbf9aa3", "value": "3072:B6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:BoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223858, "uuid": "c5c66e49-41dd-4274-8517-43e7c000c3c3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223858, "uuid": "c40e160b-7909-4208-b554-cb45077dbeae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223858, "uuid": "a2370bf9-fe44-4bea-8663-50996c33c97f", "value": "64110ffe7d9a6222ebe30cbf8bd461782ad60628c07eed3372e85fd710569de8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5cd1ed-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217576, "uuid": "e2794a3f-b908-488a-8e2b-e3de744cdcc2", "comment": "Malware payload (Dridex)", "value": "ba75833e713e807611d7d4136e17732f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217576, "uuid": "e4bc4d66-dc19-4f89-ac86-9479fb389114", "comment": "Malware payload (Dridex)", "value": "643592c8ae8566ba7a2c21d92a5e617d52819958c7a7056da0b4f9b32b2693b9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217576, "uuid": "fc8690d8-c260-4d30-87dd-d57eb30bb12f", "comment": "Malware payload (Dridex)", "value": "84254764ce0610e713a7b2c7050299a165ee152b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217576, "uuid": "05010088-e7e0-45fd-a71a-d88b79000eb1", "comment": "Malware payload (Dridex)", "value": "a0d6b7661c71230d39c1bcdd5d92e695a4d7bebd9388dcc04e577d6f9f0a79e402ac09be74e28c2e8e80410478b87fc5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217576, "uuid": "981b1ff0-e934-4796-ada5-931c93966335", "value": "BB14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217576, "uuid": "277eb9f3-a0f5-4db3-91dd-1fc86fcb64ff", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217576, "uuid": "f0173938-9015-45d1-a666-da0c4d86fab9", "value": "3072:dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:SpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217576, "uuid": "345cab75-142a-4593-955b-e0dfdad8aa44", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217576, "uuid": "87fcb8f2-6eb1-458c-b954-1ed6b395785a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217576, "uuid": "ab690bb0-9942-4c49-80b0-5259cd6f94a9", "value": "643592c8ae8566ba7a2c21d92a5e617d52819958c7a7056da0b4f9b32b2693b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e085314c-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204995, "uuid": "d714e69e-0e99-49cf-ae42-fe91567a0567", "comment": "Malware payload (IcedID)", "value": "01b2fe9b4f132c25d761024b011760b6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204995, "uuid": "fc5d3de5-9b56-4c5f-93e5-614b18fb7f9f", "comment": "Malware payload (IcedID)", "value": "644b0a60a0108c5a97f1b5a27ef312a504f88ec8d04cf997af8d333ee837b005", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204995, "uuid": "f8cec497-5559-470b-8283-e9a85fd863b0", "comment": "Malware payload (IcedID)", "value": "54e403ffb0444b9767454fc62921996eaf0ee306", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204995, "uuid": "08e15f96-755f-4f24-99e9-b59ca4a643c3", "comment": "Malware payload (IcedID)", "value": "1d50d59ea1934dc3a1497e8b5b41d6ef1769fb0c4b999bf8536c6e432232e87cacc696a27262ad7f4a0369a098ba6d77", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204995, "uuid": "f7e6b5a8-9361-420e-91ad-b68edc348ed3", "value": "30B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204995, "uuid": "4aeb8574-e9a9-4f99-8e5d-e7e2f4098d0b", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204995, "uuid": "8a346209-1200-4c1c-8887-1263e747ea02", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204995, "uuid": "1c69f264-6d30-46c5-8d1f-9c8cc993e9aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204995, "uuid": "d9d7c899-8f62-4b0b-90b3-c4582b85de8d", "value": "document-1054523877.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1525d572-9256-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218398, "uuid": "c983449b-003c-4dee-8563-92fa6f9ab8a5", "comment": "Malware payload (Dridex)", "value": "3d9e951b98aac7e451038659333dfc9b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218398, "uuid": "b36c8c67-884e-410f-9a77-4171aeded933", "comment": "Malware payload (Dridex)", "value": "645174408164efd18498a181c68462bb7007530b17d52d9058a176f3cb2168e2", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218398, "uuid": "e59cce70-45fe-4111-af88-4eaed11d8436", "comment": "Malware payload (Dridex)", "value": "ecc37193ea70bb8b5c8f2ccbb3e406922a3769cc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218398, "uuid": "152a6f39-0d27-4754-9064-70d0ba3c5904", "comment": "Malware payload (Dridex)", "value": "df29077c4b3dcb870a6a5097145e0a2cb3d3efd80c9dcf007874a2f820759498f5eb5b1033b59a850d8dae6fca9c40e2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218398, "uuid": "67197b6d-c607-4e17-a61f-84940cc66b56", "value": "1414BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218398, "uuid": "46c2a5a8-0ba6-4e75-91de-3b4f21c400fd", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218398, "uuid": "644f8dd3-b025-4020-b35b-9b2fb084b286", "value": "3072:sopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:zpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218398, "uuid": "f8d93c4a-ef5a-4c61-9136-df8939131294", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218398, "uuid": "d8b7e58e-3034-43cb-9fea-30a5558f7130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218398, "uuid": "1d96588c-046d-4ae2-ac45-e59ff3b1c8ed", "value": "645174408164efd18498a181c68462bb7007530b17d52d9058a176f3cb2168e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10cc50c-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218311, "uuid": "01f1c7ff-ba9f-4200-be27-c7a1c566f6a2", "comment": "Malware payload (Dridex)", "value": "0708f9ed2f6577d0a9e74dcecad20c85", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218311, "uuid": "aca33dc1-a436-47ed-8f24-e165e2a3f31f", "comment": "Malware payload (Dridex)", "value": "64767b399a7e0009e89785f4e4f7a84a70fec5de95cd3da499ca50bf4ec6f66f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218311, "uuid": "b32d9a1e-f7bc-4bbc-a472-9e2fe0961c4c", "comment": "Malware payload (Dridex)", "value": "ea3e7fdc7166a7d231e35af98cd7832998a329bb", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218311, "uuid": "c0dda059-c805-4fb0-873e-f0d47ba2a298", "comment": "Malware payload (Dridex)", "value": "d790656bd99b80651dd3ca41d1c169a2c56e08394e4224d90f7bc0fbbed58f1e4af8d859aeb92be892edd2c3c39752a6", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218311, "uuid": "36e5cb6f-5a27-4243-a233-91315579f1af", "value": "4C14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218311, "uuid": "a7407228-4fb3-4013-a19f-86bf905bab1a", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218311, "uuid": "2f156347-f5ca-4cfd-b3e2-3b7ec4fd76e0", "value": "3072:bopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:spjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218311, "uuid": "4d742746-b474-406d-a8c2-ca9cb03470bd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218311, "uuid": "05f00dd0-90f1-49af-a71f-0ab82dae1472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218311, "uuid": "fc7784cb-be5c-4b1f-8b0f-1e436b566255", "value": "64767b399a7e0009e89785f4e4f7a84a70fec5de95cd3da499ca50bf4ec6f66f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cefcc7d-91cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158845, "uuid": "08f09673-5448-414a-b54f-1311e2423a9a", "comment": "Malware payload (IcedID)", "value": "4f88ea30f114a5d7f936bdf17f7f5057", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158845, "uuid": "fcaf7fdf-d116-44fa-a13e-f7a49c3995d9", "comment": "Malware payload (IcedID)", "value": "64b635b878066d16d7ef145961b5b51f019b70f0703efc6594e230173a9f890c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158845, "uuid": "0ede13b6-3caf-49a1-83f1-e442088e8ee0", "comment": "Malware payload (IcedID)", "value": "f4a0187dec18a33e136d8245ed482e952da1927b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158845, "uuid": "6884beb9-341d-41c8-b712-16e3330d1f5a", "comment": "Malware payload (IcedID)", "value": "092208879712f265ee4cd1322cd9ef21a9fec1d21a1a08dcd7db3660bf8d44082e1a197b3e17b805531a8bfba35ac21f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158845, "uuid": "4eb4aa0e-4492-4321-845b-0867aea50a9e", "value": "E1B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158845, "uuid": "8826aab4-62c9-405d-acdd-5cfbf4aa7e57", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158845, "uuid": "dc1f7959-fb12-45a7-ab32-84141f52fe95", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158845, "uuid": "d53b7d70-205b-4b1a-be49-1065ce900f24", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158845, "uuid": "295b7010-2d1c-4fb2-abb9-0a5154aa3993", "value": "document-232367270.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f427a8f2-9240-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209323, "uuid": "f24e281a-214e-427f-823b-97e603e52e02", "comment": "Malware payload (IcedID)", "value": "edcb2dc5fda3ae9344c164fc5d1ef56b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209323, "uuid": "493cab1a-2390-4784-85f4-fa580a9ad44b", "comment": "Malware payload (IcedID)", "value": "64d18dc8184a5d3724280d07c4ff57e486154d541a5878986274d07ea435bd12", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209323, "uuid": "0db8e255-3186-42b3-9b61-cd4a20892ddb", "comment": "Malware payload (IcedID)", "value": "d8f9fa063dbc477f6d2b8075078c19cb24bc55d4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209323, "uuid": "1d878916-e5e2-4cbd-a978-035ba5727ead", "comment": "Malware payload (IcedID)", "value": "a50c771535d6929d0603a031557aa4aae8d4142f1c3db12a67ad133ab88f28a7a9d8c3f3f2c807e6fdd2bac672de8dd5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209323, "uuid": "10f896ed-302a-4b83-9e13-ab965c70e805", "value": "A5B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209323, "uuid": "7d7d351b-f879-4d83-95de-52361619d4b7", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209323, "uuid": "e692e499-cf8f-4ebe-8e99-41b3f9bf1607", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209323, "uuid": "71d726c4-a3ec-421e-b369-4274aa8e1480", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209323, "uuid": "9463a3a6-b908-442c-856c-512ec4b6881d", "value": "document-1091183551.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7833a4f5-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200096, "uuid": "d4c83aea-bc82-4734-a725-7628b7579076", "comment": "Malware payload", "value": "7a017980eacdeaf20a5772a6befdad48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200096, "uuid": "1c88a138-6f04-45a8-b54b-5a92221e20c2", "comment": "Malware payload", "value": "64d7a511f1dc1428e81c94c8072fcf075908c7712183e757fa0bde50b3fcab04", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200096, "uuid": "7f64e67d-5901-4ba9-a11f-c5f513c43bb9", "comment": "Malware payload", "value": "1bd745cf612d542913d4106b8692884048080aea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200096, "uuid": "f524be36-ce2f-4cc4-ad54-138491851fc6", "comment": "Malware payload", "value": "00ed8d6644ca8b8c77432359712a00f9030bd955e714b99aa9bfd2d43728f7eb5e22a4f702879ef621390e2c33a96f34", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200096, "uuid": "9a912b71-4337-415d-a300-eed47b2bf4be", "value": "6E9272A46B26FD65156606732842C52BE6B640D2B240B0F43FBE08C9FF395184B77E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200096, "uuid": "3ad1a21c-e2f6-4578-b2fa-1a9b5a0af7da", "value": "384:MeGlfYsullQKpOn6/9OW6uizbkTGwSnCHiJ9PQ/mlN5QK/U8G:slulzOn6IW6uo/tiiHm65QAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200096, "uuid": "725da38f-3678-4cc0-b05d-107999fb10e3", "value": 20280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200096, "uuid": "a4c65ed5-e801-444a-b011-17a3918408de", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200096, "uuid": "71b846bb-caa3-4ba0-a0da-b9582a23f709", "value": "64d7a511f1dc1428e81c94c8072fcf075908c7712183e757fa0bde50b3fcab04.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b0e58c-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617202132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202132, "uuid": "cf1e963d-4df4-448c-bb3b-3d34ace8b079", "comment": "Malware payload (Loki)", "value": "087dfb349f438a901d06f2fabc5c1f41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202132, "uuid": "b17d165c-d1d3-49b2-9046-ad3df1bb151d", "comment": "Malware payload (Loki)", "value": "64f6d585fc440e07793e13af5b25a98684f56016d7aff3711379b1fc5f210334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202132, "uuid": "5f7388ac-7cca-4d83-bae0-be5058a230ab", "comment": "Malware payload (Loki)", "value": "1f1373f720af35abe88bdf4801eb2cadf64b7973", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202132, "uuid": "daad78dd-942a-4959-8909-810470279909", "comment": "Malware payload (Loki)", "value": "fe00d0e0efd5874310661366db534a5bca2985c48d9cc15f38bc216da8cda37f4532dc409c656e22eccd80083ba54755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202132, "uuid": "9b0103b7-cdbb-479b-a0a7-52a64cb6fc4d", "value": "0C74DFFD87088F7BD6FE14BC51912A8803F5D0A52623FF9A3CE518D995CBB8007716A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202132, "uuid": "5b7e0dd6-9e35-4c9f-9532-c9bdf2a56209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202132, "uuid": "6b692aea-e04d-4b97-92e3-f6b89e6ba7db", "value": "6144:pELEskLDWM63zdqylNXq1kqYcSlrqMnLsjBlxrxwFBcoNrot6Ww:pELENm9a1sTlBnCB71wgMrot6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202132, "uuid": "0a323774-b14e-4723-8bd8-3d471479a160", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202132, "uuid": "0614c68e-7cb7-429d-ac20-a372474970c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202132, "uuid": "e630eadf-a058-4774-bfe6-21b1e892a4c2", "value": "Ref 0180066743.PDF.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddcb50b-91d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617161934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161934, "uuid": "f0777409-1868-4d92-a1f1-4af5941409b1", "comment": "Malware payload (IcedID)", "value": "ae987ff47fcb343c4a9387d1318e87ee", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161934, "uuid": "f266393b-6569-4a84-a8cf-455e3779bb63", "comment": "Malware payload (IcedID)", "value": "657cf1a2b72d79ba777bb5536d0cbfe0b2f485ad73de4663c5b9f50501aae38e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161934, "uuid": "a4370d8a-7100-4a37-8897-dcb6c3816410", "comment": "Malware payload (IcedID)", "value": "29b02c94bd889f0d594978a99525c8a6481a1bb0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617161934, "uuid": "d72de60f-a61c-4d21-8e8f-deab0e5ea2e7", "comment": "Malware payload (IcedID)", "value": "2874e5a703c6a2c48405f1b2945ae6deef07fe3a20c95ca4caf647f736c49c855e7ad75649d4d5dc01c72da4e2fe861b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161934, "uuid": "3c1ff2ec-9728-4cf5-b474-c9d18ba08402", "value": "25B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161934, "uuid": "b8a7b246-482a-458c-8110-e8b39190b321", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617161934, "uuid": "35a40d3b-0fe7-419e-ae75-7afc4f7ac4ea", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617161934, "uuid": "67c0650b-9a93-4f88-b9a9-61a995aa3680", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617161934, "uuid": "ad365325-e20b-4771-9c56-a645b1744b30", "value": "document-1862023781.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ec220b-9268-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617226352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226352, "uuid": "894c96fb-259b-4d61-99f6-4259b3553e2b", "comment": "Malware payload", "value": "526d55153f9ae34eda9cb920b1d8990b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226352, "uuid": "38a57617-b969-44a4-a78b-a95c1348ac2f", "comment": "Malware payload", "value": "65aa5e4dc6b4a84738ca1653d0e819bb72a74aedb77678d3e8eb50533787b62e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226352, "uuid": "a577bf66-4d03-4572-84dc-3ba0326b3d73", "comment": "Malware payload", "value": "0b63eac8a2d01aa75f65e2e2c7b7fe3c62e583d1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617226352, "uuid": "92253b07-4131-4e62-9e63-90e2b62172d4", "comment": "Malware payload", "value": "e82c9313c08fcc048b20f9a574db99d186953cd571ac76aa3e8d68a35560dff62039bdbf162a919212920568aa715713", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226352, "uuid": "b9a61ba2-fc78-431f-91c3-c1f2fb6886d1", "value": "3F248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226352, "uuid": "f55c0b56-362d-4802-95c9-70d34db484f2", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226352, "uuid": "2918650e-2622-42aa-b079-cb7713e1606f", "value": "3072:t6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:toMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617226352, "uuid": "55eb3f98-4d85-471f-86b1-57926cd6a78f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617226352, "uuid": "52e35a60-be11-4591-8337-a4f1d4ff469f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617226352, "uuid": "e4838241-db7e-482e-bd92-923e96a6da3b", "value": "65aa5e4dc6b4a84738ca1653d0e819bb72a74aedb77678d3e8eb50533787b62e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519a7528-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218070, "uuid": "e65ff0fa-5162-49d1-b34b-b56dc5c06c6d", "comment": "Malware payload (Dridex)", "value": "bc586e1ad29e4cf6175234bb8cbcedfd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218070, "uuid": "2d882237-99fa-4299-a4ca-9f333b830fcc", "comment": "Malware payload (Dridex)", "value": "660e373f30314aefd0a146b4bbd8bcf9bf8532849b1052a66d79c86a4393eda7", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218070, "uuid": "cb66d819-9901-463a-83d1-f1aaad8ccc56", "comment": "Malware payload (Dridex)", "value": "4c7cb721e751f5e630ec924315d337e4f8746c14", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218070, "uuid": "a155dfaa-de64-42b6-8861-f5bb1c91fd03", "comment": "Malware payload (Dridex)", "value": "7e07093e5e18cd7e5db2bb7fbbae36b5fb664c51e67c6cc9e45b4d8d27c945c457e9dab3cb2874ca1d1318015b6ff6a4", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218070, "uuid": "89b5161c-72e1-4cb0-a8d4-3cd1a0d32557", "value": "1014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218070, "uuid": "4748e878-3006-41f2-a104-0f6580a8700d", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218070, "uuid": "3d1120a3-080a-4f28-805f-180da26b1c23", "value": "3072:Yopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:PpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218070, "uuid": "aca5dd22-4067-410f-ab55-19d97fb6c885", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218070, "uuid": "a519bcec-3e41-43a6-8d2c-b7453a1f1ff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218070, "uuid": "5a71b085-a3a4-4e09-95f5-0f538284e077", "value": "660e373f30314aefd0a146b4bbd8bcf9bf8532849b1052a66d79c86a4393eda7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd683f8f-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617231136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231136, "uuid": "e48ab47c-3567-45c9-8ab1-f43cac3176b0", "comment": "Malware payload", "value": "a6b59b0fd5dadefe7169f2e5cb2bec6b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231136, "uuid": "d5e4f910-9e7b-4f22-95f5-731c77e14775", "comment": "Malware payload", "value": "661afa31ca527b12c80fd2e2def4910f3df90217b8a78fc1a3758f8c14cc7c6b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231136, "uuid": "33dbe999-57a3-42ca-adc5-34eff9306726", "comment": "Malware payload", "value": "0b65929c5e2fde57c3576c84d8971dad73b21ef3", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231136, "uuid": "87d45acc-530c-47e9-b981-23a3b5b51b56", "comment": "Malware payload", "value": "6ceea8d0f93c3311d611f492b1b362002baeef12a5fc4fdf05eadfa197459aa2565f8ffee5c0d5773631a3c860874166", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231136, "uuid": "9183a16f-668b-41c4-9976-498cf87eb6fa", "value": "2514BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231136, "uuid": "384a7ee7-0562-44d8-849a-80ed80fd5f13", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231136, "uuid": "9f336eef-ab32-495f-a692-8426edaf92d9", "value": "3072:4opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:vpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617231136, "uuid": "d2f2aad8-191c-4cdb-a955-57c364550623", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617231136, "uuid": "472a1c2f-3ebf-44a7-a39c-b07fdb5e70a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231136, "uuid": "b8b1cff8-031c-4d60-bab5-783c810ebb9e", "value": "661afa31ca527b12c80fd2e2def4910f3df90217b8a78fc1a3758f8c14cc7c6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fb40bd-9250-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216151, "uuid": "687aa143-a085-4214-8093-3346814d6bdf", "comment": "Malware payload (Dridex)", "value": "1c89929b8048eced5e50e7efff053e21", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216151, "uuid": "aec8fbf1-3b05-403b-bdab-cdba53b4137c", "comment": "Malware payload (Dridex)", "value": "663b95c7128e49860f3d91bad7d295fabd65fa666ae2a62a89c585c5cb0224c9", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216151, "uuid": "13e674bc-ab81-4288-aa52-c7972bc3bd4e", "comment": "Malware payload (Dridex)", "value": "95eb2eda395db5b931f8df21faa0fc3dcac6a5a4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216151, "uuid": "2e0369fc-a5cd-46df-8a7c-b10a1c2db2ee", "comment": "Malware payload (Dridex)", "value": "4033d52f5c198716c70a095927b841847c2cc496211eff581bfe15efa86f6fd08ae1039ed073798610672696b4103dcc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216151, "uuid": "234ddeff-c11b-4f8d-84c9-b8265b38fa93", "value": "7D14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216151, "uuid": "04452f48-512b-4be8-8bd5-a6414f28d81f", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216151, "uuid": "943dedf4-a3b8-4afb-814f-9784e607f6d8", "value": "3072:1opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:apjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216151, "uuid": "2bfbf8b6-464d-4fc5-93c7-30e2c588bc1c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216151, "uuid": "a933d2d8-4c11-444e-8985-de51dcbb770b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216151, "uuid": "8f76f48e-0a26-44b3-8fa6-d8d6ca0ebc04", "value": "663b95c7128e49860f3d91bad7d295fabd65fa666ae2a62a89c585c5cb0224c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9858032a-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617231073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231073, "uuid": "22da8ddf-b74b-49b7-8230-aeff9746fe32", "comment": "Malware payload", "value": "790498be23a9f5856d51beaaf5c474aa", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231073, "uuid": "6feb4852-dba2-4167-80ea-b9ddae12033f", "comment": "Malware payload", "value": "668b11ac7b8d88bf19d213bb1e87d8c67461a5a50de1e2a6b780bcf71e069a26", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231073, "uuid": "b6151122-e382-412c-ae29-3e58355856f3", "comment": "Malware payload", "value": "e41b33c85dbf31ff9621e25b54bb712297b36e45", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231073, "uuid": "2e682049-f640-4ac9-bcc9-7c7bcb2e1d0e", "comment": "Malware payload", "value": "7908792b1fa02c722cbf9f4bcc2eb432d4557bdbeb90be5fec4184f92628e7ef56968bdf7cad318024c14cfff739dd18", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231073, "uuid": "fa549802-f7b0-4bc2-8842-e1c68558b4a3", "value": "2714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231073, "uuid": "24622f9c-7f40-4f0f-9a60-89f4bcbf0788", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231073, "uuid": "ed9b1979-fd7a-42bb-a6ee-c880fa282921", "value": "3072:/opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:QpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617231073, "uuid": "b3fe7bab-9fb3-4761-80c8-df11ff49fc91", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617231073, "uuid": "0ad96f66-425e-4555-8c09-5ffe8c6d0a40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231073, "uuid": "f6181384-8db9-472a-978e-20d2987274c4", "value": "668b11ac7b8d88bf19d213bb1e87d8c67461a5a50de1e2a6b780bcf71e069a26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ec6870-9261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223144, "uuid": "85aae500-562d-49ba-a492-57d1786886cd", "comment": "Malware payload (Dridex)", "value": "876dfee1efc3da123f458eb46cb6b37d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223144, "uuid": "5ff910a6-2316-44af-b616-1e94455d9642", "comment": "Malware payload (Dridex)", "value": "66a2abf0782b8f230e754015e36dd9aa45229e47da8ce8c2e4664bee5836f1b4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223144, "uuid": "da2857ec-f82d-42fe-9cef-ea47bc639228", "comment": "Malware payload (Dridex)", "value": "27907d9f735ef75cb0badaa993f6a8364958cb46", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223144, "uuid": "7a578021-306b-4158-9311-cbb452dadd68", "comment": "Malware payload (Dridex)", "value": "fff555f3d450fd833db40a85e7093b5cfce5d5d6bc8535b75530b02e7c298b332b2252d747ccc20c1657a0b9d154c83d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223144, "uuid": "5fbde7da-84bb-456d-bd65-3cbbd7e6fee2", "value": "48248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223144, "uuid": "14c99b78-d882-4084-ad4f-7545714c0d43", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223144, "uuid": "28fc8025-5ba9-4683-ad17-1e0e44183aae", "value": "3072:T6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:ToMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223144, "uuid": "15a8ae55-7d6c-4379-8f2e-de3139fed604", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223144, "uuid": "6e8fee47-0475-46c1-a31d-ce42a767ce47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223144, "uuid": "2358c83c-a137-46f3-820c-5e051bfb5bed", "value": "66a2abf0782b8f230e754015e36dd9aa45229e47da8ce8c2e4664bee5836f1b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f29333-9220-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617195332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195332, "uuid": "b6780046-7be1-430c-b9be-afb3b7df0899", "comment": "Malware payload (RedLineStealer)", "value": "c679976e64da2051c01b750587c2786d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195332, "uuid": "5a4f2e3b-337b-49c2-97c4-e8d0ece457ed", "comment": "Malware payload (RedLineStealer)", "value": "66a38cc4c3d771280b087ca859dfb95644588421f633e83abab7cd4e4169003f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195332, "uuid": "a07a63e9-b806-4689-9c57-1036b31fc1f7", "comment": "Malware payload (RedLineStealer)", "value": "2960a6034785807bfc7d2187bc43f54021a0c34b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195332, "uuid": "fd07c65b-a279-44d9-88a6-5ffc3085a154", "comment": "Malware payload (RedLineStealer)", "value": "820233d759c7135bab4273da6ab3fc252479a1a08eb67451f92d14e72de72d8e8b2f3b047f82a0dc139b5df66a5b89f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195332, "uuid": "13216d2a-17a2-4613-a4a2-f5e8950ebdfc", "value": "5E64E000B1D1C473D29A15790461C6A14A3AFCB19F75A6C73B903F7A9E3A3E18A37397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195332, "uuid": "37012969-f5e9-4bc4-bcaa-8ccf7245afed", "value": "baf6552e1c7923d039841ba11b7a0d4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195332, "uuid": "7cc55777-717d-40b9-a66b-3ae1bbbf490f", "value": "6144:Ddccoxqq6LtFyxdlLhcTUUoHytTB0BhUQnjtOQ2X7rDXQCieMSn:Kco8q6yxdxhMEH2wwjrrDApeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195332, "uuid": "a11b226b-cb59-4a31-ba87-702d96fc3f4a", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195332, "uuid": "2b2d6a57-23ae-4b32-a739-6641149a3ff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195332, "uuid": "f9e4c74c-128a-4bd0-98a3-5582757f3beb", "value": "c679976e64da2051c01b750587c2786d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c03e9c-9254-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217568, "uuid": "ffe82c8a-4243-413a-b353-756131e6e964", "comment": "Malware payload (Dridex)", "value": "0d89d34b3f5a17fba5613048b6437390", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217568, "uuid": "5cb4cbe6-4960-4078-8d72-2798cbc06ef7", "comment": "Malware payload (Dridex)", "value": "66bcc383c452abeb6485db485d9bee7f0d73136840f9adbb781cc618c1c4912a", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217568, "uuid": "ac495cdf-bdf1-4270-9690-f82b2a8642b2", "comment": "Malware payload (Dridex)", "value": "7ad4bb4909fd21297dcdd503c0b9cd22f098ef99", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217568, "uuid": "9be3f108-22fd-42a5-9e1d-72e13ac9b7ee", "comment": "Malware payload (Dridex)", "value": "a8ad4defaa650ed8b370e089f62a70b5da9a643241837359d63cc6d7260252de893e216877a2f660620b65cee5cdd5be", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217568, "uuid": "aff84550-7c9e-4db2-8d74-20fbbfae79df", "value": "A114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217568, "uuid": "551f0e06-086b-4337-b919-9b6fbe4588f4", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217568, "uuid": "917d5f68-fe1c-4f4d-946c-51a2f8f3539b", "value": "3072:ropj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:8pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217568, "uuid": "9bd6f235-1653-4e1d-8d55-b7d216a3279a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217568, "uuid": "ae84df14-ef76-4cf9-9c03-0d2f64474b13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217568, "uuid": "41875239-c839-4a73-aff6-f963c7d0e904", "value": "66bcc383c452abeb6485db485d9bee7f0d73136840f9adbb781cc618c1c4912a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5f038e-9267-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617225795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225795, "uuid": "fd427fc6-1ba0-434e-b26f-5641d3dd8f67", "comment": "Malware payload", "value": "21686138c89f48f82d199dae90a9ac9c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225795, "uuid": "23b024bb-82b1-426f-a353-8254905494ef", "comment": "Malware payload", "value": "66e28f1a8111424a51e9d243762e1df066d2b0ef2d719df533f033f6bfcf3647", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225795, "uuid": "1b4fc6f6-f01d-4b4f-98dd-139d73c5be8a", "comment": "Malware payload", "value": "39d31355a28082961cc15ced72db3ded602238c6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617225795, "uuid": "9f7085fd-697a-4280-af1a-1475a1ed02f6", "comment": "Malware payload", "value": "1efd8e2a62a18fdeb499facb8b68c685ef71a76c07c7affe75f4e725f3260f32386f552fb717fed275591ee753305a37", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225795, "uuid": "bdb3ef2f-da4e-4566-8e7d-5115985d6f6b", "value": "D9248C5FE339E486FEE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225795, "uuid": "f6b64169-4d20-46b6-a91e-db01b29c72ec", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225795, "uuid": "f8592625-ea69-4d45-b986-8e960de4a5f1", "value": "3072:K6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:KoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617225795, "uuid": "ff20998d-1e1e-44fe-8961-d8d3dd866145", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617225795, "uuid": "e0e35065-c3ee-4ebe-be80-ae4f64fd67ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617225795, "uuid": "17680463-332d-4a8d-aa70-7f6b511cac93", "value": "66e28f1a8111424a51e9d243762e1df066d2b0ef2d719df533f033f6bfcf3647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd84f53-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617195674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195674, "uuid": "8478ed4b-570a-4b96-99fc-d8ad4b8d832d", "comment": "Malware payload", "value": "8f5759d8ff774915b0083f9031520644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Strato", "colour": "#D334A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195674, "uuid": "47e804ea-fb95-4da3-8e21-f1d1011c7e7a", "comment": "Malware payload", "value": "66ec4884aa53b768c7125dee603cbdbfd02736caae70080c313cf966698a48f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Strato", "colour": "#D334A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195674, "uuid": "46d5bbb6-27a5-4442-8650-0300d15982ff", "comment": "Malware payload", "value": "3eadb5932ec0e57c3b1481d0ed1e82e246d576b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Strato", "colour": "#D334A6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195674, "uuid": "831a4143-217e-4a34-84de-8267b0694c49", "comment": "Malware payload", "value": "fbd92ed14bde5e0aa689465078dfb014bac4ea7d08eb5b7dc8552b28bf491b40c8038fe267fe4e5dc66e606d626cfb15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Strato", "colour": "#D334A6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195674, "uuid": "ff7013e4-2176-48c6-9e2b-f1c7a60918bf", "value": "40737C79BAC1E931C33D4CBC006DBD711778F521EA8285A6815DE8EA2AEBD701B1FC15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195674, "uuid": "77a78e6a-5531-432f-b570-98fda6806b72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195674, "uuid": "9b2e3fd8-82f6-4a5d-ab3d-9bb6411746dc", "value": "1536:j/TR4KduAXIM/HjxTIXNTcqg+9sUjX8hjv4/gunHUNqemXUCh/L8hkL45Qj3qkhO:XqKMerjxTIXNTcqg+9sUjX8hjv4/gunY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195674, "uuid": "aa16604b-4ed5-44c5-8907-952dc823429e", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195674, "uuid": "1c8135a3-c4f1-4da6-938e-065ccace10af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195674, "uuid": "c835d52d-4693-4c1d-83cd-4977bd9a984a", "value": "IMG_60_36_7220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3420d8c3-923e-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617208142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208142, "uuid": "00a748b9-0eac-46d9-8161-27a65ecd1bd7", "comment": "Malware payload (NanoCore)", "value": "f8d60e01998ddfaf6494ae4028bdf601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208142, "uuid": "68d3cf07-8832-4643-8dce-d8e314682fed", "comment": "Malware payload (NanoCore)", "value": "674b27aff16d272d81d002580257502c06f5f8d468141be2eef4386d51c91a99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208142, "uuid": "e6c7582b-9cc5-494a-a352-0863de44ec15", "comment": "Malware payload (NanoCore)", "value": "0948ef3f460417aba5770d288bc34b82f3c65e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208142, "uuid": "6b75af7e-5e68-4ec2-a1de-a63d36cf48c3", "comment": "Malware payload (NanoCore)", "value": "683f4e65cfbc4431325da4187c78c428b6be6cd45ba3980cec3830db32fefa0b1e23988ca7eb8e622fecd2e06e6d6a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208142, "uuid": "8c034b98-32d9-425a-b4bf-2569577dbc92", "value": "17B4DF13B24C5B2DE2BE57B53070063013E5EF13D722EA49BED8EDAC05A264C56677E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208142, "uuid": "7b3358af-7920-49e9-9df0-a738a05a9c15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208142, "uuid": "95131a9b-edff-4da8-be2a-f57dc3b03aa2", "value": "12288:v7Z+AsmIKgOwN8h80wZ0UYtdsyExhJp8UuMASdw3H:v1xsmiQwZ0UOslBL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617208142, "uuid": "864c6f1a-b8b3-49a8-b5ae-e0ca968d40ea", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617208142, "uuid": "93da24fb-29b2-4e3d-bcea-08d22fae047c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208142, "uuid": "11491496-3934-49ce-a261-437e45a90c6c", "value": "DHLExpressShipmentConfirmationBJC400618092909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d86876-91e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617170987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170987, "uuid": "de4dafd3-f757-4c77-9a40-9fbff234369d", "comment": "Malware payload (AgentTesla)", "value": "09bd72e8af80815f663cedb5d1a1b09d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170987, "uuid": "60e4e40d-7b5a-445e-b401-fb0bda64473c", "comment": "Malware payload (AgentTesla)", "value": "67932ecba088e48f8cb1ad8413f77505fb3bb4a46e3c9f59ed174f5742c6b98c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170987, "uuid": "20abecb1-bb87-47cc-a972-36f538af3e64", "comment": "Malware payload (AgentTesla)", "value": "48d0bfacd595a9cc9386304cd437d856a2827357", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170987, "uuid": "7327ea1f-4819-40f6-aad3-6f8f5d0b6cfa", "comment": "Malware payload (AgentTesla)", "value": "1ed712d8ef737796a310881b54f6da3d090ed98f116870d95cd0a9b0a1848f5e407d3b1b830ae9801d6a6cc037189fdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170987, "uuid": "40c4bb2d-2fdb-483c-b6da-a2899b018c1f", "value": "BAB422A072EDAF3BE803353ADB23ED1C3598AD966735BA43610D754C4EF2B401892D76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170987, "uuid": "d81db0bb-967b-47c9-abbc-70bb4841726c", "value": "12288:Fvwl87T7mLNdD0rZqXMTvNXG32TYXRmNwNoHn/y0yt06Y/h5bUgSZVAd:Fbqac8TI32TYhqw+a1t+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617170987, "uuid": "716193b1-3ac2-494b-92a8-902ac21e11be", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617170987, "uuid": "2f1dc677-9442-415c-88cf-c98eaeb6c74e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170987, "uuid": "779211cd-a711-4e02-bf70-d01cf2c74bd6", "value": "INVR19839134PKGs.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6315474e-922e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617201349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201349, "uuid": "09a82488-1a8d-47cf-b49e-614399d68d49", "comment": "Malware payload (IcedID)", "value": "9a470cc3247d38d6eb467d2e3aba48ea", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201349, "uuid": "6dbe8d5a-8612-497d-b882-aa81bfe48cf3", "comment": "Malware payload (IcedID)", "value": "67b995ec6b3732c2d2d2228fbd2d34980d9fc6378da3bf278b9a60a7c9b13e43", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201349, "uuid": "2e3f4c0b-cc6d-4cee-88ff-ebf42055e6e1", "comment": "Malware payload (IcedID)", "value": "ac9f003668f74b8b8609d8192ecf3a5c58651611", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617201349, "uuid": "6e420a59-883c-495a-bada-ff300c3d8804", "comment": "Malware payload (IcedID)", "value": "6e8d98940a50eee1933d96a2c50559e2e69b8299fd6e78aba6e652e3c1c963402bcbdc4584ba99760c541dda2240a2f8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201349, "uuid": "f8d810a3-ebec-41f7-b8ea-dd4fbabd5ee2", "value": "07B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201349, "uuid": "1503e656-96c0-4f4c-89e3-380742af8d06", "value": "3072:82S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:8qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617201349, "uuid": "aec4fde5-0ee7-44e1-8262-b35113617a60", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617201349, "uuid": "aca1533e-99b7-4f27-b819-4e287b0cc4db", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617201349, "uuid": "40555941-768c-4bc3-abcf-a40bf574bb0d", "value": "document-709504179.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784ecc73-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232738, "uuid": "b5a1caf6-3405-4eef-8627-1ed85923504f", "comment": "Malware payload", "value": "ac5502715a3d43089b7a194703621109", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232738, "uuid": "7e388aa3-8519-4862-a1a7-8a695a330f7d", "comment": "Malware payload", "value": "67cfa078ad5dc695ec495a345931aa93cccf312a809a5b9cebc6458b390c8d61", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232738, "uuid": "e2b25fab-cc26-4d4d-a3a2-951a49296f73", "comment": "Malware payload", "value": "780ebf77242f5f6334f6e95185686db964f59955", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232738, "uuid": "016e7a90-7b73-48ff-adfe-a8b695eed6a8", "comment": "Malware payload", "value": "20e32001ed313af3f19257e1ae0e96bf7780e1847aed349533509ee0063ace1b8782aafd592a6bd1b4a809ee9060430f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232738, "uuid": "df0acced-69d3-4ee9-99d7-af7824ef5485", "value": "7B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232738, "uuid": "62e29740-baeb-4b3f-8ced-d6363f928f3b", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232738, "uuid": "8e5f25af-97a7-45e0-94ef-687db2da7a8b", "value": "3072:Gopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ZpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232738, "uuid": "a85f04e3-416d-4996-8bbd-e5ed7b2c147a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232738, "uuid": "3883d57c-eefe-4ad8-a8e5-d208c7e9271d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232738, "uuid": "5d984464-9a12-475e-8784-92a47aefa187", "value": "67cfa078ad5dc695ec495a345931aa93cccf312a809a5b9cebc6458b390c8d61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0ad06d-9277-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232741, "uuid": "e95b7071-fe4e-4669-b33a-0429924354e8", "comment": "Malware payload", "value": "b18bfdbd2cc4aa1820d6225aa05265ed", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232741, "uuid": "db9af672-3798-4bec-8a62-33d3297a6600", "comment": "Malware payload", "value": "6845bc4c78134cc8b4770aedca315be8b437beee30fff089e3efeb26031cedf9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232741, "uuid": "df79796c-f95d-41e5-8fea-3e7b77d45c01", "comment": "Malware payload", "value": "891e2cac739a2f12a444dacf244f0145d33780e7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232741, "uuid": "ccc0e3c8-b437-47ee-8108-36ea2049c280", "comment": "Malware payload", "value": "1f0f6f305d0269b0e3c0b8f9b64d07418c1d643fc4ebddb102423f915869d223811c89f52dd0515741104839c4c1108f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232741, "uuid": "6532c034-9910-45f6-9efd-936d05a75d4f", "value": "7D248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232741, "uuid": "cb547ab4-e312-448e-93df-121fdc1d0cd5", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232741, "uuid": "34ef967f-39d3-4128-bf39-9ba29bb4500d", "value": "3072:26TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:2oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232741, "uuid": "4c38bb67-e8f0-49e1-b18d-d665d1312fcb", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232741, "uuid": "251361f6-970f-480f-a4cb-123e2efd4552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232741, "uuid": "c8d3ab73-7469-4ea8-a6b5-144f7c77568e", "value": "6845bc4c78134cc8b4770aedca315be8b437beee30fff089e3efeb26031cedf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3357c574-91c7-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617157031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157031, "uuid": "4de9fc5f-93f0-4d4f-80a5-b01557ee005f", "comment": "Malware payload (IcedID)", "value": "03a07ff939d5124aa0d50dd3a1498e9d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157031, "uuid": "d253826e-be57-4287-aae8-caac9eb41992", "comment": "Malware payload (IcedID)", "value": "684f00d7cd2b7874655d349393fbfc441def1bad8c482025d19cb6abe11b6590", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157031, "uuid": "7f1a2108-c751-4e1f-9ded-7f3300d75f07", "comment": "Malware payload (IcedID)", "value": "2cce883a0c43d23368ddd52f886145241ecdaf40", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617157031, "uuid": "d73584a2-7a99-4eec-9042-0407430bec40", "comment": "Malware payload (IcedID)", "value": "b033f3277855b85563a86b02e677af32958f5ef166c5d4cefe1e204b566b5ceb2ca0720e1b790df014b78d218d4c27a1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157031, "uuid": "bb7d14c9-8232-4d47-a83b-d483d507f4a3", "value": "73B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157031, "uuid": "639f75be-bf08-45d7-a838-1df687b2406f", "value": "3072:Q2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:QzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617157031, "uuid": "e982089a-4884-4c73-8495-20d320880063", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617157031, "uuid": "b181afe1-c902-4f45-934b-61cf90126ff3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617157031, "uuid": "ad21e04b-af5a-4bd2-bece-48fc42ce3cc5", "value": "document-1734492511.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed2771a-9232-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617203087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203087, "uuid": "72881f14-bf4d-4a5a-8722-07551c7a8c14", "comment": "Malware payload (IcedID)", "value": "45cc30ee258af21fca3177e5153ef428", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203087, "uuid": "6074cf2f-db9b-4712-868f-b091f228b3c1", "comment": "Malware payload (IcedID)", "value": "68a9d0d816c1664ea6160fa13fd6d4934ed1decaf2cbad149ea3cfca20ae1c4b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203087, "uuid": "993ba777-db54-436d-bac2-56481111dae8", "comment": "Malware payload (IcedID)", "value": "a7b99e5469e0c48003cf60bdfc37ea88802ac5fc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203087, "uuid": "ad57e58e-04e7-40d1-8355-92fd78c4b518", "comment": "Malware payload (IcedID)", "value": "fcdaa87f3f4957bb28a97b120210bb33e3c197b32e23e25f6784b51fffdce2f0e3e3810bff6d653282d81d4f74202611", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203087, "uuid": "ae98389b-f609-4d92-9eb1-e1fa6145fc6c", "value": "06B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203087, "uuid": "8327c677-889a-4179-889d-81160c04ba1e", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203087, "uuid": "a37beec6-07e3-4fd5-bfc9-acf910fd11dd", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203087, "uuid": "dae2acc9-3823-4a35-9038-e37585545968", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203087, "uuid": "33ef8ca0-6a05-4915-9f9e-4cce57b26903", "value": "document-1292116720.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee446d06-9272-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617230788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230788, "uuid": "dad231b3-6270-45cb-8c33-18a77189eb71", "comment": "Malware payload", "value": "01d869c7496404c5e61e1fb4ee4ca93f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230788, "uuid": "f7429af0-3a14-4546-9014-68481cf2bb9c", "comment": "Malware payload", "value": "68aa732d7929da4f2ea081b33bc9a3a1c318c616b163fec19df72e566d2f40df", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230788, "uuid": "99d65b8b-4b6f-4e98-a98f-d979d478fffb", "comment": "Malware payload", "value": "354557ea59ee77bbfe42324af4d860d72d9fb5bb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617230788, "uuid": "037de589-533d-47db-9927-68c0e5750cd8", "comment": "Malware payload", "value": "3389ffd7daff606fce7a94319dada1ad22b38c41753c876312ca304645212105a76232e284fcab510c7e36c89ecf7a18", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230788, "uuid": "f8827625-fa16-4fef-92bd-073af112be1c", "value": "CB248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230788, "uuid": "52743e61-b2c9-4c31-b4ab-111781b5780f", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230788, "uuid": "3c1a92b2-869b-4f44-b312-1e5fc93874fa", "value": "3072:M6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:MoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617230788, "uuid": "c919c640-9d55-482a-a835-70a399d14ee4", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617230788, "uuid": "aef16558-5c0b-4429-b922-90b436bd32b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617230788, "uuid": "481edb34-5ba8-457c-866f-19ee72de42ca", "value": "68aa732d7929da4f2ea081b33bc9a3a1c318c616b163fec19df72e566d2f40df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2973afb5-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232176, "uuid": "fa4d3e57-6bb4-4ba7-a320-e8332415152d", "comment": "Malware payload", "value": "dec98a9d8c836ff48a38168c0109ca8e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232176, "uuid": "7b648358-ba30-43fa-bbaa-7fe1c4812711", "comment": "Malware payload", "value": "68c90d446f340df4c412e7f73c38e74b66319aa98129069926b3c92f9e597a24", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232176, "uuid": "d0b2333d-a3cf-4569-a61b-f1e75a9c49df", "comment": "Malware payload", "value": "3120870345397af64eaf70880627f6448a06d1b9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232176, "uuid": "fe19e297-9656-47ed-85bc-72013cf02c7e", "comment": "Malware payload", "value": "fdbfd1dacf0a4cd470248ec183068b184bec71b3ba7b3b761161e3a903c1e98e8d53d00858924ccbd6583cea2c059139", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232176, "uuid": "f2b45cf5-2e4f-44c8-baec-6adbc2eacc9e", "value": "7014BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232176, "uuid": "57f2e5cd-2965-452b-9bbe-dccb78f51a5a", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232176, "uuid": "6ec41b5a-2ce0-42ed-ac6c-79aa9aac2f73", "value": "3072:mopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:5pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232176, "uuid": "1d591a27-e29e-4bb0-b0f8-f569af7418d8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232176, "uuid": "66800ad2-eb0a-4ced-9177-aa3e5252a3e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232176, "uuid": "48d74720-cd23-42dd-8ba7-49a6bfa2865a", "value": "68c90d446f340df4c412e7f73c38e74b66319aa98129069926b3c92f9e597a24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b6d8cb-9240-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209029, "uuid": "56b7539d-5bc6-402b-885c-a5e4145077e2", "comment": "Malware payload (IcedID)", "value": "f7c52191a4508e3ba7df688bf9ea5def", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209029, "uuid": "6203c040-e05a-4ede-b64a-00e160c31a34", "comment": "Malware payload (IcedID)", "value": "68dd95e84f8ce5c44832259fd54cc0fe9c6cca96268a0ebd53bbe4d4a5d3d5d9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209029, "uuid": "f97def3d-d899-4bde-9593-ed10b3484f8a", "comment": "Malware payload (IcedID)", "value": "ebaeadf19bb0ace3f90ba59749db9330f9ec5a7f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209029, "uuid": "1b9bae83-e0d9-416f-9ff9-3baed100da27", "comment": "Malware payload (IcedID)", "value": "81607f739f534e02c1e88004c0e257e8cc85eeec642df3775f71b17721c9976f912f5372c0a6858b699722a9cdafb21d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209029, "uuid": "ede3b963-89ee-400d-997e-bafd3ed3b5e6", "value": "BDB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209029, "uuid": "e7b14473-3c98-4901-b7c1-48b1230c1f88", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209029, "uuid": "0246228e-7070-4e5c-912b-29cb9cb45a53", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209029, "uuid": "32b6f5eb-f11c-4cb7-a28b-ec2706cc9858", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209029, "uuid": "687ec4d7-5dd4-4726-a6a1-87aa4ade7b04", "value": "document-1724252443.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c46a5af-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212934, "uuid": "4260a80b-eb93-4713-8051-c427266e7cd4", "comment": "Malware payload (Dridex)", "value": "5a430c65ce3d245d2898a0d9ae9c3673", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212934, "uuid": "a22bb9a4-fe4d-44ef-88db-fa633fd993a2", "comment": "Malware payload (Dridex)", "value": "68ef8290ad7617ecfdd8cfef7b316a43396dfc3d08e6789823bf22bca197ce65", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212934, "uuid": "456f7137-3b54-463e-a9a6-699554df5169", "comment": "Malware payload (Dridex)", "value": "258e7887890c2420788d926e88079e72856f66c1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212934, "uuid": "53cfa49b-adc9-4ea0-bdc5-a17581175c12", "comment": "Malware payload (Dridex)", "value": "2d339c1488c352357e834d8f362608cd2aa8e644a34f2dd44b1b7041ce8d7d91c3cff37011c4842a4d48bce4057c03bb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212934, "uuid": "9450eb46-cc73-49ae-a14d-50ca41f7b18e", "value": "A6248C5FE339E486FEE3CAF54186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212934, "uuid": "50febb05-50ba-4327-86ff-2b593225c081", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212934, "uuid": "41b18fcb-87a3-41a5-99fc-349d6ed31f92", "value": "3072:G6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:GoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212934, "uuid": "5460d450-aab1-4fc1-a931-654b58296e4e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212934, "uuid": "9226bf4f-3a31-4778-9a16-3ef5c30a49fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212934, "uuid": "72b4dd26-1edf-480a-8ef9-d397075afb3b", "value": "68ef8290ad7617ecfdd8cfef7b316a43396dfc3d08e6789823bf22bca197ce65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df32ad6-91f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617174711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174711, "uuid": "e03373d6-4095-421c-a432-f150dbb62c4f", "comment": "Malware payload (Formbook)", "value": "5ceb8db06412b0ba9a81fda8edbf7c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174711, "uuid": "033c45c6-f155-406c-beab-3ee13a0e7688", "comment": "Malware payload (Formbook)", "value": "68fa77befde4e147cc7bc2fb142306a94245adb49c4ccca175f12f29414ce3d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174711, "uuid": "4a89f3c9-18cd-41ca-b97b-85bb9832fa25", "comment": "Malware payload (Formbook)", "value": "5bf7a8425a33b41f495c37b42dc8689ebed1cac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174711, "uuid": "d622ff8c-3b7b-4590-9fc4-0dc1a1d480e0", "comment": "Malware payload (Formbook)", "value": "8772e7e2d91cdcb9596d73b6cdcdef83c2aebb35ed27bf44f89d97491ea6c4fdc672776e83f700892ed838d6709dde99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174711, "uuid": "034cb70a-105a-4d2f-b128-f916425deb73", "value": "65C4DF013344BAF7D26A62B54FE1AE15A6ADD4722F2F49C7A3F54E0F4C34A819334792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174711, "uuid": "9e3804f8-b297-4fb5-bfe4-68741a9139a6", "value": "a0b4c2b87349f40fa8e8d68dd69d3c81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174711, "uuid": "4b9a69f6-d103-4e6a-b3d1-fc93d5cb704a", "value": "12288:ztP3ejuaqsTAiBs4paudV0S4PqjG2lKG2BFeWF:ZPujua1u4paudV01qjG2lKGoFeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174711, "uuid": "efdd3687-c3a6-4c64-9f07-a81a727db46a", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174711, "uuid": "bbc9fd20-ad01-48e1-8800-a6f73de3da38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174711, "uuid": "56fe34ff-f653-4668-bf0b-5fef950700ef", "value": "Order Drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b34d558-924f-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1617215616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215616, "uuid": "6e6c09ac-fd23-4fb3-81b2-24185c016223", "comment": "Malware payload (BazaLoader)", "value": "fae1cf371d316ddd6918efda8b993f72", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215616, "uuid": "dad00791-ae74-49d4-8611-cc98eb24b984", "comment": "Malware payload (BazaLoader)", "value": "6903331c68ae731472d0096e25395c8057b28c44304eb9d2c8c9102cff5db0a1", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215616, "uuid": "5a0469a0-f9b7-40f0-879d-63b926d03e78", "comment": "Malware payload (BazaLoader)", "value": "3df9e80f1822a9474a9cb272245482e279dd62ca", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617215616, "uuid": "75407f3e-6cb3-4b21-bc0c-0fc8e541f332", "comment": "Malware payload (BazaLoader)", "value": "2308fcd562a248c808c36619fc2b60ff809785a6d20f6494bf46eeb3b4c3db09650c4fc7e72c75a80f7d07ed291b444a", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215616, "uuid": "e8cc3d23-8402-4365-addb-6507831d65ff", "value": "00C4AEC16CAD96F7DCBBD239A5844E3D2F3028D246C59ACF9508870591F33C2B6A67D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215616, "uuid": "b5bb2aad-d510-4849-9c0d-5ab0134746e8", "value": "12288:B5uiYusYXOYf5ip4hLFLTQAZVoblWXaLRT:B5OE/PUgwTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617215616, "uuid": "cdc8b4fa-7747-43c3-b299-b1743915ee82", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617215616, "uuid": "18abb21e-2211-4f68-b916-4ee4e1280d3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617215616, "uuid": "8d2cad23-06a0-41ec-a452-71f13adb271a", "value": "fae1cf371d316ddd6918efda8b993f72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df46b7f-926b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617227459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227459, "uuid": "09d7a2d7-118b-4e9d-bdaa-098c1ff8700c", "comment": "Malware payload", "value": "a52d84e0f5d0b6111dc1bbe0d3568e4a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227459, "uuid": "4b2dd899-fcff-413c-82c9-ee2bf5c6ffbc", "comment": "Malware payload", "value": "6959a91c603190aff84a6e59d8d90db910d35041705fbd6a874e24a8f0d43fc9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227459, "uuid": "ef9f9701-bd19-4fc9-aa49-d22fa082489b", "comment": "Malware payload", "value": "1adf03e06d5e948f7eb7f427b82848e4baed5a41", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617227459, "uuid": "aca0ae25-15c7-42d2-810d-105bf37d19ca", "comment": "Malware payload", "value": "c6b5198abe05d45b90374cf6618e6280edc475160fde392bd0cddf321a508f5153f8b84be3c00e4d4bde4eef9f15b003", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227459, "uuid": "909791df-a5a9-4e1a-bf3b-6464aa6ca0f3", "value": "8A248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227459, "uuid": "b60fcc27-f646-4570-a4ec-0bdc49b4283e", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227459, "uuid": "8a8a0e75-00ce-49f0-9696-80a045eb5bff", "value": "3072:U6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:UoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617227459, "uuid": "8df225fa-e4cb-4672-b575-0166910395f0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617227459, "uuid": "4b57c8bd-7e45-4a6d-97fc-ba100a4fd574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617227459, "uuid": "5dd3b4e1-9c12-49f8-8738-c245733ab102", "value": "6959a91c603190aff84a6e59d8d90db910d35041705fbd6a874e24a8f0d43fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4d2aaf-91cf-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160752, "uuid": "cf3b3590-1de5-4fd9-8100-830bc241721c", "comment": "Malware payload (IcedID)", "value": "7d2a067b57e2dc1f375f271ef5f067d8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160752, "uuid": "c4f4c437-ddff-4829-bb4b-5764c111207c", "comment": "Malware payload (IcedID)", "value": "697d0a11e9ccb426c1c039ee1951708b83407f0e373272607ca7cd8663f7a20c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160752, "uuid": "70943f3e-ac59-4d5a-8241-634e4652c62e", "comment": "Malware payload (IcedID)", "value": "26acad79427c623da09b6cf5e61c06b478cb04a4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160752, "uuid": "b20b8bb2-94b5-4fcb-bb1f-d947e5265f55", "comment": "Malware payload (IcedID)", "value": "e8694417f80096c3a346f728b128eba45955d9d85cd6be3d90569e647f6a5743ec871c110dacfdebb91e1e1ecdd6f95c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160752, "uuid": "2e865d9e-4d48-4a86-8fc1-3ecf15fed895", "value": "E9B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160752, "uuid": "481ae87b-a926-45e1-a5ec-64d8a5a46d06", "value": "3072:i2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:izxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160752, "uuid": "1eac5f6b-6b45-4961-a4f2-95a7e618823f", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160752, "uuid": "48c9b7e5-35fd-4629-906c-04ce0aee0811", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160752, "uuid": "d2ca9d3c-2c26-4677-884a-739de77e0770", "value": "document-695015223.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0563e9-923f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617208528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208528, "uuid": "d2bd4431-674c-4fc0-acea-6ae9d68eec72", "comment": "Malware payload (IcedID)", "value": "137f07339ad2a60804c7646455686878", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208528, "uuid": "6c42b0a0-83f8-491c-990e-1fbe9dbf4f2b", "comment": "Malware payload (IcedID)", "value": "69952de5c84d4e1b2aec321a76841ea6b0facbd89b39fca0326d339a506ee45b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208528, "uuid": "9c0c4813-0762-4ba2-bcaa-32188a5420b9", "comment": "Malware payload (IcedID)", "value": "4672481bc94b3ac00ed6160ca53d7a0e1421bb5c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617208528, "uuid": "c3cca4f6-d281-42d3-858c-067fb81f9907", "comment": "Malware payload (IcedID)", "value": "2e347c140e945c287104d303429de52a6e38d6a41f2ef37c4b00f3a07234d5855f74120dc89c9f824243a6ac6a40b09f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208528, "uuid": "22b68dd3-cf7c-4e54-a829-0fc45b20134a", "value": "1AB3C0AA1A11B714D7344B3CBF86C83AD804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208528, "uuid": "4ffb3409-94bd-46c8-af6f-ab70d5af6aa6", "value": "3072:u2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:uqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617208528, "uuid": "ec757ad5-0992-494a-8dc0-1aa78b312ea5", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617208528, "uuid": "8ea327b6-46d1-4e56-9390-e10124e33dbd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617208528, "uuid": "543b417f-c300-4fb2-9339-e8b0cea43a4b", "value": "document-900539577.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c2f1da-9261-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617223120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223120, "uuid": "f2e2916d-6b28-4600-aed7-4901c4fa326d", "comment": "Malware payload (Dridex)", "value": "458b784a2ad65232d4b544065e15f978", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223120, "uuid": "7a8a92a8-08a5-47ce-ab54-b66055828a99", "comment": "Malware payload (Dridex)", "value": "6999fa4acdc0e1c9ee09d24801a8a775f59ac7deeb42dd5340873d53717c57fb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223120, "uuid": "c3fa3f3f-58e8-4885-9c6c-049fab244f5f", "comment": "Malware payload (Dridex)", "value": "f51b033f5d651b75ae48667769c67e638cf5b123", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617223120, "uuid": "17b67754-261c-429f-9c4b-9a4e24914e9e", "comment": "Malware payload (Dridex)", "value": "7a59d1fd46f424d42d310c8eb82b17b30ef8ddb843701521fa0b3c09c5fc16c7dd4f8b78d8bfe7632984eba0fe273900", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223120, "uuid": "b43c7f16-2e9e-4b67-8bc3-9720f048690c", "value": "35248C5FE339E486FEE3CAF44186A72296A39C92436F580DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223120, "uuid": "1ce4a521-e9c1-470e-b259-ff84d5682ead", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223120, "uuid": "743a8080-65a9-4039-b3a2-9e933c873dac", "value": "3072:B6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:BoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617223120, "uuid": "26f81bec-51ee-42df-b8b4-342fb3d41062", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617223120, "uuid": "5a687967-d299-4332-9b0f-c5409a3b490c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617223120, "uuid": "5c5846f2-a060-4e25-aa92-a5ae9244a299", "value": "6999fa4acdc0e1c9ee09d24801a8a775f59ac7deeb42dd5340873d53717c57fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02c62b3-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163656, "uuid": "895567d3-d163-46ee-9e8b-68281e607551", "comment": "Malware payload (IcedID)", "value": "f6290a4b7967a43790d7d733651b4e02", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163656, "uuid": "42d015fa-7b50-4bd4-86d5-4895a0bf1a61", "comment": "Malware payload (IcedID)", "value": "699b6bd20963e76e0b5d4388b57fdc9f405c40ff65007a08e306aaf04e6608b6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163656, "uuid": "6d74cc09-a784-46de-ba86-801cf5377757", "comment": "Malware payload (IcedID)", "value": "bbfd0b5bd0db2f4cfd26dd31d53ebdee49b4f63b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163656, "uuid": "e93af6f3-4487-487f-9395-ad9547276b3e", "comment": "Malware payload (IcedID)", "value": "c9dc0c21b61cc11feb7cf9b719695da000862c0f6a620c6170b2ee48a429b4ae3f10d4e15a72ce9cf160f780deb2b7f0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163656, "uuid": "1b0f5fd8-8f69-464a-8e6b-723d489aecb9", "value": "8AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163656, "uuid": "087e9950-febe-493a-8bfb-f90554199c65", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163656, "uuid": "c0f86296-a9b0-4409-b9c9-410356ec278a", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163656, "uuid": "2e05cb0c-a50e-46f2-9c3b-423288ef15d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163656, "uuid": "ed0535bf-2011-43c0-a683-45ea2109d49c", "value": "document-462775153.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c5c213-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158234, "uuid": "280a3a09-61bc-4af1-b15b-4593e01811fd", "comment": "Malware payload (IcedID)", "value": "4166bdfa7cd863acba80859510e9d597", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158234, "uuid": "950c9fc9-6a16-44e9-a995-4c220de00107", "comment": "Malware payload (IcedID)", "value": "6a277cd61aee29568c5d3dd51f207a0a60acb4cdc85276a17e9341baaa7cc56f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158234, "uuid": "3766aceb-e424-4b38-8c54-94557a540d77", "comment": "Malware payload (IcedID)", "value": "26387bdd4e0191c3ce9d972a91ac2705e4354872", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158234, "uuid": "c0dfc87b-cf2d-4490-aef2-49d577832b13", "comment": "Malware payload (IcedID)", "value": "4d55984d8fe0435d75993030420f257bdfc11c16e79d5bc3af1dcecf3127ce7a5fbef74c6d9c817de656b5f20e64961a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158234, "uuid": "51b2502b-991c-4be4-9d65-66f95b4d11cd", "value": "4AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158234, "uuid": "6f0f9887-4987-474d-82fb-afd62a99ca3b", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158234, "uuid": "e7f99f5b-0460-4114-beff-e0946bcb30bd", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158234, "uuid": "1008627e-a372-45c0-acb9-b1d4b2853c5e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158234, "uuid": "4862f011-82ef-4574-8bbc-4237f40a9d97", "value": "document-361508829.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c62420c-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204693, "uuid": "3aa00fe5-7e7a-4b68-bcdc-7d2f95538cd1", "comment": "Malware payload (IcedID)", "value": "8d1e03331485ce827a0e1eaca479c9dc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204693, "uuid": "df56ec25-44ab-46df-930b-b00531bd83b6", "comment": "Malware payload (IcedID)", "value": "6a5cf5e2e990c4c95a435f0dd8e62f571e53053778671452daabd6bbda1b8c1f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204693, "uuid": "72139d03-1bc8-44a4-b415-87f02016e701", "comment": "Malware payload (IcedID)", "value": "4de07ac958bf87f72a6f9eead996f8bdb2a47461", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204693, "uuid": "dd1b8843-607e-450a-b988-df47c053d21c", "comment": "Malware payload (IcedID)", "value": "3e44d4f00d15aed8daa03cc9a77aafeb4371485196ee9e6bf0743aeb5748bb2fcf3a8b9258ce3e3ffe87670f0ac2c2b7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204693, "uuid": "8b808731-851d-406d-9a57-f1d287a65db7", "value": "CFB3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204693, "uuid": "8c10ffec-7ed4-48e0-b39b-398d59633d9f", "value": "3072:e2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:eqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204693, "uuid": "869f2055-6985-4b67-9077-a20437146108", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204693, "uuid": "d8129004-2555-468e-98c0-737ca7c86136", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204693, "uuid": "f216380d-bf4c-4316-aad5-855d7f5c8c30", "value": "document-181778706.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c24b2c-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216954, "uuid": "f374121e-28ca-418a-84ae-310ec6a356ae", "comment": "Malware payload (Dridex)", "value": "44d6f920ac5df7fea46d8b284f9f1e53", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216954, "uuid": "5bc7cbde-f4d6-48e8-98e2-bde2db5cf036", "comment": "Malware payload (Dridex)", "value": "6a5d1c85bf1915fc280dfbad8e294a3e9813cb7c7a2ed5e07fa346392a48b719", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216954, "uuid": "8db877a0-6f21-401b-a71c-2be95d9f7a5d", "comment": "Malware payload (Dridex)", "value": "837ba7fbf4043aa18cf560cd414027aa46061655", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216954, "uuid": "cfcf141f-92ec-42e3-a6a7-e24698578540", "comment": "Malware payload (Dridex)", "value": "f71b6f2cdda0f90fd1fadad8f2497c9ae699eda5b18173dfbe7448882d20efba998f05f67f1a138005ce672ae97e3de5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216954, "uuid": "12901eea-974e-450b-ab45-bc2c3e1d535c", "value": "7914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216954, "uuid": "0711a6e1-8b37-4860-9038-b45ccc61eb0c", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216954, "uuid": "f8640a9d-8e4a-49af-82ee-6b81cbdfeb06", "value": "3072:Eopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:7pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216954, "uuid": "075a6931-7324-4db7-a5d6-c5faf9f1a991", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216954, "uuid": "9011d885-0e23-4a21-83da-d59545c05b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216954, "uuid": "08e54013-c6b1-4a78-9e3c-8005c7ce05aa", "value": "6a5d1c85bf1915fc280dfbad8e294a3e9813cb7c7a2ed5e07fa346392a48b719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99adbde9-9255-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617218191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218191, "uuid": "834c5a72-4d41-45db-814f-b547e9be92d9", "comment": "Malware payload (Dridex)", "value": "35ad28f5d39e6ad2176366d6dd103bc2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218191, "uuid": "d71f9dfb-b95e-4b28-8a6c-b169e876ede9", "comment": "Malware payload (Dridex)", "value": "6a6edb63a1a752da90914f9f1330488f1842e9bef1bd2b5b608fdabcb19363b4", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218191, "uuid": "6a15f4a6-801b-425f-8cf4-abb3b75dfa9c", "comment": "Malware payload (Dridex)", "value": "1b8dce8c02755398685419ff62a6f0f44a7d5e58", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617218191, "uuid": "dba2ec95-88d0-4d15-9427-50fb8246e5fb", "comment": "Malware payload (Dridex)", "value": "51bf4923c0a94f058513e1e73c5b81dce646a37dcdf7cd12d5ce63aef59be52e8945da2690ecb6beda05661fa1c1cbbd", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218191, "uuid": "0a7b5a4a-e245-4979-8793-d67a4f63754e", "value": "FF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218191, "uuid": "4142cedc-774d-40c4-8446-3d73091095eb", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218191, "uuid": "5619d234-56b3-4bf0-a1b6-7f776549374f", "value": "3072:Popj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:gpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617218191, "uuid": "cb15875a-e96c-47e5-9d5b-6ac88bcc7671", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617218191, "uuid": "38d992a3-8f20-486f-89ba-71afa6606397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617218191, "uuid": "a6cafb84-8826-4d37-bc71-48fd3d0ddd56", "value": "6a6edb63a1a752da90914f9f1330488f1842e9bef1bd2b5b608fdabcb19363b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a1486d-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213059, "uuid": "49639ece-91b3-456b-bf99-ab2539486166", "comment": "Malware payload (Dridex)", "value": "e5a274f3c78791160d467a8445f5780d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213059, "uuid": "e83ce987-92fc-4da7-b847-b61e5e16794c", "comment": "Malware payload (Dridex)", "value": "6a7f998b6b40964091f8f4a1c91ce3312fbf5d9ce05247441fbb77f48510689a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213059, "uuid": "2197d5f6-8860-4c1f-ba73-550c16df5f5a", "comment": "Malware payload (Dridex)", "value": "185eaa8352bb60de5e4fcab316a0caecf9c4c8a3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213059, "uuid": "229aaea2-8088-4dfa-8ddf-1a5fafade6d0", "comment": "Malware payload (Dridex)", "value": "5f98d81869e80e77427ad5eecf2c8e65ba3f6d60940eacad3069f075d461d03576834c99e8ab8c523688fc051d002f72", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213059, "uuid": "efcbf447-d900-4cf7-8c20-48c29fe55b66", "value": "79248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213059, "uuid": "4cb21368-c0a4-424e-a6a9-3d2ab1f596b1", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213059, "uuid": "3f94fa82-e24b-4725-ac3d-32dedc1a5327", "value": "3072:76TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:7oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213059, "uuid": "7c81538e-c286-4171-bc2e-89677082db29", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213059, "uuid": "f4033a05-ae74-48ee-8098-28e2b78ceab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213059, "uuid": "4331356e-844a-492d-9008-6ec0c6f238e3", "value": "6a7f998b6b40964091f8f4a1c91ce3312fbf5d9ce05247441fbb77f48510689a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f14324f-9243-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617210281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210281, "uuid": "0157a104-142c-4cdb-a8ac-74b7c992e500", "comment": "Malware payload", "value": "8b1e8a90aae1a53218dbbcd726e0ab40", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210281, "uuid": "d546af34-ae70-431d-b8f7-3bca52bf9a16", "comment": "Malware payload", "value": "6acddb98cb2f2d8f0f6e99ce1111b3e03bc9f59f4680d90cbc55d55d4c83103f", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210281, "uuid": "f200cafd-f120-49d1-91d7-cd64e7501d2b", "comment": "Malware payload", "value": "9250d63218830f03ba04f08b7db223914a106110", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617210281, "uuid": "21242ce9-ddb7-4188-8444-a6e16d78a7b5", "comment": "Malware payload", "value": "29cef75aab5c685e303281030e7040052a2ee56ddb3bf50c5213f0c9f8e32e0061969dc616b4d6069c178a2077eaad0b", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210281, "uuid": "8e4835fe-303e-46c4-a930-a151470237b2", "value": "22E2E168C92DF88FC127463CE37B09E1F59E13020A92901B355AB9AED73451377B1A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210281, "uuid": "6e4d6cb4-2ae4-4b4a-8974-bc8674f7df2e", "value": "768:Ah7O+OaGL/iOIkM2cqh6/hEtbOs3j6nnKV4awmv9NC8U6tANqcQQeo5O:UfOlitkMH1/hEs7nnKVtx/ztANQQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617210281, "uuid": "991d3c90-09d5-4336-b1f6-cbb08567e861", "value": 33747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617210281, "uuid": "9a865ee8-a50b-4bcf-bb8c-1e107fd13b86", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617210281, "uuid": "a74fea87-d6d9-452e-8067-cb2ec8167fb9", "value": "Sales information for Triststate Poewer Supply LLC, 8.21.20.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a084eb1-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232123, "uuid": "4faaae54-6cf3-4920-ac42-5a90902b8958", "comment": "Malware payload", "value": "ee6198f4abfa5188d0545b0803e70d63", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232123, "uuid": "5cb0f5f7-9405-4571-9aff-c0098d037dbd", "comment": "Malware payload", "value": "6b1a1eafdb256c03b7369e43be39985bd3bb959b97454ed5c2245df99c5b949e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232123, "uuid": "eb8c4d0b-3def-4d9b-ba4a-61727c160696", "comment": "Malware payload", "value": "a8b00654454a6a587a0da8409c902b02c988cfbc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232123, "uuid": "1450248a-c9e6-4c76-8379-84aa54357bd3", "comment": "Malware payload", "value": "9d4ca9ca286a03954b089d39156d0cfbdf0196a0a5fdd1fbbbb63a6e4490c12ef0063ccedd5c8b96c235dde30f82b2b3", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232123, "uuid": "b568daa0-df90-44f4-82b0-07b003778a33", "value": "3B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232123, "uuid": "1d85b1ef-594f-44a6-b7dc-fb2497f113de", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232123, "uuid": "6af19086-2f7c-4ca2-97cd-b8a2794a75fe", "value": "3072:uopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:RpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232123, "uuid": "3a190d23-77ee-4092-be18-bdd4530aac20", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232123, "uuid": "d425d434-c317-4df6-94b9-e7d8cca5550a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232123, "uuid": "d440f3fd-de37-4d72-a8da-41de7de91183", "value": "6b1a1eafdb256c03b7369e43be39985bd3bb959b97454ed5c2245df99c5b949e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "decb2731-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204992, "uuid": "58801b84-28f7-4d47-ba61-a9f8675f5060", "comment": "Malware payload (IcedID)", "value": "6e5df839d1231fbdfdc3b02e53bebc50", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204992, "uuid": "ffc1107d-0547-4749-81c2-60a77baa3dfc", "comment": "Malware payload (IcedID)", "value": "6b4e7e6aea4dca87dd63811417022cfa344b6ca011cf303d97f0df98db692aff", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204992, "uuid": "0b07f726-0498-4a22-b4ea-d08a7cf29df2", "comment": "Malware payload (IcedID)", "value": "01c199d629defc53e4e6c420082a0b93867ad4e7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204992, "uuid": "3bd7201e-764e-4b7e-b016-87861469392e", "comment": "Malware payload (IcedID)", "value": "2068b33cc377c0a79f6689ba27e77d9c77679b2994346d16585ab5a2589a2a29310616b9917b20b27c4d13545ff0a5e8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204992, "uuid": "59548d17-6d85-4f32-9934-a5ebd1a895ae", "value": "E0B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204992, "uuid": "7242602e-d840-4c6d-a52e-04766c21241c", "value": "3072:22S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:2qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204992, "uuid": "7ea1be4d-6852-4082-be73-1e8959b79c3a", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204992, "uuid": "e5b95780-96a8-4d27-8b18-326fa6d53feb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204992, "uuid": "690dd812-5678-41a8-bdf9-cf6b127c96db", "value": "document-206400547.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce0d7a7-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202117, "uuid": "898cab82-7cf6-44a5-a8bd-3944715f91d5", "comment": "Malware payload (IcedID)", "value": "2db03871cc671a0e29f2287fbb3def1f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202117, "uuid": "5dd84ba0-82da-4e7f-a36e-95aca9128835", "comment": "Malware payload (IcedID)", "value": "6b50d1128628777f2780910967bbb0748e2941808b617252b3f8757cae687e00", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202117, "uuid": "d70edf51-6dd5-484a-b6b1-a37b9a61d0c6", "comment": "Malware payload (IcedID)", "value": "85e0269bf42d167f3f560a85e0fbe17c34cb88c5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202117, "uuid": "0c96cf34-81c0-41f1-92a1-64ca26189919", "comment": "Malware payload (IcedID)", "value": "c82c01dadc272e3f8f681a244f91d0459392869c3e35a6faaebed13a96ec08ffa265848ae14b3f508f3cc5bd8257a26d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202117, "uuid": "fa4d26f8-580f-4726-9467-dddf81f33536", "value": "08B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202117, "uuid": "5dc138fe-754b-48e0-867e-9a72061df489", "value": "3072:m2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:mqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202117, "uuid": "01d051e1-f148-4201-a199-b5e0ca3f5afa", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202117, "uuid": "42abf45c-b110-40af-bb8d-82b986f6a8e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202117, "uuid": "28bd8bdb-16eb-4310-97dc-6a0420f801c6", "value": "document-629116763.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a11c837-926e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617228822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228822, "uuid": "deb7988d-1b77-484f-9ec1-ab462a130f78", "comment": "Malware payload", "value": "850fc8f65fc071c93590478a16941ea0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228822, "uuid": "19fa9f20-c253-4ce4-8786-ef62f8d69505", "comment": "Malware payload", "value": "6b7ee24986e364bacaf4e379b8e10ac1f5f3fe1198de03a705f78620fd95060d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228822, "uuid": "4494603d-a6c0-4faf-885b-b080aee9e024", "comment": "Malware payload", "value": "ee0c54d78404b0a954d4c767b52beaa2960cd876", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617228822, "uuid": "a5aae0aa-e995-4711-aba9-5bf22020ee61", "comment": "Malware payload", "value": "30cf1ee1e085d6b882e7f8cb3f909ed925649e979743d1190f4069e6b85952ca553056eadcc53bf49249bc06baa4ce05", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228822, "uuid": "b82d6cf5-16ef-45a3-afb2-263acb442989", "value": "34248C5FE339E486FEE3CAF44186A72296A39C92476F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228822, "uuid": "3b53cf29-0e96-4e8d-8113-19a45ea8eedb", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228822, "uuid": "1f5f8cde-25b4-4d16-b41d-d29bbbb82039", "value": "3072:W6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:WoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617228822, "uuid": "c8cc5c04-c884-4959-8dae-9f6ca09cd2e4", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617228822, "uuid": "9d46e920-c410-445a-a506-7c69477e176a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617228822, "uuid": "29daaf74-d01a-4ec4-8326-9076d5cc5ced", "value": "6b7ee24986e364bacaf4e379b8e10ac1f5f3fe1198de03a705f78620fd95060d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2862a844-9242-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617209840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209840, "uuid": "935fba0f-6788-44c2-925e-f3fd04c6e368", "comment": "Malware payload (IcedID)", "value": "9123f28a46c745e75395e88696372857", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209840, "uuid": "0f555cf0-6b84-491c-b1c2-980643962955", "comment": "Malware payload (IcedID)", "value": "6b936541da204ca4cc045913f8a06067a7b15cb00303667eadbca04eb20054f9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209840, "uuid": "811de236-5e8f-4316-8b48-1c8ea6acd264", "comment": "Malware payload (IcedID)", "value": "6ee3f98b24e267d83d0234c4dd9fbcdf42d961a6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617209840, "uuid": "d1c3e2a8-e7ea-42d3-b7b2-142db5923053", "comment": "Malware payload (IcedID)", "value": "f3a5ac5eb57c349d87778078bbc6b72fb74d5f9fac496c8ed0810d07ecc08388b680fe8ddd21a4c8b4042f3ad867c887", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209840, "uuid": "852c0219-790c-47e5-9b5a-64ed684ed807", "value": "03B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209840, "uuid": "56f8027b-5390-4864-8431-d727d7b6add3", "value": "3072:w2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:wqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617209840, "uuid": "42605e5e-51ef-4f19-92d6-bee33231173f", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617209840, "uuid": "4dd41916-bbd4-4b7a-9e99-5e9971bdfcf9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617209840, "uuid": "9c1b802f-3901-4432-9984-9f5b71e8b772", "value": "document-2020789863.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff29501-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212886, "uuid": "acafc248-41d7-49d2-895f-ce1d66ceeff0", "comment": "Malware payload (Dridex)", "value": "4a796cb47c58e1da6a21651dcb29529a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212886, "uuid": "89b5f01e-c264-48fc-9ce1-8ca9d3f39a0d", "comment": "Malware payload (Dridex)", "value": "6bbc2976bbc334d8581db737f9334418012bc05b0484e58f552794b41351ec82", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212886, "uuid": "ec2fb3f8-9d86-4224-8c5d-cae228d9dd64", "comment": "Malware payload (Dridex)", "value": "ce39342c4955abedaec36a8119f151da858b8555", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212886, "uuid": "4bf0cb4f-9c5f-44ea-8f08-5bdf5a788f87", "comment": "Malware payload (Dridex)", "value": "a663cec318ed34bf95f186aeaaeb9dbfddc208aeec51b2af3f48d10e6167850871192e638d1a85568003ead0706f1b77", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212886, "uuid": "449aa261-c7e6-4ab2-8130-1ad5eb60da9a", "value": "CB248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212886, "uuid": "281cad1b-ba68-43e8-9dc8-91f42ad3bf7c", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212886, "uuid": "58901242-e073-4551-bd60-826eff44442d", "value": "3072:W6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:WoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212886, "uuid": "03e94a62-59f3-4d82-a1cd-6b4caa31ba9c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212886, "uuid": "231b64fc-c8bc-46cd-8238-39f3c9b8c3fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212886, "uuid": "680097e8-581a-4be1-b6b1-26b0e992f7bd", "value": "6bbc2976bbc334d8581db737f9334418012bc05b0484e58f552794b41351ec82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3347a1e4-91d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617163473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163473, "uuid": "dc97ccfe-29b4-419b-abf4-a032ebcb4525", "comment": "Malware payload (IcedID)", "value": "f292c3178af0eea110e7e50cf87efea8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163473, "uuid": "7d21bbbb-3321-41d7-9979-d6bccc1a4e4b", "comment": "Malware payload (IcedID)", "value": "6bc346efa36e9fb70ab7991a75478ca5029dc98ab9b91fba99273eff9d69da59", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163473, "uuid": "20b3af8e-7c4d-4dc8-9b15-936a6a3a326e", "comment": "Malware payload (IcedID)", "value": "40e89e3c123072c927f49cae1d7f24a1a2a6498f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617163473, "uuid": "7ae98575-8865-4a00-bfb7-901dd42e592e", "comment": "Malware payload (IcedID)", "value": "1193c54d2c36495906e7d97dc278ab96d4cd190f2be1e1b7b82298f66edaa24d7a5a2ec4c9422e69511c0a6a5c803fd1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163473, "uuid": "cf4cebbc-9345-42bd-91d8-133cf4561ebe", "value": "8FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163473, "uuid": "ad3a6b69-aa93-429d-af7c-018c7321c4a0", "value": "3072:y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:yzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617163473, "uuid": "723e6c74-f326-4c5e-914b-3eff01875923", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617163473, "uuid": "0143c8bf-9125-4db1-8cb7-a6d756e14cf8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617163473, "uuid": "aa35e1e8-3973-4926-88bd-b798159807cb", "value": "document-1328109973.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a828b4d-9239-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205978, "uuid": "5a6195cb-ef02-46df-becc-fd79e104f840", "comment": "Malware payload (IcedID)", "value": "e0ec5345680d526358db1abfa8cd4bdc", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205978, "uuid": "6376cb55-387b-4c81-bbd8-9d31dc471227", "comment": "Malware payload (IcedID)", "value": "6c23117d5b5a1fd7ce1273b00900926129c86e6be8cd0af3c236d93ace387a9b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205978, "uuid": "03a38fab-abfa-4eda-8481-2eadda139781", "comment": "Malware payload (IcedID)", "value": "1c45fb619f7bb9c63e21ffcf0afb89e8a5e222bd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205978, "uuid": "656ce1bc-d7b2-49c8-817d-c4c945c9a791", "comment": "Malware payload (IcedID)", "value": "0af1a071169cb86ef60a270316176ee7d1a42ca640aee433ff208d16ab75fa2b9cdf7fbcbbfb577e57c11d2cb6943f2d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205978, "uuid": "c4e16a1e-32a2-41a0-ba01-c616362d999a", "value": "26B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205978, "uuid": "b5e8065e-bd82-4304-a642-3cb36be9684a", "value": "3072:A2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:AqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205978, "uuid": "3f70cf91-7b35-4772-9cdf-0e58ea89aee9", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205978, "uuid": "bf0deb22-f9b8-4fdd-a364-6345dc08189f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205978, "uuid": "fe7d0fad-604f-4286-bca5-3a789e55ba19", "value": "document-522405701.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47c8c8b-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617216491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216491, "uuid": "2816c152-225f-4d0b-a052-b0d02ef9743b", "comment": "Malware payload", "value": "984565b993300edb711594c2b4eb2180", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216491, "uuid": "55920c5f-3cfe-4771-b168-db251d54a65d", "comment": "Malware payload", "value": "6c4e74b80e62592293582c50b56347e3aebc22d28a9da1a1f8d108c2abfc5d5c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216491, "uuid": "27f81da8-d849-4042-a9de-c2a7b807966f", "comment": "Malware payload", "value": "d52cd2f9f95984db0c242732e9c548b66fcb45ff", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216491, "uuid": "be77d71c-ef44-4f67-84b3-b0073afdc5c2", "comment": "Malware payload", "value": "032af85e55d6c117dc72a73bddc7219b04d05275a0d3a311a69e787d5c6d934db4fc3d80653b428f724e3306a5617df8", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216491, "uuid": "353f0e2e-d729-4976-b74e-e9ff15fafa5a", "value": "5F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216491, "uuid": "33726d8d-60d7-4dc6-baf2-3bd7186b446a", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216491, "uuid": "dbf03b56-4f8d-4d96-a3a1-9de42a01ee9b", "value": "3072:+opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:hpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216491, "uuid": "b18128a1-594e-4812-89f1-378f26db0b0e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216491, "uuid": "1a8fc75c-7ce1-4df9-a8b0-93225c7ab59d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216491, "uuid": "8c160092-0079-4aea-8a62-029789ee4826", "value": "6c4e74b80e62592293582c50b56347e3aebc22d28a9da1a1f8d108c2abfc5d5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46311b66-9233-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617203448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203448, "uuid": "4de4198c-44ca-498a-be8c-dfdcc8724aa7", "comment": "Malware payload (Vjw0rm)", "value": "673bf2a0da4a18184005ef93615170ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203448, "uuid": "e1e1a12a-9bd9-46dc-9b41-9738cf6f19e8", "comment": "Malware payload (Vjw0rm)", "value": "6ce9729c02932add0dfe28370c67b23496e816d2f489129a89ad62701a36cbdb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203448, "uuid": "a89aaa78-0401-489e-a4e4-e554e5c9ff32", "comment": "Malware payload (Vjw0rm)", "value": "9db0bb4b6b3aa88520b185afacd8ebc52a91af6c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203448, "uuid": "e8cf2116-d505-4122-8883-0609688a8725", "comment": "Malware payload (Vjw0rm)", "value": "b7b8c99a9b2b0701d470e26f88bfae0a4aee5fdf3c4dcee4ec88fce092ab6db66d87f079a7da4303d4a529f49d71886f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203448, "uuid": "56b4b0d9-3704-49e0-9f24-61680e7150fa", "value": "3C81109D284BC63C57D23B8A802DD148CDF648B47E28D2B5148CDAC5360E979C7B29BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203448, "uuid": "0aa2bd23-70c2-45f1-ac49-5fe4a31b5241", "value": "96:SABNo5D2Yk2c24ZRMHXE6/BI6t+Ys+fJYJDdQqR7bJyKhEOS4UK:zSit2c24ZRMlBI6oYs+fJYlfRf1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203448, "uuid": "f6621df1-c24b-40fd-bd39-1d63d4bc5085", "value": 3876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203448, "uuid": "670aefc8-002e-4ad6-8e16-9c0e40e41cb8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203448, "uuid": "7290c8db-81f7-40ae-a437-8ca469386e99", "value": "ord#31803.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39480bab-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217170, "uuid": "7c9bb019-2456-4254-a659-ab610466213c", "comment": "Malware payload (Dridex)", "value": "129dd2a1e5c79bf5a6ec9b1ac4c9dffd", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217170, "uuid": "40ceeb74-0ae6-4f10-b868-9ac78689a39f", "comment": "Malware payload (Dridex)", "value": "6cf27806c25f8e87589c5ffef2bf586f142d79e6cdec65340d6182230ccc874c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217170, "uuid": "80d4a994-058a-4e52-a0c0-30bafb46741b", "comment": "Malware payload (Dridex)", "value": "1554e67b2515b1303ba853ce4406f4b7ed256e88", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217170, "uuid": "9a27141c-af5f-4cff-9c1f-cb7205b1112e", "comment": "Malware payload (Dridex)", "value": "eb6c62b0b2dace39b3eeb22a330eaaff580abd2c52cb334c6e2a9dfdb3e5591a4d3803b84e57ac3e84ba43c3abae72cb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217170, "uuid": "be147a84-7b96-44e8-a80c-286aaf1e59fc", "value": "9914BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217170, "uuid": "fb987d97-aa1f-419d-a65a-2677a9549692", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217170, "uuid": "d83c9cd0-78f8-4d15-927e-48e031147c0e", "value": "3072:2opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:JpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217170, "uuid": "54ae0cc6-acd0-4b44-849f-b51ceedf3ffc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217170, "uuid": "486f19df-464d-4109-83b2-9c81fc78df27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217170, "uuid": "4c18c226-4a73-4481-ad74-d78ab957d660", "value": "6cf27806c25f8e87589c5ffef2bf586f142d79e6cdec65340d6182230ccc874c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4054af4-91ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617174051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174051, "uuid": "5b08b179-faaa-4092-88b2-8dd6c312b2a5", "comment": "Malware payload (Formbook)", "value": "918ef7fefeab69375ca89574c1cdd536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174051, "uuid": "da25c02e-73ce-449a-8160-58813d12e34a", "comment": "Malware payload (Formbook)", "value": "6d1e9e2682482d7d3d3746c5e5678dab00f2e6b9210ec53e3aac20d40af61a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174051, "uuid": "3ad082a4-29cf-4415-96fe-7064a98461ba", "comment": "Malware payload (Formbook)", "value": "195854a89705d4e4e8fc55b8312849ae5f17af38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617174051, "uuid": "ae01edcb-3a42-4fa6-9e71-7c6477d25ab2", "comment": "Malware payload (Formbook)", "value": "35e874869aebfbc7cb72805d8bffa4b2d8ecff797da6fa56f09391ab548f0bc411cf646220c6dd1097c539da8901e415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174051, "uuid": "d66b2083-b7c9-421d-ae70-4819e9c5700a", "value": "8015F31129356849FCEE4EB1009806C32BD3DE826611947FEB547F56CAB2389FDDA2F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174051, "uuid": "c9952aac-7f18-47fc-a525-317073bfb440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174051, "uuid": "24418589-7982-4eb5-896d-2502f24b58ff", "value": "24576:eBcfCBhEStCFJpw1AXst5YtoxQ9En09PZKqK:OpYst5uoLqPgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617174051, "uuid": "9fd88e4e-6050-4a75-befa-492b956d3409", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617174051, "uuid": "7bc0a76a-5595-4c3a-afab-3217007e1971", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617174051, "uuid": "84260a9e-4210-420b-a99d-e443a5044bc2", "value": "PO 2100020608-77003731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3168c7f9-927a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617233907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617233907, "uuid": "9006cf5d-ecc7-43a5-a061-ce6cee3242e8", "comment": "Malware payload", "value": "4ead17530414b627f9ffc5c3f7725b53", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617233907, "uuid": "98731976-2f7c-4619-b740-afbaf895bb2b", "comment": "Malware payload", "value": "6d3c70e195dda8e66546c13bd114506c48a09af17ea9aaa77005992be289f36b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617233907, "uuid": "35dfa562-eec5-48bb-a9dd-240d3d53ef40", "comment": "Malware payload", "value": "fcf8bc462ab859cb6d37f70e5bcbe62ee65c3d1c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617233907, "uuid": "d16fdf8a-80c4-4ef1-a342-092eff29a2c4", "comment": "Malware payload", "value": "ad2fa8ecc36c6d4fe31a9b970a89621132239f62ab5a4eccea26da37d30fa7a32d894a16c2bf39ea6afa72902fe4448b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617233907, "uuid": "8fa48419-7cbc-4115-b4d1-5e60875e9001", "value": "52248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617233907, "uuid": "76a2cb7a-6307-4fed-8d71-498cac22f530", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617233907, "uuid": "c39f574b-fbb3-49c3-8c5e-03227e75367d", "value": "3072:q6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:qoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617233907, "uuid": "196a03af-4f87-4a5a-978f-af803e25e6ad", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617233907, "uuid": "bf89c37b-0511-404b-ab46-a3f4fde1f7f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617233907, "uuid": "8da8e107-f5e1-481d-aad1-2dd5c4507529", "value": "6d3c70e195dda8e66546c13bd114506c48a09af17ea9aaa77005992be289f36b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61782dca-91e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617170422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170422, "uuid": "72e6b2d4-645d-4fb9-9e79-10d4360221a7", "comment": "Malware payload (AgentTesla)", "value": "766d2b885abd5f39db8b81ab131a235d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170422, "uuid": "d4c73c02-40cf-40d6-a98b-166314971f63", "comment": "Malware payload (AgentTesla)", "value": "6d8e5ab510fb1fd7529709fea143f82307c94dfe4ed693cc04c50aca1196a543", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170422, "uuid": "dbad6b2c-b051-48cc-b2f6-ce171a67059a", "comment": "Malware payload (AgentTesla)", "value": "7b646fdf24c89ea07a01d810891f7dd28dec11e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170422, "uuid": "198fce07-d46c-4910-b914-60a1a0e31b58", "comment": "Malware payload (AgentTesla)", "value": "57354b43d7c91f51e4454865ae80c7c7e80d4e22c7f8f7cca11119379e4b85ba42eba0662e8337cda096dd6b0a99ed79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170422, "uuid": "dc7992f9-7edd-4261-a8c3-8e2edb0a7c56", "value": "76E4239FDAC389249B19D4EB8EB3D0158BFA6F193D5984E82C42B850D137DBCB410376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170422, "uuid": "cd040574-d385-404a-aabd-8f51a9aec4c9", "value": "12288:fsnBhmlEhIKR0pXq1YNTI8biFfA20X4EqsmjZFffy0V8xLy9rdNM1:fQhAEhI9a2NsyXWaKy0/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617170422, "uuid": "84ef10e0-62ed-461c-82fc-d35a16f8cf9c", "value": 667744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617170422, "uuid": "f20f4cba-d72a-43db-a4f3-628ba3cdf14f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170422, "uuid": "29cb76b9-272a-43f8-8787-61a0cc42b482", "value": "QUOTATION.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bae8f06-91ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Adwind)", "timestamp": 1617172963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172963, "uuid": "25922ec2-e3cd-4317-ac17-b4dac5067066", "comment": "Malware payload (Adwind)", "value": "9ba5bf84a07fb51dd6104dd0d5b36ee7", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172963, "uuid": "bc4acab3-f250-4cef-9924-fcc246187911", "comment": "Malware payload (Adwind)", "value": "6dc30bcb9a281d1fc845ee2136b06c9bf310992c108c286d9db515817b0a035a", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172963, "uuid": "9559d029-db4c-41fa-9a4b-2684d029f66a", "comment": "Malware payload (Adwind)", "value": "b79dbe3058924296fab3524b2f413045c98dbb30", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617172963, "uuid": "5f948929-e4af-4273-9be2-dc090a0b47ff", "comment": "Malware payload (Adwind)", "value": "5211dd30b5584ae649a526aea5f5ee5fef028810704fba9b3260f33ccc44589063e6720745177a14f42edee419e2a7a0", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172963, "uuid": "5f74f442-c71e-4eb6-8378-1b5366b9bb63", "value": "C12533669E85C1044DF8767160BE28ED265786D7DFB600B1DA70FFFF812E64622BD480", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172963, "uuid": "0ffbf51a-146a-4996-8740-b40598d7056f", "value": "24576:WUiAmgBxjBv33Z66x6pwfgGqvJ4VO43R5Z:WU5mwBf3Z96pGqeJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617172963, "uuid": "8a00774b-7998-40ef-91c2-747847974161", "value": 970308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617172963, "uuid": "9812a881-53b6-45c3-b94d-3bb240b9edbd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617172963, "uuid": "3d014307-7e8c-4f25-9925-addbfebef98d", "value": "QUOTATION 270920.pdf________________________________________________________________________________", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d33703-91d3-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617162271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162271, "uuid": "241f4bdc-04ce-4036-922c-66b683281ef7", "comment": "Malware payload (IcedID)", "value": "c941a969853df1d7d62036aa7e13d2d9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162271, "uuid": "fafe78c1-a99b-499b-b96a-f2dda4a22f5b", "comment": "Malware payload (IcedID)", "value": "6ddc198e64097adca8ff17e093cda1f149e3c1202ce51b7108861efb5ee7ed8d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162271, "uuid": "9b05d82c-9320-4061-b727-4e108791f583", "comment": "Malware payload (IcedID)", "value": "818f04b3e42a5077840e3518cdd33621f5115f5d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617162271, "uuid": "4639b4da-5399-4dd0-bb98-8d92fe7170a5", "comment": "Malware payload (IcedID)", "value": "1936eb740f74e93da1cec50efd63bb014e1da3d77ba88d71627717908c70872f6b74b7564cc61afcee53b2ab984ef261", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162271, "uuid": "c11adf3e-52ca-49d5-9291-d9622ab7a271", "value": "39B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162271, "uuid": "8c4bec53-4c7b-4950-aaf9-aaa548792d88", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617162271, "uuid": "9eb1cdac-f531-408d-b379-02c0c77bfa45", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617162271, "uuid": "62f0017e-7e7d-4bfd-bf65-9c70755ac55f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617162271, "uuid": "a010be7e-20c3-45a8-82ee-1e59ec6f8203", "value": "document-2090249040.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e542ce-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232497, "uuid": "604f6a21-cbc6-4246-93d8-b9f97e9251f9", "comment": "Malware payload", "value": "28baae1bf0ac9d1add570ecbd7cf91ff", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232497, "uuid": "ecef664f-a858-4404-aeb1-2560b1abea1d", "comment": "Malware payload", "value": "6dde833d3fb5723dcead3859a6ddb6edfbccd8d0fe40b669d77eb3d909ec8431", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232497, "uuid": "da06cb81-c959-4f82-92ab-6a9e7209f8c7", "comment": "Malware payload", "value": "19bbd28ec314e8297636ce45ed0fca6ddd955297", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232497, "uuid": "ab32fe00-c47b-4983-95cd-44d5b05a33f3", "comment": "Malware payload", "value": "7c3e18929361471fdc633aebdc97bbf600a2ba6a4c01092f7c1694b9fe1c526ef01656fe61bf85c946b489d3f229aac2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232497, "uuid": "e3699d49-26fb-44ca-bc94-07ad95ac27e5", "value": "E114BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232497, "uuid": "42346f75-90c0-48e4-a76e-4eb1ecf087a8", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232497, "uuid": "d6e9c264-f22d-487d-b7cb-08b07111fc70", "value": "3072:fopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:wpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232497, "uuid": "6d41c43b-904f-487f-abf2-30f5f89fb6b6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232497, "uuid": "2136e2e1-3127-4d3f-ba7d-2cc4fb2b2e68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232497, "uuid": "2f6b124c-bd52-46d2-ae08-fa3b0cb02925", "value": "6dde833d3fb5723dcead3859a6ddb6edfbccd8d0fe40b669d77eb3d909ec8431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7333592c-91ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617160144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160144, "uuid": "a7d64677-fc23-47d6-830a-d17ecc00e978", "comment": "Malware payload (IcedID)", "value": "7d4b729cf1ce5cdb0f9bcab6628558e1", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160144, "uuid": "98c8843a-085a-45b3-9d03-6508b11ac99a", "comment": "Malware payload (IcedID)", "value": "6de10eb55b719e5bb7538e5cb0d19eafabc7d7f35b62c55459515fa0187c8c0d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160144, "uuid": "a5fdc430-a4b2-430e-b677-96c2a21b1916", "comment": "Malware payload (IcedID)", "value": "4b032b1f3d4480b72cce2ceb9b6d822304ab6c89", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617160144, "uuid": "93db3966-d29e-404f-b057-4d7e13d36bf8", "comment": "Malware payload (IcedID)", "value": "58303425c1e4d4d60fb010b057853ec3c32d4cfd97be09b6d34bf6666b0f400c1bffd750a548861e8ad0557e6b0f60d1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160144, "uuid": "e1286cd5-0670-4d33-be63-80de5ba435e0", "value": "8EB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160144, "uuid": "0e297c61-4f2d-4303-9902-691239f92d9a", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617160144, "uuid": "69f85fef-755f-4fbb-87d3-e4e04bf14fe8", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617160144, "uuid": "47510c81-7f9f-4a06-b866-394249daa7d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617160144, "uuid": "e523059f-7107-4b40-8661-276fdb6514aa", "value": "document-245098283.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1487daf-9253-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617217398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217398, "uuid": "7acf30ae-d900-4b86-b851-279d45cb4ee4", "comment": "Malware payload (Dridex)", "value": "5199b24fe9792b298e62ea893e788bd1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217398, "uuid": "107eafd2-2552-4194-a7cb-f63619965c2e", "comment": "Malware payload (Dridex)", "value": "6e4527d42d88cd61fcce6224e1877ceb31b29163f11cd44edb4604bf5bf1f6ef", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217398, "uuid": "6e17edf1-1a0a-4b47-bf77-bd9df07ab61e", "comment": "Malware payload (Dridex)", "value": "f006eca6ab7488dccb6a6a9a2f2587b1119ea809", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617217398, "uuid": "b8a3e92a-940a-486f-b0f7-eb8f13ad8fe8", "comment": "Malware payload (Dridex)", "value": "630c58976cca9e54a6ce7a841cc1e08c9782dca1a1dce541e2d13c3f03e6baaf17fbda2f314da8d37f3d7dabf1236bc2", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217398, "uuid": "2cd6fbd0-85bb-4b19-bf5f-26da2739ae9c", "value": "2214BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217398, "uuid": "af6d7ce1-feb1-4d1e-a395-02ad46fb3af8", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217398, "uuid": "7438df65-5f58-445d-ac1d-66f3c1363c3c", "value": "3072:Jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:OpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617217398, "uuid": "38e3f824-b506-4654-a5c0-0180422e3976", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617217398, "uuid": "5712e22b-e25d-483f-ac72-f51c84880c7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617217398, "uuid": "b0b5a2ef-5995-40c5-9723-58970ab49704", "value": "6e4527d42d88cd61fcce6224e1877ceb31b29163f11cd44edb4604bf5bf1f6ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d5c3cc-91df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617167666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167666, "uuid": "4fb89e41-40cd-4dc4-8a5d-6e1d89a7dfec", "comment": "Malware payload (Gozi)", "value": "405f0a8c869db4b3f2db4a838c8d6f17", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167666, "uuid": "a4e66244-a634-4cf5-8a08-94ba11e21010", "comment": "Malware payload (Gozi)", "value": "6e4568c87d8d2b5d6428ce46362b1ae29559047aafc275948cd4510573e460a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167666, "uuid": "dfcc4b6b-2bd5-495a-becc-f0b8665aa4b9", "comment": "Malware payload (Gozi)", "value": "47b9cb06603d9704c2206d271dfc63edd7cfc539", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617167666, "uuid": "c82b6460-65ca-4220-836e-8f848c972677", "comment": "Malware payload (Gozi)", "value": "3d7bedd1cf287204702d6ca2b8f04e141f745017746e971ba86ce8f36d099a6a94301a4852d9c6a9d6e30ceeb0bd2d87", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enel", "colour": "#3B012F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167666, "uuid": "cd60eb7c-31f3-4efb-8e2b-561ed18ba631", "value": "B344BE13A3D14031F7B31B3508BB99414BEF7CE18A34C9ABA688310D6F676D05A797A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167666, "uuid": "28101d97-3bff-42d0-94b8-4e69d8f6205f", "value": "b7358069c066a5063a8c53c6adf66bd9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167666, "uuid": "46c65caa-235e-40bd-b86f-f48bfd28ad1a", "value": "6144:mdnnLzN2slvlUkNkGPz2Q3kEv6/xdBBybvN:Gn3R44kGPz2QpC5PeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617167666, "uuid": "d775feeb-2107-49f1-8c3e-2422c402224d", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617167666, "uuid": "e11de2e4-9e7a-4e81-8eec-460ecd18cb93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617167666, "uuid": "8d113932-c6bc-48fe-abbb-4038e6c45ed1", "value": "6e4568c87d8d2b5d6428ce46362b1ae29559047aafc275948cd4510573e460a8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea151279-91cc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617159485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159485, "uuid": "f77d7c32-6dd7-49bd-ba89-3ffb4a80b974", "comment": "Malware payload (IcedID)", "value": "676d6040ddf8d7b8abe6e4def221ba33", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159485, "uuid": "99d07cb4-354d-4c60-a861-149e7fef476e", "comment": "Malware payload (IcedID)", "value": "6e6f454bb30ffd3446bea3eec51ced29b31f30f93727532611c5e318a79890a5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159485, "uuid": "13155170-8f38-4f89-9f2c-371b35812f8a", "comment": "Malware payload (IcedID)", "value": "65c6c40ec0e105c27299743f55f6dcc1f1ac1768", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617159485, "uuid": "685bb2b1-743b-4c24-bb70-4d7943c904d9", "comment": "Malware payload (IcedID)", "value": "a5b7934c0ff036d82c6ad048ac8463ee929f3210dda82df7051e98942abc246d6c47de23aaef3c6f6c8c65f9a8acfd73", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159485, "uuid": "1e595fb7-9d65-48fc-ac25-927456a059b5", "value": "1CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159485, "uuid": "47842bca-ca13-4f52-8bb5-4ff0a321fb46", "value": "3072:O2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:OzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617159485, "uuid": "e10d6716-aeb3-4169-bf6c-4f7062bf8da8", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617159485, "uuid": "af190558-3019-40ad-9f19-c259cdd44877", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617159485, "uuid": "ff9a54c8-7019-404c-aa7f-f2c9a27d643b", "value": "document-1480798779.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565db067-920b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617186295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186295, "uuid": "38c573de-bf46-4153-9c04-2c6d282a6fc1", "comment": "Malware payload", "value": "5d0e5c94b52af6623ffdef19fbb9d384", "object_relation": "md5", "Tag": [ { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186295, "uuid": "fc3280d2-d774-4dd1-b21b-575c6fd4e51c", "comment": "Malware payload", "value": "6e78090f1ed7dee3f242b9436d57b580f4331169b85baedaaaf983339b3e1611", "object_relation": "sha256", "Tag": [ { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186295, "uuid": "92f2bc1d-01e2-463b-93c1-71f6579a03b8", "comment": "Malware payload", "value": "5684411c2758802bfa89aff50cecea9404a4fd46", "object_relation": "sha1", "Tag": [ { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617186295, "uuid": "e2babcb1-31f2-4360-9a50-1d5b96956381", "comment": "Malware payload", "value": "de6bccc4394b542e9fad949c55108259f706adcf8ea240570c3a95dd90125f1cc3296a4ae3484a90d8645a99ebb446f5", "object_relation": "sha3-384", "Tag": [ { "name": "usamyforever", "colour": "#84946C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186295, "uuid": "4792388f-8b02-4404-b849-4bef4d7b0783", "value": "A7F005199D21E64C05887163F019B084A335035EE1F49CE0A7E3CD74464A1F0127F714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186295, "uuid": "10449f5a-499c-4b07-be5f-17314f166e53", "value": "12:K1aICcQfC2IkRVJaICcQfC28Z81OzLgyaIS1PKC2vbwPxBLn:tcQK2IkscQK2Q812Lw1PKC2TwPxBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617186295, "uuid": "c77f28e8-e7db-46c7-97ba-5548bee1a076", "value": 503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617186295, "uuid": "55effc94-d690-4449-97d8-a835254edbab", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617186295, "uuid": "5084a4f8-9df2-4b33-a6ff-1f9217e8000e", "value": "pork", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac6b24b-91d8-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617164291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164291, "uuid": "f51ed1ea-9cde-4548-a383-cd6249b8f9bb", "comment": "Malware payload (IcedID)", "value": "e88e2c150ced7e75985ff74c96256e49", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164291, "uuid": "1a368c36-022d-4d2f-b444-76a614955f18", "comment": "Malware payload (IcedID)", "value": "6e9a7e2e7e1c861334fb65eb6d8673ee3aa3684ec824e22ee024afcefc10d35a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164291, "uuid": "620e7a19-35aa-48ef-aae5-a444f997e38d", "comment": "Malware payload (IcedID)", "value": "c973425fca879a957445a610ddaf86d3793d43a2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617164291, "uuid": "452e0d64-37bd-4d38-8a30-cded774c8ebd", "comment": "Malware payload (IcedID)", "value": "0d60a608c1ad25b5afa2f898c1dfe542f9510e59aa4b7c2175bce823e361decbe3b89f96d2149fdfe4c84d1d1b7c2970", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164291, "uuid": "0573469d-137a-4d93-9744-8199acdfc4da", "value": "A4B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164291, "uuid": "00899427-9603-401e-b13e-e93fa9f4eb1d", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617164291, "uuid": "abed8fd8-6cc7-4520-babe-69840c8db4a9", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617164291, "uuid": "f1df8421-aa2c-4a19-a71e-35ab360033fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617164291, "uuid": "1263b943-bb85-4e8f-bc8a-24356b738fc4", "value": "document-1941175887.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468bcdb7-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617212897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212897, "uuid": "adc731ac-326c-4469-93bd-fa3b8c7ee6eb", "comment": "Malware payload (Dridex)", "value": "0f5bdfa79603d352c907f589dadcfceb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212897, "uuid": "48c75378-b11c-48cf-ba90-86af078aa511", "comment": "Malware payload (Dridex)", "value": "6f0b8b85561967f389b47071131f01e3a0be56c5f46e48b4dc9181575f388810", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212897, "uuid": "c5006c68-6e71-4f73-823f-f996c52f89a8", "comment": "Malware payload (Dridex)", "value": "f0bf4405ca1c93668a8b4c869ca2e4d9c809cde2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617212897, "uuid": "7550a8fe-7b9f-46a7-a61e-8f5b8c43f749", "comment": "Malware payload (Dridex)", "value": "129a9566ec80d0f9ddf741271adf1832766a6e85bd9459945bfa98f377966cbbe0c452ec42bb9e8012f9e7c96bf338be", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212897, "uuid": "47167744-9a76-44eb-a121-7dd5e1139b60", "value": "BF248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212897, "uuid": "3815cf6c-417e-4cb7-90f1-86958579af10", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212897, "uuid": "7131e79c-3a04-40a2-8ed5-d84eafb76428", "value": "3072:S6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:SoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617212897, "uuid": "d125b4ad-bdfa-4663-8234-24f682903e58", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617212897, "uuid": "38def680-b29b-47a5-b5d0-076ba11907a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617212897, "uuid": "aedd3cb6-4946-428b-be6a-70c0b8baa127", "value": "6f0b8b85561967f389b47071131f01e3a0be56c5f46e48b4dc9181575f388810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28eeb0e8-9239-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617205976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205976, "uuid": "83ead098-2291-4c16-904c-eb922aaf1465", "comment": "Malware payload (IcedID)", "value": "e97225ebc8658a4d172446f68ba6b1ef", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205976, "uuid": "344b0d40-90dc-4ecf-9ba1-d1d2a6c1e5ef", "comment": "Malware payload (IcedID)", "value": "6f1ecb378a842d4db41beb64de1dfe1509e1244cc0ffab12371fb69e73b5fba7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205976, "uuid": "8485722f-e496-47b1-a33f-2d59a00451b6", "comment": "Malware payload (IcedID)", "value": "280ae43ec7cbbe4c57376d73dff6382fc0a02c01", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617205976, "uuid": "1a87ad99-43b5-45e1-9913-a21391ac0192", "comment": "Malware payload (IcedID)", "value": "3cfb7c070a7100e5da7baa7ecd80da9625f6f06644bf16944d7b1b26c9eb4bbe70d50c2f4be2dbdbdb1f1d24765b906c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205976, "uuid": "93c93ad4-dfb5-46f3-96c9-7e55b588b745", "value": "25B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205976, "uuid": "b7a65d46-1866-41f2-8aa2-5d423a2594d4", "value": "3072:I2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:IqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617205976, "uuid": "f8bf1948-f4e8-4318-89c0-c09bf9a0d907", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617205976, "uuid": "e27ef4f2-ee88-4f0a-bcfc-d0fc429abcb5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617205976, "uuid": "3f540c72-8cf6-4c2f-ab90-3cd9d630588e", "value": "document-1898657210.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bde1a4-9273-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617231049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231049, "uuid": "066169d4-94d9-4b68-98de-2e2e8b9e8f3d", "comment": "Malware payload", "value": "116c00984a611980495ffbfb07326d4e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231049, "uuid": "ca67a1d6-8861-4cd5-877d-e947d1b987d6", "comment": "Malware payload", "value": "6f2e8a5ebf016e7e420358e9d90e9d5ea25cf8ddb62b794b9aafb9ea262087c6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231049, "uuid": "99536a13-94a3-45d3-bf88-be32ff719e53", "comment": "Malware payload", "value": "5fe8402336d6078da68f606820c6df2aa4c1d338", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617231049, "uuid": "7d7a90de-8968-4ddf-b8cf-4aa958ecdb68", "comment": "Malware payload", "value": "4dabef9bf62e46e796f5a9ae6dd3c1762816b72a01b20e34e8cdd4b6896d119bf3559f2e6c148b2ff77e2c3cd51694cd", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231049, "uuid": "b2f52183-6296-4b4d-b4c7-1327d537451a", "value": "9F14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231049, "uuid": "e7ce9afd-fa30-4b23-a485-150d7ec293cc", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231049, "uuid": "98302495-82d2-404c-8c6c-613d44afe7dc", "value": "3072:0opj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:rpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617231049, "uuid": "7e03d262-2f3a-4f69-a0d1-419dd1d63026", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617231049, "uuid": "1501c379-4c62-4d84-96b7-18ebc8d8c785", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617231049, "uuid": "d24c8ec9-d157-4325-8612-78d01507bcb6", "value": "6f2e8a5ebf016e7e420358e9d90e9d5ea25cf8ddb62b794b9aafb9ea262087c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45654ee8-9221-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617195716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195716, "uuid": "81fc50dc-98c5-4747-b925-760f0de55c14", "comment": "Malware payload", "value": "98fcbfa1afca9cb39ba04ebd9f0b338b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195716, "uuid": "9f9e6e40-949a-4567-bd56-4d77dc46d61f", "comment": "Malware payload", "value": "6f32f8028f020910bcc68e881236e3275c8287b05bb1c42342e73cb1d9b17548", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195716, "uuid": "4be8ffd8-07bd-4800-abf5-8918940586e9", "comment": "Malware payload", "value": "4fef8f2825ee6502d328d3883a0342334b9b5e87", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617195716, "uuid": "47c3723f-cd13-4ca1-a21e-24eb6d9e43e8", "comment": "Malware payload", "value": "0c5adcf96d4e542fe040b666682ac63895e09b9429e0978775e1421c43b55509e049212c4ee78c209d13537a1f896634", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195716, "uuid": "38cde09f-c68f-46c4-9d8d-c1d8b4bfc708", "value": "31450E316DC58379C28638F8D0027DB53AFDC9B3D020456B9EACE2E667B6CB51749C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195716, "uuid": "e713b03a-e051-4c85-9ee3-ff9492704054", "value": "768:STHgHw+zaogYSnwoSu8bvr0YTZUeKNLs2LF6nsN1IDcF6SHblhci:/wGaPIoSuoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617195716, "uuid": "bc7ceeea-3934-415b-a6f0-4a5b37912446", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617195716, "uuid": "44a83c35-66bf-4c8e-af01-60d4bf98c2c2", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617195716, "uuid": "18676784-06fe-42d6-8a14-f4b223d62583", "value": "IMG_061_36_01.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed365cd-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213394, "uuid": "f1141495-ddc5-435b-8588-74527cd31dc5", "comment": "Malware payload (Dridex)", "value": "407ab93814cdf883a73a37599195df52", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213394, "uuid": "e3243084-f3db-49ee-8390-6c4b7b31ab7d", "comment": "Malware payload (Dridex)", "value": "6f4cc4f26c5122ce03163b0814fc21253a41f086a12839a2f2b8cc7c4f48a570", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213394, "uuid": "f5497c70-5fbe-4ec7-a10b-4a433b54116c", "comment": "Malware payload (Dridex)", "value": "cd583f0c3774cbc1f3f9e02813eb491a53c37e49", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213394, "uuid": "75468dde-71f3-4c3e-894f-aa1cc8c0dbbd", "comment": "Malware payload (Dridex)", "value": "ba11f5334513de7c86f05f52bb0d23fa1c8d6d961c2fd04543a62e2867c4fac3f46c440a47f12025cf239e1c6dc3fa12", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213394, "uuid": "56dd48bd-c894-4b36-b0a4-909b8c592be6", "value": "ED248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213394, "uuid": "584287f2-eed1-4144-818c-3e988289dbe8", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213394, "uuid": "ef0cbbfb-2054-494f-ba8a-eeaa206382d1", "value": "3072:76TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:7oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213394, "uuid": "3f91e3cd-952d-420f-9519-a58e85e779ad", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213394, "uuid": "dadc2149-9d95-40c1-b5b0-f10b90999d9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213394, "uuid": "63721abf-7a79-418e-a99e-7dd4ac3b5670", "value": "6f4cc4f26c5122ce03163b0814fc21253a41f086a12839a2f2b8cc7c4f48a570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b35908-9233-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617203392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203392, "uuid": "0d0757ac-2e0b-465e-b89d-c2024d6832ca", "comment": "Malware payload (IcedID)", "value": "baad040de4086460f870230cb2d57317", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203392, "uuid": "f68b181e-539f-4c27-b89f-56c44b37258c", "comment": "Malware payload (IcedID)", "value": "6f7e146dced7645bc8730e5347c1014091c1db0f76a34e7cba6a42007d976498", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203392, "uuid": "7947db89-a221-4276-80ab-d2a74d6470b4", "comment": "Malware payload (IcedID)", "value": "f20fef3aaf4e789f4c961ccb46d295bbc8209dc2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617203392, "uuid": "1d29f094-5ae2-4f6c-bf32-e997456998ae", "comment": "Malware payload (IcedID)", "value": "810b3c6c94269504108fe10ce9e98433a1cfcd4bac0ef4f45d4c22cca4cec7ae867fc3cac3b10e84a37b405755f516f4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203392, "uuid": "71ea2cf8-7af4-4291-85b9-0c16e1ccbf30", "value": "89B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203392, "uuid": "c6e10877-b613-45a5-9995-b61ed99f567c", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617203392, "uuid": "8b20c1d2-1289-45cb-bbba-4761bd3bc844", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617203392, "uuid": "824213c0-e24c-4933-9d8c-b9f4339f3686", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617203392, "uuid": "822d6ff6-6c81-423b-899f-7793d33b6cc9", "value": "document-2087798864.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1f0824-9259-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617219864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219864, "uuid": "21152350-9115-49c8-9f46-4ff9932c7657", "comment": "Malware payload (Dridex)", "value": "555abaadf0f1a28f4d3745c7a45755d2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219864, "uuid": "f2f6218b-032f-455a-bcc5-9fbb0881b754", "comment": "Malware payload (Dridex)", "value": "6f8527c4524ee868293dab770d2bbc4230de8cf573968a46cf23db383ec80074", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219864, "uuid": "9f37fa46-cf1c-40df-88ee-7f1163ef69c9", "comment": "Malware payload (Dridex)", "value": "68f6a2064985ebc3243ddd4ac4da0f85ced14442", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617219864, "uuid": "3d521a46-0bbd-409c-bec1-6f083b36edf8", "comment": "Malware payload (Dridex)", "value": "63957b03117c20e180ee287f81fedba666945806f72e8aa422636cbb673ade7c4adf4a163785c6b3c1ac0fbc3bdcdee9", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219864, "uuid": "7b0eb7e8-806c-4aa4-a723-c1b93e00bfc7", "value": "4B14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219864, "uuid": "7994a710-0ff1-47f5-a8a0-0f314e54c4a0", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219864, "uuid": "bbbf534e-6a5e-440a-bfcc-46352de60ada", "value": "3072:Jopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:OpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617219864, "uuid": "4c22cd44-9a23-4311-b8fb-bd1ae2418f8b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617219864, "uuid": "fc3e2ceb-7f30-4b40-a8e1-14521ae0b2d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617219864, "uuid": "0be331ca-4c86-4915-8120-c385dc48522d", "value": "6f8527c4524ee868293dab770d2bbc4230de8cf573968a46cf23db383ec80074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8186e2-9260-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617222925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222925, "uuid": "9c5f9f28-ab5e-45e5-819c-4177719861d6", "comment": "Malware payload (Dridex)", "value": "3079ca8f5c06eac2119c16c22ef082f6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222925, "uuid": "79da401d-e217-41ec-aba1-14560995f6bd", "comment": "Malware payload (Dridex)", "value": "6f8ce681ea1949077a45a9bdd3c8d1ad9b548f8aab842379bfd3a5b8388b72d7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222925, "uuid": "19f6d2cf-7925-4fc1-b886-320e0f3831b9", "comment": "Malware payload (Dridex)", "value": "56635ebc5fae1382c31795156f890ab27b3cf83e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617222925, "uuid": "6a30e735-2c4c-41f1-b4f1-58530086e1a3", "comment": "Malware payload (Dridex)", "value": "a4cd7c5139b062d3da65db92db120a1edba08628ca3cc811858104f6dd9742d422de3b3ae57ef0ba3da94a6a41f073d3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222925, "uuid": "6ff285a9-0100-4bd9-934f-191840634e57", "value": "FF248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222925, "uuid": "ffd32b14-26f0-4e39-b42e-cd16e60b238d", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222925, "uuid": "d134fc00-a012-4766-a3f7-a0e8385f3293", "value": "3072:P6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:PoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617222925, "uuid": "271232f8-e022-4f3f-a20d-11b5da356fb8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617222925, "uuid": "7599a5b3-4a1c-406c-80ed-ac49d1b7da4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617222925, "uuid": "0ab3565c-353e-4e3f-b579-5c1de2d4117e", "value": "6f8ce681ea1949077a45a9bdd3c8d1ad9b548f8aab842379bfd3a5b8388b72d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db33e4fb-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158601, "uuid": "dff5d562-142d-40e0-865d-952df30017a3", "comment": "Malware payload (IcedID)", "value": "53046297af0a7378a927c8a42bb77533", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158601, "uuid": "a8ecfce4-8bdf-4d0a-9f6b-024ffab7e0ae", "comment": "Malware payload (IcedID)", "value": "6fabf2b2523515f513a207b62998a29b83040c06c4d8a461acb2aac454263b80", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158601, "uuid": "16743594-7bd2-44ee-9000-4c9996bc1e45", "comment": "Malware payload (IcedID)", "value": "2dcfd9e4720e16fe94cb12f439f193a02303ce30", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158601, "uuid": "7e2ebcae-ec10-4319-9fba-572bae88c26c", "comment": "Malware payload (IcedID)", "value": "1c8b6311acafb514e00f8196a7147ce36e70ff1af3d49aa7f6c9aea70eb9fc58159a0cce4e611c3b1b71c52a0f9e784b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158601, "uuid": "16103ca6-38c8-465a-a1d0-3bcb18c8b144", "value": "EFB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158601, "uuid": "4f1b4478-80fe-4a56-9b62-024a513cda12", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158601, "uuid": "61d270fb-9b0f-49dd-a258-7b9214e8227e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158601, "uuid": "b249d74b-ca75-4e6a-a3d5-1895ccd1145d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158601, "uuid": "e64c5fb0-147f-4478-90f3-7d27df2fa209", "value": "document-1841456057.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a75b868-924a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617213333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213333, "uuid": "e9ac950f-9354-4cb9-a83e-60fda59f081e", "comment": "Malware payload (Dridex)", "value": "672f2b04df9b9b0a603832703dfab2da", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213333, "uuid": "562e7481-8893-4040-a7f7-521905eb31b3", "comment": "Malware payload (Dridex)", "value": "6fd3685bc75639b2547859303165ad544f05fa440ca950b303f3a3bc12b7d5a4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213333, "uuid": "49d7ab3a-a261-4468-bca1-391cd5db51fb", "comment": "Malware payload (Dridex)", "value": "f1d295ab6bb579725334f4704be78e8c7a4598b1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213333, "uuid": "03f6d4f7-f2dd-464b-8c06-0eb2af4bcd0d", "comment": "Malware payload (Dridex)", "value": "312be0d236a4965c3c1466634cb924a391c5269ee1641ac713c4066735f7f30e082ac4a5a3152b148b8c90bb1e0cc4e9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213333, "uuid": "82f6e9e9-1c2b-4b37-a8f2-e327ef05d7a8", "value": "63248C5FE339E486FEE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213333, "uuid": "c82f31cd-0752-49f2-80f3-e0f1ba266601", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213333, "uuid": "9948712c-7c5a-41d8-bc5c-f7cc93b073ac", "value": "3072:E6TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:EoMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213333, "uuid": "103dec68-1b51-411c-aca7-5eff5b2d8229", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213333, "uuid": "a3b35a0c-bda5-459a-8ef0-37811f4160da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213333, "uuid": "e9e26fda-9dc0-46b7-8630-032eb565383b", "value": "6fd3685bc75639b2547859303165ad544f05fa440ca950b303f3a3bc12b7d5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a95cfba-9276-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617232258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232258, "uuid": "c64f6488-87c2-4023-8364-1a5a87839ebf", "comment": "Malware payload", "value": "cd92251edcd66d89d3a4bff867ab09cf", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232258, "uuid": "eb1cb5eb-29f3-4a29-a862-ad3af8bf5102", "comment": "Malware payload", "value": "701231dfdf72fbfd288a6655cf73632b681053c0e9d2fbb5ef5dbf95715cf4dc", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232258, "uuid": "6b32388e-6a9a-48d0-a461-a18712ea090d", "comment": "Malware payload", "value": "0e0238ec0bfa5dd8b86eff9dd4cc6d17d534331a", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617232258, "uuid": "3210cf1e-9305-4a37-81a8-5cfc6e65d56c", "comment": "Malware payload", "value": "062896d9dfa0c7d6f0f4ac6dadf602a865bd5f378ed4fc04250054c79353ead38f2a4ffed59e115b51d56fea51f255d7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232258, "uuid": "5197b309-f494-46d6-a8c7-f63ef1a0db1d", "value": "7714BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232258, "uuid": "431b387b-ac39-4b15-b609-1ac5e048d350", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232258, "uuid": "2ccadda7-d50a-42b4-869b-25448b5396b8", "value": "3072:eopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:BpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617232258, "uuid": "c9e11618-8e77-42dd-8057-dab2e44b86cc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617232258, "uuid": "835bde6f-4ef6-44fe-8aa0-4a65617135c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617232258, "uuid": "a8d1c83f-054b-4abc-8f77-c78b7ba909f4", "value": "701231dfdf72fbfd288a6655cf73632b681053c0e9d2fbb5ef5dbf95715cf4dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d3650e-9252-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216876, "uuid": "8f763d43-a192-437c-98f6-4b52d3e03a40", "comment": "Malware payload (Dridex)", "value": "bb9536b2639d0c387a1c89147da70dc8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216876, "uuid": "04c0918f-316e-4440-9ff8-109978d766be", "comment": "Malware payload (Dridex)", "value": "7054ea0d4f73bc6e5ce78165a3b7d1b6ce989b3265da2719dea614e7a4019801", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216876, "uuid": "13d7d166-8f32-4810-9a1c-2ef47a0a26e6", "comment": "Malware payload (Dridex)", "value": "efbe4f319628b6eaedd5bb89b553e2d55def8ffc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216876, "uuid": "aa40c8cc-79b0-41f8-aff7-11ddd356555b", "comment": "Malware payload (Dridex)", "value": "2aca04f192ef5e98859648ac552aa811f49704795f709f75d3575ace8a339b5c6034ca004933f46f9b52c4f846d36427", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216876, "uuid": "51452561-f497-4e51-9a38-85c7776cfceb", "value": "DF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216876, "uuid": "c04e8f4a-3ada-4936-ad87-07014df03811", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216876, "uuid": "401a20d1-07f7-4e11-8ff2-6a8f0094186d", "value": "3072:Gopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:ZpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216876, "uuid": "9c365b81-1f4b-4ba0-a838-6b844dad0956", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216876, "uuid": "448833f6-d923-4e14-a0cd-d48ef05c6b5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216876, "uuid": "14079a87-7a9d-4ecd-907b-17df9a6f700d", "value": "7054ea0d4f73bc6e5ce78165a3b7d1b6ce989b3265da2719dea614e7a4019801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6bd918d-91ca-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617158593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158593, "uuid": "f8c23740-f8f6-40a7-ba66-421606c55c96", "comment": "Malware payload (IcedID)", "value": "2b77f08556852d8ae95a2d77bd95b1c8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158593, "uuid": "ae843ee8-20bd-422b-b9a0-023b457b788e", "comment": "Malware payload (IcedID)", "value": "706d3f82b168e855f7938a377f8d5270de720aa4093fa96c11407acb6eac95e4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158593, "uuid": "1851bd63-0fa2-452f-b6e5-c7863c46c40b", "comment": "Malware payload (IcedID)", "value": "aa96f65a5b5119ed20053585c7feddc31151a2a1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617158593, "uuid": "2292f3f1-7cd3-4bcb-a272-666adcb81521", "comment": "Malware payload (IcedID)", "value": "821fa94f5f498f35cf18668f344eb8835865a93ffd249947432b631dd0cb535ded236074f4a82b113b97d9ddb3c66a5b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158593, "uuid": "d14fabdb-3c30-4363-9cd2-28e1c57f2ff9", "value": "41B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158593, "uuid": "6efa2529-d84a-41c6-b4cd-38f1b04cf6ba", "value": "3072:82CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:8zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617158593, "uuid": "b3bafcbe-657a-4985-8667-729a9ed225e8", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617158593, "uuid": "bed34449-4dbc-407c-9448-5d3103341ab0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617158593, "uuid": "d4053e7e-c75b-43b2-af6e-163cb230a033", "value": "document-1236957111.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a57e7e-9264-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617224415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224415, "uuid": "3bbe88b6-fedb-4fda-b262-2ba0fe037e74", "comment": "Malware payload", "value": "c67bed22f05dbbe660104fdefa42f5ab", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224415, "uuid": "7cd496a8-731c-4036-89ca-f815412e7aed", "comment": "Malware payload", "value": "70b69a970cc9f9fa534da4bd3573f9b9adf7212914431f428cbd44957e239476", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224415, "uuid": "d7b1ad83-931b-477f-9524-37efcfbf2003", "comment": "Malware payload", "value": "8ce63c71e129cef6d1a69a3e302b7d9a2baca1d7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617224415, "uuid": "618ec979-c012-49a6-a947-0e23e1b9b955", "comment": "Malware payload", "value": "3652d163f82e92af89e65ce2f065151d601ffc3a444d7e8958baf6336dbddef5ad6ac497fc37a2f914b2a8b5cff7a138", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224415, "uuid": "3700dc98-7200-4782-a13f-03a033cd4a94", "value": "76248C5FE339E486FAE3CAF44186A72296A39C92436F680DB0D6B57F453F49C152220C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224415, "uuid": "66baae03-f729-4b0a-aeea-1f4707c1b576", "value": "eeb95284c509c0cd676bb6384e0e301f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224415, "uuid": "4d69cf19-683f-441c-864b-9a5f7983548a", "value": "3072:76TM9U1Knle0BbRJd9pkJxrLxpoo/B5BvMzw9s/RmB5kA0KtNiqJWyJU0Nj8Vh:7oMy1KnllnvixrkyB7Mzw9I3KhJU0Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617224415, "uuid": "cfe54839-50fb-477a-818e-24ef0211bffa", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617224415, "uuid": "cf1f9aa7-d717-4567-999e-d3ab9c29184c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617224415, "uuid": "62761649-130e-44d8-8eaa-6f09805deaf8", "value": "70b69a970cc9f9fa534da4bd3573f9b9adf7212914431f428cbd44957e239476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28485e86-9236-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617204686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204686, "uuid": "bb325e19-da5f-43ef-80d1-a7fd9b6d493c", "comment": "Malware payload (IcedID)", "value": "21b10cabd3296fa5ef09262311783a43", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204686, "uuid": "d968bf96-f143-4670-a8d5-b26838cd796d", "comment": "Malware payload (IcedID)", "value": "70c512dfe12af74a43f3fbede6169fb6c2336561b344b06fff184ce2fd892229", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204686, "uuid": "f2101169-1cf9-476f-ab9c-0628b8550556", "comment": "Malware payload (IcedID)", "value": "712f1031d0aac75a2c43131f697c750cea17d5f6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617204686, "uuid": "5bc7fbdd-deae-4cf4-94ca-dff71d7a7a67", "comment": "Malware payload (IcedID)", "value": "be119bfd7eb7c06113a8f3b12a93c2876a452c3d37493d5ab789e3b3f9af47ecaefc836189fc0cfa103023fb3f358001", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204686, "uuid": "3547d9d1-856e-4b45-97b6-6d7684501a68", "value": "CDB3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204686, "uuid": "b8e9bb81-67c7-4402-a199-e7d866b2f770", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617204686, "uuid": "770dca8f-4b4d-419e-88fd-67c100f375a2", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617204686, "uuid": "2ce8f329-6321-4884-b352-1d25abf77b1c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617204686, "uuid": "37dc6993-5c91-4c27-9d24-79088dde21dd", "value": "document-1746123641.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e41387-91e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617170140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170140, "uuid": "43bc78f2-e758-4d64-95e5-93ec7a70bc65", "comment": "Malware payload (AgentTesla)", "value": "88bd77ff3ba4f6a4a9de4769278d3860", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170140, "uuid": "4c0de1b6-d401-4cd1-bab6-eafaa00a752f", "comment": "Malware payload (AgentTesla)", "value": "710ac80effbff3d28e1ca0010738c1ce51104166b3770cb66924f754d1d4a3b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170140, "uuid": "a00ab50f-07fa-424f-bd80-d1ba618e5582", "comment": "Malware payload (AgentTesla)", "value": "406225a466590ca298c091356ac3cf8d6cbcc22d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617170140, "uuid": "563b79af-f633-44b6-88a9-00e32fe2a278", "comment": "Malware payload (AgentTesla)", "value": "1ba5d745bee3a6448b9825cd19e13da263bd8b469927ee4bdfc344c89be85c199d78e55c87dfea74514e87c9eb743007", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170140, "uuid": "a85f14f4-7444-4e46-8080-68b8c3e1d94a", "value": "9205E015B61BBE51E03E87F640CC4B41B3B79B855316E47D7CE0A1888AE27C3B6E26C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170140, "uuid": "ae9b8231-0fd7-4f79-83b2-c1ebd5c5588f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170140, "uuid": "25e38c61-33fb-4e6a-938d-5823ab0ba67f", "value": "12288:BbTm4rYIhkjSIACFJUSMB1A/j3PnlhSQDf3YzkxNBueD5rOj+7mnNzatjhq:bBhEStCFJpw1A7lIKYCwyVODNwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617170140, "uuid": "6fc88b07-c3ee-44e0-a653-d7c910048a3a", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617170140, "uuid": "53a56ebf-a614-47f6-afa1-19a33a4c24ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617170140, "uuid": "dcc01a30-27b9-4f38-ab19-23c56d23051c", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ae1ec6-9249-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617213075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213075, "uuid": "af5f6bd4-4ce8-4b17-8d68-1b475d3795e9", "comment": "Malware payload (AgentTesla)", "value": "a7f014f4fe566e48e794b79661aef18e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213075, "uuid": "eb6b3f23-062a-48a5-a850-515267438a07", "comment": "Malware payload (AgentTesla)", "value": "712c1077c77ff7e4f69fc4184c29b82b796fe0103204dd95b3a620cb64005ac8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213075, "uuid": "e112a5a4-d77b-4a48-ad4b-900fb5a7b94e", "comment": "Malware payload (AgentTesla)", "value": "d100047fff6790a24ea68ecb6d8ed31ded99b142", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617213075, "uuid": "44ab7139-9c6b-4f02-83da-f733720653c8", "comment": "Malware payload (AgentTesla)", "value": "7dcd554249e40173cf7a26e192b69a315c2a46f030ac3ae5f889934412ae37e7eeb6d706c8ef4273ef3b7351a829bb84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213075, "uuid": "ec68f672-8d69-4b2e-96bf-494c9613e4bc", "value": "9813CAE44AA894FBED7DFA7093A9290FA621FD772511845FC4A2C1C3C8E27432DD116E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213075, "uuid": "a5026e26-91ae-49bf-be46-3b68fea8cc6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213075, "uuid": "9d35e425-168b-4f39-9f5e-cf6b1f97eedf", "value": "768:5XBGhg2XVlqtbymWLGGfl/Gflvx/FIwJGun51uvZS8rhu:5XBGhRXVlqtBgZS8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617213075, "uuid": "b4f53039-a301-4c61-a2c5-2cc57e0da492", "value": 44320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617213075, "uuid": "be46145c-2433-4677-872e-18d8f0896df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617213075, "uuid": "5fa58d0a-1b49-435e-a6d7-eea87f59e93b", "value": "a7f014f4fe566e48e794b79661aef18e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8af45b-925b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617220716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220716, "uuid": "c342dcae-e79f-4b95-837a-ce5f47c9c116", "comment": "Malware payload (Dridex)", "value": "9a1c6e48be37b84c0e37bdab0d5b2ba2", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220716, "uuid": "c2fd13be-027e-4fda-8aeb-d26424b98cff", "comment": "Malware payload (Dridex)", "value": "7146f8b0bad0e2129031a01dbf5b6c4cc47b708e2e26ee6d1f20d53d449e6480", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220716, "uuid": "7d0f79a5-4228-444e-ac75-d63360116012", "comment": "Malware payload (Dridex)", "value": "8a957c15656a6853a01b8f5d48276403a30aef85", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617220716, "uuid": "2ffafdd8-53ed-46af-a870-59ccb069961c", "comment": "Malware payload (Dridex)", "value": "004942bb816e5fe07697b2b5978136495680e8bf105f565a16ff7c17ba217b1a42a8fe9381d67c56747f3a38a2cd9b26", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220716, "uuid": "8b131cb8-3ef5-42c4-95c7-9243d2a1197e", "value": "C814BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220716, "uuid": "51d27804-e10a-4af8-947a-fb4fd7fe09b5", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220716, "uuid": "838cb95d-544a-4fb8-b7db-908a48cf473e", "value": "3072:dopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:SpjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617220716, "uuid": "8d463391-36f4-4147-8704-31f64a6c02c6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617220716, "uuid": "cfaa01a3-2f99-49ec-a307-cc2bcb032913", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617220716, "uuid": "71147275-cc88-44b9-9813-dc76e440744f", "value": "7146f8b0bad0e2129031a01dbf5b6c4cc47b708e2e26ee6d1f20d53d449e6480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3203ddc4-9230-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617202126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202126, "uuid": "89430c59-899c-4137-8401-f995964036fc", "comment": "Malware payload (IcedID)", "value": "49d83c321f4d5dfcc472beab2acb301e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202126, "uuid": "c1198ce3-7214-4bd3-9cdd-15fd32810948", "comment": "Malware payload (IcedID)", "value": "71484f01eb504ea52f3d41e6632dccb3eaa7cae411efa3816cc811cc565c59b2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202126, "uuid": "b8e656f1-703b-478f-8c74-e302a1f6e5b2", "comment": "Malware payload (IcedID)", "value": "dd80b9f997d408c8827db5ee3e812820d1917149", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617202126, "uuid": "2773cacd-8164-4a94-b3e6-4d043ba51ea8", "comment": "Malware payload (IcedID)", "value": "a1637e0eeb8213b40e3f0ae1060fbdc752fd36112cbd60ad1df5421b2a4518b861a4ccf3b9d15018a07faf1c6fb21cdd", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202126, "uuid": "5832a07d-1f9c-49bd-a8d4-51508b083995", "value": "23B3C0AA1A11B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E91516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202126, "uuid": "d46efa26-8a76-4bc9-821c-cf5b0e64e0c8", "value": "3072:+2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:+qtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617202126, "uuid": "c14299d3-a132-4fef-a8ae-2dc42d8272db", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617202126, "uuid": "f245251f-35f6-4e93-af90-836445debee2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617202126, "uuid": "fbff9457-56a9-4a21-afdc-440eb1733df1", "value": "document-1396450880.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78a0aef-922b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617200283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200283, "uuid": "fa260446-5ca7-4f6b-a951-a354004a8120", "comment": "Malware payload", "value": "1e677ec4b000d9286a716361f34291ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200283, "uuid": "727027d3-bbf4-4d99-b31e-4e5c49bcc509", "comment": "Malware payload", "value": "714bb2c57676bd4acec5d9c5a4ead0f9c9acc43b3acd013adefb2ef0c61e361a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200283, "uuid": "3534e774-efd8-4675-9928-a6f0e229571f", "comment": "Malware payload", "value": "be09f1d2a700a6f6955d32108399acb0e4d0d555", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617200283, "uuid": "089910df-30cd-43cf-906a-b0d2699b04e5", "comment": "Malware payload", "value": "3ae23ef289835d262011a4e4dd6cd3758302beb54c5c29a4092f1f4f5e64ea2193b9eb3797ba45210db5ff193c1cf541", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200283, "uuid": "b4970001-8a54-440c-8d84-b7e3128d7f69", "value": "3292B530F9072C522536C3235A5A39EAFE6C8113017054DCBF6E613DAB7994886BB9FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200283, "uuid": "e73cd3be-e3ae-4154-9e80-4a883b844fe4", "value": "384:UW066sEdBjgyL//Te4zFo5v16/TO+raQ/khm1mohvjAV4l:U766sErjLLTe4zFo5NQframLm8vEil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617200283, "uuid": "3b71cd06-c49a-4970-8af1-35921a2bc360", "value": 20239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617200283, "uuid": "66ce5383-23c0-4db2-a5c1-bc8c81aa8abb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617200283, "uuid": "888940dc-b812-49bb-a9bf-5eb6dcbc12ac", "value": "714bb2c57676bd4acec5d9c5a4ead0f9c9acc43b3acd013adefb2ef0c61e361a.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fa50a7-9251-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617216227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216227, "uuid": "7f512c45-bcd7-4a79-8802-1f656923c0ae", "comment": "Malware payload (Dridex)", "value": "1f36b65231d436f659b575ef866030d7", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216227, "uuid": "972a468c-8490-4a18-a541-6d38e9b36eef", "comment": "Malware payload (Dridex)", "value": "718c3715b3a46d42ba2fad8b4324dc59e730611e5850cdfa24e23ab75ee18894", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216227, "uuid": "9eb5d5b0-6a33-4d9e-be2d-ca131100e01e", "comment": "Malware payload (Dridex)", "value": "13f4346d118a2935f5cb9792003c58023da7c04d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617216227, "uuid": "8378fe50-b1ec-4074-bc65-85d71db4b816", "comment": "Malware payload (Dridex)", "value": "d4cbb6363c072713eed02555c31086538fa9851c07eb9459dd21692492a570af0e2f9fcb8cfd738cb241a86037e3007a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216227, "uuid": "b4dc8ca1-4a39-4952-8106-b3d49df8af41", "value": "FF14BD4DCB36E095FBEBEAF51585C36892336F40A2BF5159A4D0387F893FA0C191899C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216227, "uuid": "7c69da1c-4019-480d-988d-d436a47964cd", "value": "97de38df25bb86ed5773a338d673d7ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216227, "uuid": "1eb43529-d5b4-4677-8560-fa7e91ba5b48", "value": "3072:iopj6gTxmzaCEH8nFb369t9EtpiU7FZEz57GEYd4ntfrOulzQh:1pjtUzy8nF8YN73Ez57Gz4VyWzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617216227, "uuid": "dff0b2d3-0f81-40cf-a6f3-f726325a6fd6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617216227, "uuid": "433be074-a68f-4f74-9540-2f4e83bfd41a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617216227, "uuid": "49ecae81-6774-4bcb-9bf6-67fbb74ba0bd", "value": "718c3715b3a46d42ba2fad8b4324dc59e730611e5850cdfa24e23ab75ee18894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f9f820-9229-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617199282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199282, "uuid": "df5657c3-6b4d-43bf-bd72-5ce3a3ec913f", "comment": "Malware payload (IcedID)", "value": "d981a40a354d1379f013526f0d3cb082", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199282, "uuid": "c2427abf-7480-4711-b05e-6160722bb8fd", "comment": "Malware payload (IcedID)", "value": "71b3f8c80ee81e4215aa201735abe960bb453fa63911439f4a724d8b6c10f9dd", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199282, "uuid": "ebacde75-5489-4d14-a5ae-0e8f27ec25fd", "comment": "Malware payload (IcedID)", "value": "a4a7195993f87741600f2c029298944edbd1adc1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617199282, "uuid": "60325605-06b3-4d45-b78c-afe0a0876514", "comment": "Malware payload (IcedID)", "value": "6f33a7e6120818273f38ab5a0951aa583cacb0bfa03c8c3b9f922789ca64f509b2e38cfeb6f11a3e21b2ffdec875a672", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199282, "uuid": "5be93a99-50ac-4670-851b-d27351c3aaca", "value": "D1B3C0AA1A10B714D7344B3CBF86C836D804ECDB682E1B3C785F74D9FB08E92516B919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199282, "uuid": "21903004-3017-4326-a8fc-358cc3d671fc", "value": "3072:W2S917bZ2tDYwBx+nbt0Guni5ryJf5STh6vwiRYdvvK9P1iT9:WqtWbt0PixyJf5STh8wiRYdvy9PAT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617199282, "uuid": "d28bccf1-ac27-4774-827b-b631a326264d", "value": 109481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617199282, "uuid": "f90bcf68-32b0-41d5-8308-facf5676bf21", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617199282, "uuid": "dc291e8f-ef52-4bdc-99f3-9da3c6a2ccc4", "value": "document-1937298510.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3140f90a-91f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617175925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175925, "uuid": "e2229e43-90a9-4c23-a472-14f1f5a733c6", "comment": "Malware payload (Dridex)", "value": "34c39074fba00dece0fc068295d4add7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175925, "uuid": "f4336147-eeb0-414b-83a8-76a4a69b23d4", "comment": "Malware payload (Dridex)", "value": "71f2d042e73b064a9b2d7a73b535ec3f168318462b7505b2e5af47e8ccb5d556", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617175925, "uuid": "fa8b8d0a-2862-4f35-a153-2e6d261e2645", "comment": "Malware payload (Dridex