{ "Event": { "published": true, "date": "2021-03-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-03-17", "timestamp": 1616025781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c4c6bd72-f9ae-4c07-964f-b74ec6959997", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82647a58-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003964, "uuid": "f814c3b9-023c-4641-8ff2-a43f678d6c35", "comment": "Malware payload (Dridex)", "value": "28339e6adda99daf32a5ee3302b8ed24", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003964, "uuid": "c418d015-f19f-4ee0-a474-3518da22968d", "comment": "Malware payload (Dridex)", "value": "0007272e570a3e0cb4a508b9046e14d13deb39ffdb5da56b14783c0a86f4f5b8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003964, "uuid": "a07d480e-62d8-4147-8010-29f535a9a66f", "comment": "Malware payload (Dridex)", "value": "bdf4e96a8f291470ebd92b1518a5f440bfab64fd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003964, "uuid": "203c50ce-616b-4159-a5ad-2b4595f7b3d3", "comment": "Malware payload (Dridex)", "value": "9407ca39f0366e99d5dda8c46e5130182c0830e53f222509dbccff7e11d333742ff0bf5f2be6b28efa3e3b09b62fd408", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003964, "uuid": "b6c6b2ec-e4d0-4993-a99a-b34450c20fcc", "value": "AD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003964, "uuid": "e220555d-92f9-4f36-9914-72bdc82b7c09", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003964, "uuid": "6743ec0d-205c-429c-8ccb-aaa9472d6fb5", "value": "3072:M9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:M9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003964, "uuid": "6a58c3fc-f654-4646-ac58-eb7a13a055ce", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003964, "uuid": "0057d43c-b797-4305-9ef7-bf8432b2e6b3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003964, "uuid": "9d3edab8-1a61-4aa5-844a-6798afd3f1b1", "value": "0007272e570a3e0cb4a508b9046e14d13deb39ffdb5da56b14783c0a86f4f5b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eecfc2f-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004388, "uuid": "03c7b5c0-6b1e-4db8-aa19-c9eee0f6e094", "comment": "Malware payload (Dridex)", "value": "a0b0104f3b3bd0b01ff9f943d8738236", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004388, "uuid": "e1829adf-8388-4d3d-8b2c-059677dd95a4", "comment": "Malware payload (Dridex)", "value": "003c9b4c05792dcddd3c0660d5ef995c1043f407172088af30f8d33fea5845f7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004388, "uuid": "d1bc1ef8-155e-4b96-aa75-03726f7a5507", "comment": "Malware payload (Dridex)", "value": "5bd542621098b840228acbb442ef964373e53d76", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004388, "uuid": "f712d741-d2fd-4cc2-a4f2-beb2cae70013", "comment": "Malware payload (Dridex)", "value": "c80409cdc4cb598ffc51aa1eb581b80a6df22b1e1dd15c51f5d6e53136b88b7a3cdcf61549a5ffc30fd40cfb59cd569d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004388, "uuid": "f7528579-e625-43eb-bd52-2ade6a4a9c0c", "value": "7E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004388, "uuid": "0dede467-bbdf-4b2b-b8bd-1bb6d4bd9c0a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004388, "uuid": "88cbc708-d2bb-4276-9101-fa57affca3f9", "value": "3072:w9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:w9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004388, "uuid": "68f36a8d-a89e-452b-b4e6-ed127e058a3c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004388, "uuid": "6586b4f6-5508-4ddd-bddd-9e841ba7cb09", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004388, "uuid": "a18398f4-7cba-464d-9f40-bb2a7fb7582e", "value": "003c9b4c05792dcddd3c0660d5ef995c1043f407172088af30f8d33fea5845f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829467a4-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "4587e605-5ca9-441e-bdcb-2011124958a6", "comment": "Malware payload (Dridex)", "value": "49e656595cebc4e2bc978fec36ec135d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "347f3275-f007-4ddf-be1c-900176b8e716", "comment": "Malware payload (Dridex)", "value": "0062e06a0c4dcf2c7bfc892d5e8dd2114f6b74489a41b727889578a763fd5aae", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "08f5d932-d6db-4720-bad8-ec5d3f3b2cda", "comment": "Malware payload (Dridex)", "value": "8dd5e3c299187d8bb3637c38d3cad609a01f12c1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "103ad40c-5272-424f-97a8-fb90c128bafc", "comment": "Malware payload (Dridex)", "value": "e9794024f506924b1fbb294ce877805c09e0cbf4892814542b43d42d37014d922ec71ffdd92e66035c81099a1bf1b2d3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "743a8cdd-e21b-4214-ae58-35973cc04b3b", "value": "EC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "d22c3144-683c-455f-b8c5-fd28a6c9d058", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "220a05cb-4872-4268-a796-425ed6dccf7b", "value": "3072:19Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:19Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003965, "uuid": "6a825aaa-0651-405e-8b94-c38aa3c7227e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003965, "uuid": "14248547-590e-4e2f-af9e-4d022d2e700e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "0b064eca-697d-402f-95cb-212eab863395", "value": "0062e06a0c4dcf2c7bfc892d5e8dd2114f6b74489a41b727889578a763fd5aae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c026b41a-86fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615970138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970138, "uuid": "6cd57a45-2389-4d39-8653-e6f1ad9fda5b", "comment": "Malware payload (AgentTesla)", "value": "6cfcc46ac40c7fccc985e8cbc71c9dbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970138, "uuid": "cd992469-3547-4b5f-b467-e20d8fb716ba", "comment": "Malware payload (AgentTesla)", "value": "006e140751117d2dda1ebdbc917353674df60ec3a7aaca34c2348877e0f44129", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970138, "uuid": "ddd72c16-a946-4207-839b-5a6b5b69e064", "comment": "Malware payload (AgentTesla)", "value": "4fc9ef031531e8c0bb57054d0f2016c48cb231ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970138, "uuid": "e9cc3910-78a6-4687-a8cd-5e1832f726a5", "comment": "Malware payload (AgentTesla)", "value": "d12f996c6645ac3caca492e8ea47e53eb0b1e6463f02ddfad3100a10b08315b58660d26be077de1037f6f5b874e17314", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970138, "uuid": "dc505131-c9f6-4251-b856-da84c6de3894", "value": "C6E4DFC959886701D82B02F20C56C72133AFBD2E95BBC175BAD7F9CC189AA47493317B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970138, "uuid": "c81d949d-565b-49e2-b80b-66f19607f7c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970138, "uuid": "63eb8610-98c8-4771-9014-dc651d010e38", "value": "12288:nUjt1eyEN16tVtjY86tVVJ6SZc+sKEg2AB4hIe9Uu/Ylf+xKo:SyEtV+86tVZZKKEACae9Utlf+4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615970138, "uuid": "d2a9e25a-3a1e-411d-b9e6-162c3ba26407", "value": 715264, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615970138, "uuid": "30abf2d1-1f29-4a53-bfa4-f0091ccfbb5f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970138, "uuid": "40257b14-377c-44d8-8a7a-817fa09ba892", "value": "6cfcc46ac40c7fccc985e8cbc71c9dbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8215e8c9-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "98947eaf-f067-4249-86d6-33f136681bc6", "comment": "Malware payload (Dridex)", "value": "2fc4f640d27439f6ce236a1f1c3526dc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "b124fd5b-0392-41cc-a884-daa56d0dedb0", "comment": "Malware payload (Dridex)", "value": "0072c669b912801fbfa7c7a1719ed1c5093e23c7349037d175d77f742d9d87ce", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "06cee079-2365-4d89-b174-5b248ff7b5af", "comment": "Malware payload (Dridex)", "value": "679e8ef77691b5cf58f8973e7e3c4c1255105893", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "f9f81ce7-169c-4cd9-873f-cece6945b366", "comment": "Malware payload (Dridex)", "value": "adf76306d99e3883977de7539f9114727131bf58ce1258fbf4af35e92a73a55bdc5b2bea5109102602390ae1fec601b9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "62c9f44e-5f1b-40a6-b60b-e106c0152aaf", "value": "BE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "562215b2-8d2d-48b0-961e-d1caab453013", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "21e72088-319b-46b3-9be9-36cbe14fe988", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001816, "uuid": "44a27ffd-5a32-488c-919d-acdb7261e08a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001816, "uuid": "14b95ac2-bf23-4f57-8039-9c3d774776ea", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "68fb42b3-21cf-41dd-bec9-6afeda0754f0", "value": "0072c669b912801fbfa7c7a1719ed1c5093e23c7349037d175d77f742d9d87ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4060d613-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001706, "uuid": "69e44406-d647-4821-9a20-3ac791de6245", "comment": "Malware payload (Dridex)", "value": "a9e0b6928988ffdd317f1c586a34c6f9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001706, "uuid": "02a6119d-5df7-4703-9e5a-f4a1be339aa5", "comment": "Malware payload (Dridex)", "value": "007f1b70119e0b0b99376cb22edf4c3a43e58d01aaf65b94079a26b20aabf578", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001706, "uuid": "b5499d73-ebf9-4682-b6bc-3158ce060901", "comment": "Malware payload (Dridex)", "value": "84e4ff328b923bcbfa08d2af07e03be6515a535c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001706, "uuid": "2e6bb1d6-3c78-4b6e-9c10-a081655bcf4e", "comment": "Malware payload (Dridex)", "value": "934d9ed47fc243d9eb334ab4894c2c254adb40fd77dc794fa5f6a68ff2633a7a9c815ac40298cbd4218479d9f8875ba8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001706, "uuid": "d24b375a-d07f-4a02-84b9-de5f37d01fb8", "value": "5C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001706, "uuid": "112152e1-cacf-4a97-a1c5-4917b8005e3a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001706, "uuid": "0a2505ed-086f-45cc-835e-ad59ffd2240b", "value": "3072:u9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:u9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001706, "uuid": "ac27cad6-a0ec-408f-b887-b76bdfebcd6e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001706, "uuid": "674f51c0-7471-4ba0-bb8f-1372883666f3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001706, "uuid": "1a526a91-d7a7-4265-b6a5-4df716abab75", "value": "007f1b70119e0b0b99376cb22edf4c3a43e58d01aaf65b94079a26b20aabf578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a9364d-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009277, "uuid": "2c0f20bd-6724-4ec6-ae96-28accb2374fd", "comment": "Malware payload (Dridex)", "value": "cdb83905c64372c9b37f59b452ac045a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009277, "uuid": "36f627e2-febe-4fa4-aec1-072ee6b82694", "comment": "Malware payload (Dridex)", "value": "009b718df3f2017f127bf9b52324e7190f310c0375aa0cc99d38c90376e51030", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009277, "uuid": "fe8d0992-3f08-468b-8e7f-359650f9c992", "comment": "Malware payload (Dridex)", "value": "299937d5eba4b1ff976493c1dfdef0ab30a778a9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009277, "uuid": "c4ddecf9-4451-43a0-b49a-760eecb824b9", "comment": "Malware payload (Dridex)", "value": "d33e4f0f7f136f20e1c0f79b5bef023a51b74062ef864307083bb6f3ead72f2456000aa779115e96dae9dcfab75fed4e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009277, "uuid": "ed05cbae-9835-468c-a311-d0bf5718968a", "value": "CD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009277, "uuid": "c8bb7f4c-75ca-4c28-b103-cd93c4d9a631", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009277, "uuid": "f34c25fc-fa19-488c-9473-b52ecb946bda", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009277, "uuid": "abca29f8-4c04-4afd-b126-7bcf417a98e2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009277, "uuid": "3e013717-9968-47aa-95cf-df0a9202c8da", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009277, "uuid": "3d32b140-4f31-4c27-bc15-c1924143a2cf", "value": "009b718df3f2017f127bf9b52324e7190f310c0375aa0cc99d38c90376e51030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f5d3bc-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001739, "uuid": "f40bfd48-03cd-4e2e-a4bf-c4b2af3ce4d8", "comment": "Malware payload (Dridex)", "value": "e86f81efdd623dddeae05c437c635a5e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001739, "uuid": "ee39ed97-0c27-4d2c-a3eb-5fd15e548b4b", "comment": "Malware payload (Dridex)", "value": "00cad54c7ccfda58a697b344dcd1e28402b1753b44b4857302a7467e9a0bd4f8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001739, "uuid": "50137793-4b38-4385-901b-54a559355805", "comment": "Malware payload (Dridex)", "value": "48ab1520c567eed7a6c2ac9ef981aa346ea58d4e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001739, "uuid": "2e94d657-4bee-45af-b49e-fa2fc989479a", "comment": "Malware payload (Dridex)", "value": "6e3084e530fa32c423562926b63ee9917efdc7ab288fcf14b25a4a6ce700a6bdbc4f27763fdbbe07aeda5373801cfa8c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001739, "uuid": "98204309-a837-4345-bc4b-24ac1e0b6049", "value": "9224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001739, "uuid": "8a1f8db7-82b1-4205-9199-529261243872", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001739, "uuid": "16f39500-4b83-4123-b69d-8378fcb9761b", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001739, "uuid": "7ce93421-09ac-4c94-a1d5-ec052e05bc23", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001739, "uuid": "9a14da5c-98e5-4efb-a48a-905a588cce30", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001739, "uuid": "b5140bb6-aece-448d-9e8c-3d8153d222f8", "value": "00cad54c7ccfda58a697b344dcd1e28402b1753b44b4857302a7467e9a0bd4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338a52b1-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616010275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010275, "uuid": "a528e8c8-8aa1-42f2-840d-e65e7c33b701", "comment": "Malware payload", "value": "76d1d0a498848e37754a04167bc2dea9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010275, "uuid": "ae387a97-87e8-49b0-b7e8-d2d6f58005f9", "comment": "Malware payload", "value": "0105981ec45de5c289ce46b79bef02f2304135d8434a04d90fac3f02393d553a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010275, "uuid": "5934cf58-b9cf-4b01-9efa-9705b93bca1c", "comment": "Malware payload", "value": "a7b294ade8e86d86a3b5ecc96937bb214e3a7187", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010275, "uuid": "68b7b491-65d5-48d4-b5c4-1552e3d4edf5", "comment": "Malware payload", "value": "79bdc7fb106b46f83e4ee8738de0541b76f837ff02b8d4601f633a590aef1b339dab92e3dff8c28f3a7f557bf36064a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010275, "uuid": "6d75284d-ceaa-4e25-b923-c03b66f65fe9", "value": "3FE20A81DB9EF8A2DA4A70F2580BDB3F85B149A5C0F6C4B4DB44CB4ED34BA74D12A345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010275, "uuid": "ea574c01-1019-499e-9c06-70e18b5ff589", "value": "384:pQPdzELTOqF2flDD1+LPl3VaCSN5w4vcpU2WPfAg9B:pQBEf25DQxwJwC2mogb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010275, "uuid": "9351cb8d-f4ed-4394-8686-1cea71a4be44", "value": 32768, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010275, "uuid": "f3aef1f6-fad7-438c-b433-8eda6e165f79", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010275, "uuid": "f59a5e82-ee8f-4fd9-a0ec-c3a58128dfce", "value": "SecuriteInfo.com.Trojan.GenericKDZ.73552.31422.2904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02594e97-86f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615966813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966813, "uuid": "3ed56140-c337-4b9e-8e6c-f4992b795db4", "comment": "Malware payload (Loki)", "value": "03caef797245702503e23f1918c0102c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966813, "uuid": "d95b0838-0339-4899-a0e6-36ed3ebbb69f", "comment": "Malware payload (Loki)", "value": "0121a7567600eb27dbbf9b0b8f5ebda783719d2c87b808ccd80822ad5c1041cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966813, "uuid": "25519885-8ca7-4d21-83e7-41a3c93a75a1", "comment": "Malware payload (Loki)", "value": "e89f6e2f0d4e82afbedd763e130fe1559c80980e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966813, "uuid": "71dd10e9-804a-412c-bf28-8758eba44687", "comment": "Malware payload (Loki)", "value": "c4c75cf379418e170c321837e587054a6179f872ed9182e2cb447b3b4ba82d52f0f3c1e5a54defaddd2b736795732893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966813, "uuid": "1a499816-9da4-40a2-a297-ae14fa5468c8", "value": "E7C4ADE163509665D4A747B9483A96A365B3F20D9DB8C63D2DC2FE4B3C7230640738BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966813, "uuid": "b79635ea-6fd4-47e6-ba60-00a88c39ed51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966813, "uuid": "750ad2a5-7b7f-4442-a30f-e9cf99370f17", "value": "6144:5fSYBtmE1m6jdcqWEztwOgrMTw9HFLYtNuiRpB2qWNHfEItVUVegBNeIY/4ALpMj:5H1m6FWEiOgDZlgNt+TH27NgiIAFdAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615966813, "uuid": "2e5554b0-e32f-42bd-8a30-802dbec92b46", "value": 554496, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615966813, "uuid": "f48bd903-a3d0-46ee-917c-f93c1a0a7a88", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966813, "uuid": "98a42036-45f8-4cb9-aca5-f2f716661c6a", "value": "03caef797245702503e23f1918c0102c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96714bd4-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004428, "uuid": "370cdba2-2fff-44ac-a96b-c570247fca5b", "comment": "Malware payload (Dridex)", "value": "068b8f1eb58c248c3f18e7a9f24c7e57", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004428, "uuid": "081c5718-4656-4f44-92de-946b98257419", "comment": "Malware payload (Dridex)", "value": "01257ab1fe1b6ec4c8e1aee1684f9938485e7a3519440b9a230a55a4e2307115", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004428, "uuid": "bbe59d88-ee8d-4185-8ebe-a6e983df62e8", "comment": "Malware payload (Dridex)", "value": "8bcbd8d0c39e0771cafe14a55263845e4db9b15e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004428, "uuid": "c1cb5719-da95-48c1-89e4-c4fc24d10a19", "comment": "Malware payload (Dridex)", "value": "5512134796ec96e9790fe7d3724322d6cddd204dc1a88b3ac07fb588ef90ec8310daff8424643818151eb2dcb12c9fdc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004428, "uuid": "67b8671b-3ef5-4cef-a989-a362b85d352b", "value": "1324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004428, "uuid": "9cfad2b8-94b0-4f8b-b641-ea4a36134517", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004428, "uuid": "6866c2a1-5e53-4819-b20b-a336e64e71f9", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004428, "uuid": "bea6cd0e-a1cc-4fcb-8792-b7ca242cff87", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004428, "uuid": "682f4336-9ed7-4c39-9feb-3842952447db", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004428, "uuid": "89a87c66-50f3-4b10-a247-1a232db637dc", "value": "01257ab1fe1b6ec4c8e1aee1684f9938485e7a3519440b9a230a55a4e2307115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d707c4d-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003849, "uuid": "001bfe8c-64d1-4b61-b01c-487b14898978", "comment": "Malware payload (Dridex)", "value": "a4f618ec61dd95ecf7eddec5f6af547b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003849, "uuid": "373d5e87-efb5-49cc-a5d4-07f6943ce67e", "comment": "Malware payload (Dridex)", "value": "01c9d1900dacac9d54bc8198bad0435e2ddd810d61107c6aff676bc59b3045c3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003849, "uuid": "8227a8e9-360d-4cfa-96bc-70c3a092d341", "comment": "Malware payload (Dridex)", "value": "2fab6d273171edbacfb2e2c8a33e89906481946d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003849, "uuid": "90096a24-31c5-455a-980c-cefeecfabc90", "comment": "Malware payload (Dridex)", "value": "53cc08e9b9a8b1637eb3f6ceb11afc3f7a0a0026b2af347c4bd52342a57809d7b7f35d94953ea509252ada5e830ab020", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003849, "uuid": "e691fa27-9cd3-4ea3-b176-288cee0b10cb", "value": "4024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003849, "uuid": "d3b6de34-90b2-458c-9be3-7cf79dd5e9e0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003849, "uuid": "2f47becb-2c00-45a7-8574-fceebfd8872d", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003849, "uuid": "c4f5ebf1-b7ae-4eb9-89b4-bca53af94360", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003849, "uuid": "677ee527-911c-4dad-b2ee-bc76474a8a2a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003849, "uuid": "a978fc0f-960b-4e15-a68f-6b64c51abd45", "value": "01c9d1900dacac9d54bc8198bad0435e2ddd810d61107c6aff676bc59b3045c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42aaa220-8750-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006435, "uuid": "5c3d31a2-182f-4bc2-9f9f-ab85a05265d4", "comment": "Malware payload (Dridex)", "value": "881f6d257530605b3312f17e845a461d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006435, "uuid": "96f465e7-edb7-4da3-973a-a3686d9c71a9", "comment": "Malware payload (Dridex)", "value": "01cbc32df148b8812123722b24bd72d83ae8d82fa280798ad9410b5e2ece6145", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006435, "uuid": "71c9fdac-f42d-4f8b-81b3-1c4effb7fb93", "comment": "Malware payload (Dridex)", "value": "9cac9e29fad8c2866b3e13f8e28194c0b9d7b8b0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006435, "uuid": "20d281cc-cadb-4eb1-8f16-512bb8ab3cd4", "comment": "Malware payload (Dridex)", "value": "fe29af4798949bce4f6eafe5ac9c6be3c49f99053f9573ac6ee8f5938d1509a71357c10a33ec1f3ea52ec3af48ca647d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006435, "uuid": "4f1df213-f138-4abf-8bc9-e5bcf7f8d6eb", "value": "0C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006435, "uuid": "6d5d741e-92e2-43f4-b584-31555be5b604", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006435, "uuid": "0ce85c50-0f95-4413-9ac2-69501a41478d", "value": "3072:W9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:W9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006435, "uuid": "003ff067-a637-4327-b9fa-f074ace70e38", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006435, "uuid": "7ad30971-1d72-491e-b336-62b1c2468f0f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006435, "uuid": "4c2293e1-e379-47cc-b301-5af9d3dbba57", "value": "01cbc32df148b8812123722b24bd72d83ae8d82fa280798ad9410b5e2ece6145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d57e1d4-875e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616012385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012385, "uuid": "b2418300-baaa-4b7a-bee3-756a8f6c3a99", "comment": "Malware payload", "value": "361ebfe0ce4bf5a35f689e23901d0ff7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012385, "uuid": "06f0144f-745f-46bd-9717-2b47a792081a", "comment": "Malware payload", "value": "01d6185057b749a753fe6b57f13ecf433fc57169ea71d0879453c263d39de246", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012385, "uuid": "db86c09a-bd72-4096-ad55-808dff8e0d23", "comment": "Malware payload", "value": "298c81e1486a954aee0b05d54c0dec5f0b1d59a0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012385, "uuid": "a329eebc-b361-4690-b90c-f5fc639ee20a", "comment": "Malware payload", "value": "e115be6dd826f489e027369c234de4e525d0de8dd4165cfffb3201192391ba0fa9511df96b74af1552c50c5fc90d6ef1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012385, "uuid": "9845a8a7-b032-4050-97ff-546fe8637f57", "value": "6F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012385, "uuid": "c4369e35-4c2b-4910-9fd1-2d0a23e798a9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012385, "uuid": "1a2baca1-1493-477e-a032-54a90b235787", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012385, "uuid": "f7a8b7ff-cf7c-4be5-9ee4-7f4a48b33425", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012385, "uuid": "ed04ab5c-e61a-4be0-b4f0-74a1b121c9d9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012385, "uuid": "07892403-7b07-453d-8b36-92abaf14784c", "value": "01d6185057b749a753fe6b57f13ecf433fc57169ea71d0879453c263d39de246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577ab6fa-86f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615967815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967815, "uuid": "79f6fa65-1a3a-42c2-ac31-e721f0e2ad4d", "comment": "Malware payload (RemcosRAT)", "value": "df2423a1365d5b26c0f21b69572e3005", "object_relation": "md5", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967815, "uuid": "423f86df-d209-4ebe-a595-524b12fc7d3d", "comment": "Malware payload (RemcosRAT)", "value": "021d0fc8c34a0136e339a2468fd9ef5e5ec2eb56cc2c759b6e99dbe2e0f0a7b8", "object_relation": "sha256", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967815, "uuid": "a4da64c7-ff84-4047-8b47-1516def1d0fb", "comment": "Malware payload (RemcosRAT)", "value": "caa5255712d46b189f3095fa62266b48c21b7ce9", "object_relation": "sha1", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967815, "uuid": "3460c6eb-3791-4379-89f5-f1f4e7e23f2b", "comment": "Malware payload (RemcosRAT)", "value": "8205a5a75cac10d70db1c3e9149ae9cec2c88df0964a445baf6b925f04ee354bfd4bd518e29ce21c2da3c426ee94329f", "object_relation": "sha3-384", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967815, "uuid": "3c7fb4d5-9735-46f9-b96e-a5fd2f830e4d", "value": "5F45819C32A032EED867C576CAA82C64EB5134BB531B8203B01F11AD9F5DA97CF155F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967815, "uuid": "10e1451e-6473-4bf3-8eb0-027be2402588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967815, "uuid": "fd9bb3ff-a450-4d39-b1bc-a17712e6436f", "value": "24576:R1trXf7dgBAmQsXk1HBGr0jMOOg4TqqIq:RHWBAmQzTzIOP4TT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615967815, "uuid": "cdaef8f2-cec1-4200-a3df-248750048f0f", "value": 1251328, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615967815, "uuid": "6f36a856-1f8a-4986-8943-b1cfe63adc01", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967815, "uuid": "75bdb726-ceab-4d3a-acef-97928dca5d93", "value": "je.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d4cd88-86f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615967976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967976, "uuid": "15b1590c-52f5-4279-905d-aaf89f70f2e6", "comment": "Malware payload (Loki)", "value": "0e898039c39f0834f8d2dc00b6118f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967976, "uuid": "fb5c0e36-1c74-4cbc-b5c1-6160196f6389", "comment": "Malware payload (Loki)", "value": "025e7d82b84e5c036744c45aeb56499ae62362d0b115dd2ae7304c728bb27efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967976, "uuid": "b0c69148-2c8d-4c5f-96d3-dc1df956a9a5", "comment": "Malware payload (Loki)", "value": "9b18f8490bfc6926b9839f1182ef76587046717c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967976, "uuid": "ec8712ae-c855-4949-96db-55dd73ead217", "comment": "Malware payload (Loki)", "value": "a047d79cce27fc459504414d953f9f52ea0d645503f0176baa5fe25caf17b12b29e4f5b242c1b5160c3559968d132de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967976, "uuid": "83082426-c00b-45d5-b416-37e2563d700c", "value": "C7F3025272C0C8F7D6635FB02AB3FB71EBB6534A1571954B5BC08F3A24724C68E2E052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967976, "uuid": "44a8236c-5c75-40cd-909f-c9da6f9ba269", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967976, "uuid": "9017699c-983f-4276-84ec-7f680a34bcc7", "value": "3072:xPA6jXFN2Mcdl4seJZsUThBWyzL98cEvTeRsex/XlApSC/OLRucvY21p/QY:xhjmV+syvTtLply/OLRiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615967976, "uuid": "d8a72225-fd35-4349-b09c-121d3bdcc0fb", "value": 158438, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615967976, "uuid": "bd475ac4-5b07-45d1-b844-6503e64beaa8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967976, "uuid": "61afdc11-5cfb-443e-b5c5-3a3802884a11", "value": "0e898039c39f0834f8d2dc00b6118f55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb8085b-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004388, "uuid": "9c45844f-c9a0-449f-82da-2f6a34e82e0d", "comment": "Malware payload (Dridex)", "value": "fcdeb579ddb61a3ceff92d583961b0dd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004388, "uuid": "c6a3b7b8-6fd6-4d15-bc87-4083c3509e88", "comment": "Malware payload (Dridex)", "value": "02ea87ded1af433993991855a945e4b4d364519a1ab4dcd880b1d45a79632cee", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004388, "uuid": "af47a3a7-fe42-462f-9187-e7f5b9f6f370", "comment": "Malware payload (Dridex)", "value": "5e546228a246488e1305b0e7a1119167c2db9796", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004388, "uuid": "caf5f429-f2c5-4ad2-ba30-82f2ccae72b6", "comment": "Malware payload (Dridex)", "value": "b36253b443c0d285f02f5ffa0aaaf4901ff76386e1126ca5f52e09a463219592772acedacd09c8fab14075e441964909", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004388, "uuid": "808c3c91-0b02-4e8c-bb6f-bd1807179877", "value": "4F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004388, "uuid": "f8366874-40da-47e4-ac55-503870310603", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004388, "uuid": "ae05a12f-e7dd-443c-80ad-9e419966ee04", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004388, "uuid": "398af0ed-ab4d-481c-af17-687b7d5882b5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004388, "uuid": "eb5c70d1-9b81-4019-ae9c-2abbfa08d6f0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004388, "uuid": "e15864cc-63c8-493a-bc61-3d4f21b3b82d", "value": "02ea87ded1af433993991855a945e4b4d364519a1ab4dcd880b1d45a79632cee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27b76ab-8742-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616000582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000582, "uuid": "93a715cd-840b-412c-a8ac-55480ad68c9e", "comment": "Malware payload (AgentTesla)", "value": "ecf3b5822fe3d32fb5ab317cce2a580a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000582, "uuid": "234aeb5f-4acd-4ec6-b9d9-c1e36a6b3439", "comment": "Malware payload (AgentTesla)", "value": "02fd540169425f4f71bab994c4f1faf127f56a272e8dfb547fa0e74375bab6a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000582, "uuid": "f10d64c6-c553-4e13-a59c-9774f9116fdb", "comment": "Malware payload (AgentTesla)", "value": "873f19fb99b44b0d9305d8a61cc830318a7a0b08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000582, "uuid": "6cbaa053-b265-4899-88ac-0cbb1ea5c7a5", "comment": "Malware payload (AgentTesla)", "value": "e58ecdaabbd9201d3f8754849534653563a08736a6adad6f74ca53f860aead4e509ecba2ca15f208e6c023ba02a5b070", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000582, "uuid": "9634c68f-5a73-4af9-abed-8e6d8bdfaf74", "value": "C8E4F04C66A89697D46A53BD15E671E0DB7662160C11FFFE088610CA0D23BB1CA837FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000582, "uuid": "8ce6fb6c-3892-48b8-8e1c-e34fdb4a50c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000582, "uuid": "f9b8771a-37b5-4545-b4cb-20e2ccf233ae", "value": "12288:6+F8tBHNkzdg/tMoH7iR1INc9UjqOUiBqgfQ76+p84W+S1citTfeWcTHQ2fHHmgI:GU0qMSkjmWcBfmghFK9olXkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616000582, "uuid": "07f693d7-1d73-491d-9f39-905d67fedae4", "value": 697856, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616000582, "uuid": "e2dcb3e7-585b-4c12-80d9-1098285feaeb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000582, "uuid": "790ed460-557f-4af6-887f-8edb58727ad0", "value": "ooo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c236cca5-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003642, "uuid": "01e6b7dc-982c-4724-ab21-a16cf045a4ad", "comment": "Malware payload (Dridex)", "value": "70273b947bdb89bfc4eb760df8b3c8c7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003642, "uuid": "cf6cf30b-d697-4299-90c6-8fe036dd7033", "comment": "Malware payload (Dridex)", "value": "0309e73dba993103e80ab793deb206feb616aa5d14ab6e1f579fde796f6ff77b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003642, "uuid": "a66b605f-78e1-457d-a757-6fe4f9ddd281", "comment": "Malware payload (Dridex)", "value": "5f7c19d86386c9c4e8127d47cea0f65c269c8e02", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003642, "uuid": "0d61b77c-39c6-47fe-91e7-21f401e4f472", "comment": "Malware payload (Dridex)", "value": "1b83cfc6624516d851f44a5b7f754683a67a37471a2d38005ab2e9a317d222331390af614ee24f1d37dc34785b21fe9c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003642, "uuid": "8e091ad8-f71a-43be-b33a-bdd6fc7116e2", "value": "8924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003642, "uuid": "9001875b-e7b5-4c2e-a7c2-74435bd4558f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003642, "uuid": "b643db33-fe55-4907-9064-660fa48b5568", "value": "3072:C9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:C9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003642, "uuid": "2ab617d8-0e8e-4df4-a970-9530fff56d47", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003642, "uuid": "5ca72fbd-ff59-449b-a73a-257919e8e88c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003642, "uuid": "d2df6fb1-b54e-4cea-abaa-184fa410ec0b", "value": "0309e73dba993103e80ab793deb206feb616aa5d14ab6e1f579fde796f6ff77b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d532eff-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003849, "uuid": "7eb79bdf-1997-4828-95ed-5cff51b6339d", "comment": "Malware payload (Dridex)", "value": "fed7b2b85bc516bc34b35b988605d94a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003849, "uuid": "aa4365b9-75e4-452b-a324-82dbfc19f0ad", "comment": "Malware payload (Dridex)", "value": "031924ef1183e6a828d5cd4458e4542cf59272a66d259896b37381aa9a8c04ae", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003849, "uuid": "54071640-3cbf-454b-b10e-9f7c8abfe7e3", "comment": "Malware payload (Dridex)", "value": "ce66a014fe786f2b3b6cc7fd6e2a084ecd896837", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003849, "uuid": "641e48b3-1a89-4af6-8e9e-b8cbcbabfe25", "comment": "Malware payload (Dridex)", "value": "75afc072e154593f4fbc389cc883d996596a11cdfd1e819b902746c5a8475e382e4ed6693f9b2d8433b6ec1b8e792cb0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003849, "uuid": "10877dad-f553-4e5f-be31-0fffc75ab36b", "value": "2F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003849, "uuid": "e3dce51e-9e08-4b6b-8c93-e94f13103843", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003849, "uuid": "fbfbe8dd-01b3-4b84-9811-48fd06e6d281", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003849, "uuid": "740b8946-37a9-44de-b599-cde8219d425c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003849, "uuid": "81b7eb93-b8cc-489b-9147-0de7ad5f118d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003849, "uuid": "beb8d797-bca7-497b-b4cd-9f0b41c38f36", "value": "031924ef1183e6a828d5cd4458e4542cf59272a66d259896b37381aa9a8c04ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05321dbe-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011056, "uuid": "69ce07fb-24d4-47b0-a443-b64b787afcaf", "comment": "Malware payload (Dridex)", "value": "c0e4c02012cdb5626ac3e7a478799e4b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011056, "uuid": "b35c0b7c-d2da-4cb0-b2c8-74ad4afb2909", "comment": "Malware payload (Dridex)", "value": "03bf268a1db4f46c2f16d8a158486deb1ecd85f513d60a4d2f3ce40492439898", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011056, "uuid": "de12ec03-b0f2-4035-aa11-d208931c5380", "comment": "Malware payload (Dridex)", "value": "19f8781964d12bf999930ff0ae21bfe330046b2a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011056, "uuid": "b63d3410-7a55-4cda-a0cf-44d60b4c3f64", "comment": "Malware payload (Dridex)", "value": "edcfb8b7bb0b75ea24e56ef3343ff755a47898460e6a1e9d1ff5eadf55c13050c3b73dcaf43b1af67b48377c2f621f24", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011056, "uuid": "f8a828b0-ed6f-47d1-92e5-0303a1182323", "value": "E224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011056, "uuid": "36de581e-8b6d-4987-84c0-7ff7d284832f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011056, "uuid": "91269917-2c6b-4fe2-bab4-87aa438df8e6", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011056, "uuid": "854b7887-8aea-41e5-872d-adedf71252fd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011056, "uuid": "e4c694dd-5388-4118-aca1-fcde21209151", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011056, "uuid": "6f308d46-0c98-4040-a18d-3ad097f3931c", "value": "03bf268a1db4f46c2f16d8a158486deb1ecd85f513d60a4d2f3ce40492439898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafa3727-871e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615985162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985162, "uuid": "2df61a4c-dfb0-4971-9c37-49609da460d8", "comment": "Malware payload (AgentTesla)", "value": "a41d1e22250ee24a8659e73ab192c81b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985162, "uuid": "3aa7233b-ec58-4a8e-a80c-b5640cc90f59", "comment": "Malware payload (AgentTesla)", "value": "03f42b77429e6203cfd076d1f9a4a0a371a44ed083deba781a8914e79ae2d9b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985162, "uuid": "8bbf2ac3-e214-45ca-a1d8-4272f107e29c", "comment": "Malware payload (AgentTesla)", "value": "de3b855cdf0d07717d1e06e6e6e2de10f4905ec7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985162, "uuid": "73a305f5-b42c-4a5b-af40-3dcd04261130", "comment": "Malware payload (AgentTesla)", "value": "a09df514c68318d2b6bf5431aad99698988465c521f8469c5cdf0912cf2a1058c61f79565197f171bd47f92958ed820f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985162, "uuid": "4581ed4a-6982-475c-a10c-31923f0ba3fa", "value": "B025F12E43387B16D02D27368C94652143B99D0432A2E7F6ADC17CCD39ADB98D6F11BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985162, "uuid": "ec7620b4-c753-418a-929d-83f780207865", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985162, "uuid": "ac4ba98a-477d-4b67-b1be-c8f259b87d8f", "value": "24576:Ai4RVPjHYfkzlg+aWjGU4UhjXHOKEuoRuSp3sjaKg4L4U2fo:J4RVPjHYfkzlQWjGU4CLOK6Rua8v2U2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615985162, "uuid": "5e054d2f-93f4-4e00-bfed-1a74e4d482ad", "value": 1017344, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615985162, "uuid": "9a10a101-78a2-4f1a-af2a-d3bb5b009e85", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985162, "uuid": "7828fcba-815d-4868-9cc6-905ee36c0e07", "value": "11317693065_03162021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d549fc-875a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010649, "uuid": "a42556eb-d791-4b07-9d94-e5f586294061", "comment": "Malware payload (Dridex)", "value": "7ff90634a6339e06bea1aa9efd9c8de9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010649, "uuid": "b34074e7-6259-419a-93f0-848cac738c9c", "comment": "Malware payload (Dridex)", "value": "0428ce4183b5c65401581ab024eb670b1326323a5ed601b2bd83f30ffba2f509", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010649, "uuid": "b6d9179e-4e79-41cd-9eb5-af0b8ebe684a", "comment": "Malware payload (Dridex)", "value": "83a0fda8f1d019599284ce783adfdff76754b84c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010649, "uuid": "65e5bd6b-97b7-44a7-b2ef-6fb64889e810", "comment": "Malware payload (Dridex)", "value": "05ea81752c18868bae2d12e2ef1a04a8070be605c13de3f82cd1a8249a80152eaa4dd4b6c11dd8d0f2879d299eb7588b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010649, "uuid": "50b18e7b-24c1-4d4a-91ca-b6196547db98", "value": "8124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010649, "uuid": "e0b273ed-b14f-437b-afd8-2395dc47bfec", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010649, "uuid": "9a2f0e08-949a-4771-bcb8-9b265f92bd38", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010649, "uuid": "47ee435b-c906-479b-a282-648f3c8fee0f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010649, "uuid": "28b50ade-11f6-4206-b631-5c8b991a22c3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010649, "uuid": "fd342684-ec69-418d-bae1-35892cf1eb81", "value": "0428ce4183b5c65401581ab024eb670b1326323a5ed601b2bd83f30ffba2f509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ae39ff-8720-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615985763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985763, "uuid": "b56a696e-9d4a-4516-9da2-664c1f95021c", "comment": "Malware payload (Dridex)", "value": "e64c028977cdb45fdbe80cee90a9bd38", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985763, "uuid": "f5ee9d87-8c28-4534-bbde-d83f99a9721b", "comment": "Malware payload (Dridex)", "value": "042d5916da941a63ad933fafdb6b74daea8f47127a6d309cb9ef987d44711297", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985763, "uuid": "e4cc1e8c-d51b-4f42-bfd2-0fd2450f054c", "comment": "Malware payload (Dridex)", "value": "544ddfd83369cc12efd59d178cb39babb887196a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985763, "uuid": "bfc116f6-0473-4298-98f7-c95a478a4da8", "comment": "Malware payload (Dridex)", "value": "f0218452436c1c4a7818c6af254ff95e24dbaee4aa7bbe23c01849d939cf5f698676a088886db0cc7031706358be76ed", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985763, "uuid": "9c30c10f-3680-4ce7-9643-52c8c3270f49", "value": "6C14BEDCD376F186FFD3CEF09519935656232D42861FE0A9A9C6A83F82BF90C045618E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985763, "uuid": "c2942008-951f-413d-b921-bce8f110eeaa", "value": "554e238e1840919675ea2a74968f15ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985763, "uuid": "6983e079-9529-4156-bd4e-95f14a23474f", "value": "3072:BwTcr3VWYFcXTNZEjmL18zM7cXzAMsT7bXsObx7UpYN4IO6KMZJpSx:mTMFWYYTNKjmLyg7ozALzXsONUhIl/Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615985763, "uuid": "1475f4eb-d5d2-4e2c-9159-8350efca138d", "value": 196608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615985763, "uuid": "6b2566af-6f15-41af-9075-da8b9603773c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985763, "uuid": "cfb65e21-09dc-4525-9e99-e7fc6f15b357", "value": "042d5916da941a63ad933fafdb6b74daea8f47127a6d309cb9ef987d44711297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0361c973-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615969392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969392, "uuid": "5ea88710-e814-41cb-8ccf-5630b89cc887", "comment": "Malware payload (Formbook)", "value": "1b26c10e2aae78b074183e28b022301d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969392, "uuid": "e7146c32-c36a-4e77-a98d-f7122dadd0a2", "comment": "Malware payload (Formbook)", "value": "056548a367412a9b7fcb2d136d1c425ecfc2b0627de5d6842a5b79cee17d67dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969392, "uuid": "6d045b37-eef0-4484-a700-c64937d8a07b", "comment": "Malware payload (Formbook)", "value": "c31522a60a5123b5ed0adf77d72fb8bef02c1a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969392, "uuid": "6b8236b1-b402-410b-acdc-3d9a2ac61173", "comment": "Malware payload (Formbook)", "value": "044f22801f238b9515cc368dc9ac9d1ffdaaacc440eb5248c36d0d3e4c6f012415633deba7fb543d3bf134a94456696a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969392, "uuid": "27d2c1ce-60e5-46d2-a761-9b35cd9b7308", "value": "34C4028617753F6BE6B806762C2952111AF3E8402AB3F3F6AD81B0CB04957C567F52BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969392, "uuid": "8484c1c6-1ba9-4a45-b5b1-17ada37f3557", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969392, "uuid": "2aff3d29-e1a6-4576-b224-a3158054b2a3", "value": "12288:g41DFyY24RU+Z5Xa5cjSlhYBrZB7JRSOevUKQMP0:fhyDuqmWlhI1F48KQMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969392, "uuid": "a903bbd1-8952-497b-a7b3-7eade8c08e0d", "value": 570880, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969392, "uuid": "caa589ab-2c7c-473e-9a64-82e8239633a4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969392, "uuid": "053287a2-3a9d-40d2-8873-65cdf9164c16", "value": "1b26c10e2aae78b074183e28b022301d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18071a46-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004216, "uuid": "4854e1af-821b-478d-83a2-b2a74af4de9b", "comment": "Malware payload (Dridex)", "value": "0d8e9809d09957cf877203f583e2eee1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004216, "uuid": "5e319805-d16b-4738-b513-77778788044d", "comment": "Malware payload (Dridex)", "value": "05b02723c54e0bdf316a4d57e52a1a04d87b1c1da8460d1853a4efc5676d4562", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004216, "uuid": "29c80447-71d5-44b0-b902-35919211e01b", "comment": "Malware payload (Dridex)", "value": "849422464901bd53d79f59c34574b0195ad0c6a7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004216, "uuid": "fb7bc1a2-dfdf-49de-a214-fb9ccc8540d6", "comment": "Malware payload (Dridex)", "value": "4c079e27adb1fee4b4f6df3342fd5b9d46fbf84e34c5e29ee06370e2513ac702182d229cfab4eadcdb00418d1fdef30a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004216, "uuid": "1a1c390e-df5d-4483-93cc-62f998ace3e4", "value": "8824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004216, "uuid": "5fc0a724-b773-4f3e-8ca4-b77eaee1f87e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004216, "uuid": "f1d91535-4100-40e8-a311-29c5c82d8635", "value": "3072:o9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:o9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004216, "uuid": "f44e8b4b-f4d2-4c3a-a54b-e8e324e8adb7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004216, "uuid": "4e31b63a-02d4-4739-97f0-51a80246d338", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004216, "uuid": "2cef1489-e6a9-4a2a-ae54-888a5fdfcc6c", "value": "05b02723c54e0bdf316a4d57e52a1a04d87b1c1da8460d1853a4efc5676d4562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93186ba-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003734, "uuid": "3750de2b-a1b3-4d33-a52f-44a17cac7fc5", "comment": "Malware payload (Dridex)", "value": "7dab8e45e7915df7dd9411187d4b20b5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003734, "uuid": "19a1e819-1407-4dcb-a488-0964f2a1488d", "comment": "Malware payload (Dridex)", "value": "05d47f66653dfbdf404a5f06986bfb3b3d4bc27c5f091fab1c2bc509e1854dfd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003734, "uuid": "5315ca06-8b6b-425f-ad9f-7d7b0f148c04", "comment": "Malware payload (Dridex)", "value": "678843dbe745da6ab03ecf7adac2cca0b2932b8f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003734, "uuid": "4dca4d8e-96be-4fbc-a73e-d25cd559426d", "comment": "Malware payload (Dridex)", "value": "ca1fe9c153b802692f886f26d6a2bdbf16277dde47e813eb0cecfa38adde3b91e58ab31d696dc82277bf73b733708d1a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003734, "uuid": "bc0c21ea-4473-4ae5-99b6-1501a1871934", "value": "2224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003734, "uuid": "d787080e-9181-44d7-bffa-d14cdf86eae1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003734, "uuid": "b05bb733-c858-41f1-9225-df45216d9856", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003734, "uuid": "b981b34c-b3fc-456b-bb27-acd9b4d8c797", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003734, "uuid": "7452e718-6782-4a1a-bb29-6d0e97ffd96a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003734, "uuid": "bab52103-c0b2-4efc-a04c-e415ffe8ffca", "value": "05d47f66653dfbdf404a5f06986bfb3b3d4bc27c5f091fab1c2bc509e1854dfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb0c8fa-875d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012035, "uuid": "96dc5b6a-794f-4e5e-a498-93acd93a4c49", "comment": "Malware payload (Dridex)", "value": "8b9f7614c24719317edc54af844fa241", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012035, "uuid": "16e8f8c5-6cff-4a28-9321-fd0389594864", "comment": "Malware payload (Dridex)", "value": "061716f271ba7a4f10b8950672acda7a4ce0dbf2c6bf6cba93e9a88086417172", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012035, "uuid": "1dfd6a7e-723b-4528-a6c1-bf40f440f781", "comment": "Malware payload (Dridex)", "value": "0fd9a9f51eb56d183a26a9bb97507181cdb072b3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012035, "uuid": "df2d857d-0fb6-4dda-abd1-827a2249ca6c", "comment": "Malware payload (Dridex)", "value": "351bc8979b44ba9aef98aef6b0b0f4ad1239a8d5964c52e57e159f8811efe18294920d8ddb3b55f6641c63ca406e6784", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012035, "uuid": "ee2d9c31-88cf-4aaa-8a1f-26a3b94d4064", "value": "2624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012035, "uuid": "874c4a8b-f585-43d7-8bf2-17158c180059", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012035, "uuid": "7bba37f9-086f-43b4-9664-29cba5319466", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012035, "uuid": "ff626d59-3243-4bba-937d-ddb5b9ca1da4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012035, "uuid": "accfa057-3080-4be8-a323-644c2cf21d46", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012035, "uuid": "4e38a97d-c893-4c77-ab4c-188b6c9ddbcc", "value": "061716f271ba7a4f10b8950672acda7a4ce0dbf2c6bf6cba93e9a88086417172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32633a4c-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003830, "uuid": "60a64a55-c9ef-4625-b5f1-58af6c35dc50", "comment": "Malware payload (Dridex)", "value": "3bcc706cb3bfc3d5e332f93a9c3da757", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003830, "uuid": "405d3bec-072b-4864-8558-155c7f9359e8", "comment": "Malware payload (Dridex)", "value": "0654ed1cbf0a2939f11f2c921fe51525e4ecbe4f92215f68bb3119c89dca00b1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003830, "uuid": "f3fc9e16-a033-47be-b17a-3a3a06b9222a", "comment": "Malware payload (Dridex)", "value": "3a22540e51dd2152fc2bd603efe43b7a94867ef3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003830, "uuid": "055b5e89-73c1-4169-8534-2a43638baaca", "comment": "Malware payload (Dridex)", "value": "bfd78930b486f3fcded9cbde558d6218903cf9aba1560e2895f765d78ab80788270559754ee6333b2a0afad670809932", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003830, "uuid": "2c9e2c2a-d49d-49c0-bdbf-b5eb678ad467", "value": "9D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003830, "uuid": "070439de-d77b-4c2e-a11e-78366c57c689", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003830, "uuid": "dedbc58b-5b30-4325-8899-92e0ecfcf6e4", "value": "3072:49Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:49Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003830, "uuid": "0ebf187b-f186-4cc4-8c6e-27840a904260", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003830, "uuid": "de45604b-f2d0-4a30-b5ed-977afd615fda", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003830, "uuid": "3526e766-9fa0-41fb-b34c-9ed478f159d8", "value": "0654ed1cbf0a2939f11f2c921fe51525e4ecbe4f92215f68bb3119c89dca00b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9fdb99-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004545, "uuid": "3e27e0d5-67ee-44b5-b5e1-efcffb7d1588", "comment": "Malware payload (Dridex)", "value": "cd7124f0ec8c249306a35bd96bfb0ee8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004545, "uuid": "4adb5d02-6be3-4c13-bb1c-d606249b86db", "comment": "Malware payload (Dridex)", "value": "067bf70de35283829f16a571ab60b8ec81ff4c00db064623ac8b4e26994a526c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004545, "uuid": "41b4553c-442e-44a3-8c57-06a4640426c4", "comment": "Malware payload (Dridex)", "value": "534412b4eb0218d04a5c5f8e0d5279975d5f8a88", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004545, "uuid": "cbe176f4-f28d-4aa0-aa38-b9e20295aaef", "comment": "Malware payload (Dridex)", "value": "101732c6b44f3f94636a406dc09946a64f00e3dec8c6c6cf6a0d85c40dff0dc9159fdba31e2b1e8e41e4ac18e4c6fa3e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004545, "uuid": "b7df1afe-5a42-4bab-bad9-fde07bec9d6e", "value": "4424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004545, "uuid": "d7fec41d-809f-44b0-a223-c0c2d91fa770", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004545, "uuid": "0cb601f9-5576-4bce-9bfa-9f4c2aff47f0", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004545, "uuid": "3109f63f-5264-4f7e-90da-6196a113f318", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004545, "uuid": "60c43b2a-8e9f-4b2d-be77-ef113c9aab0c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004545, "uuid": "f9083eb0-537e-4b6f-ae77-d80ee9a7c62e", "value": "067bf70de35283829f16a571ab60b8ec81ff4c00db064623ac8b4e26994a526c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dd784c-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011273, "uuid": "2dfc9204-ef05-4a12-ab56-84ff7f713cac", "comment": "Malware payload (Dridex)", "value": "25a76467d38507c58032d628cb49741c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011273, "uuid": "351c710b-1718-40fc-a359-06a230699878", "comment": "Malware payload (Dridex)", "value": "06c4e5c67fbdb35d5f3d6a35436ccb455e7479bd1b7d53d2f97263fa512d7b5a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011273, "uuid": "45127054-2a31-4ca5-8f8d-98d7e7a3c8e4", "comment": "Malware payload (Dridex)", "value": "17047636274edcf20288a0daa2ba291e829c86d0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011273, "uuid": "5e63f885-355f-4d06-9a7a-d4f4f0776b92", "comment": "Malware payload (Dridex)", "value": "f28ee3633963d25ce9ea6983c6138fc961fa15dccaf803bf962b9132d49b802fd48d767ce417177d3ee727d1d4bcd3da", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011273, "uuid": "c0754023-9076-4858-89ba-60bd419834ba", "value": "6B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011273, "uuid": "728cc4cc-42e9-4ea9-b410-8bc03b16c98e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011273, "uuid": "5b915752-77fb-4db6-8295-26d9b23c8428", "value": "3072:29Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:29Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011273, "uuid": "d980f002-8fe5-4adc-841e-2ab47ab1a4a0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011273, "uuid": "3971bc15-aa13-4f93-a5d5-a49a5beee3ce", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011273, "uuid": "9e7ed9f3-8e0f-458a-a5da-6088ce5c7a64", "value": "06c4e5c67fbdb35d5f3d6a35436ccb455e7479bd1b7d53d2f97263fa512d7b5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f454207f-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616004156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004156, "uuid": "7e11159e-6b89-44fd-aeb4-dcfbd4f6c517", "comment": "Malware payload", "value": "5f64ec3b768c8ad371c252721bb8c4db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004156, "uuid": "51a7cb23-f32b-4e55-bbe9-57000537ec7f", "comment": "Malware payload", "value": "06fc8e8a3b67dc020707baa64860b77c93ee11d0d80533dfce3b0899fe3d3b82", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004156, "uuid": "ba221f43-042b-42b6-beae-08c69d59e99c", "comment": "Malware payload", "value": "705665bcdc2e89132af944d54600c443d1dd9e99", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004156, "uuid": "48d3cb3c-223d-4a99-8658-5971c3d0d0fd", "comment": "Malware payload", "value": "666a3eded99cc23c25a3e5b3dff49b1d447c26e369b9a23e8fceed579483c4b9003fba60b42534e500c0d23b3caa5cf8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004156, "uuid": "cd1812c9-12e9-4616-8369-f9d2846450b6", "value": "FF04F11BDD094D63C80DC77CBE5B0CBCAB0CA2ACAA8477DD20B15DD57B882261D6B15E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004156, "uuid": "233f174e-e9b6-423b-9221-3523730366ad", "value": "3072:AXFYiB3kNT+2Jozo1UW8gOvlAsku0Gy3ZsY0OPlaK/LBt:AXFYiB3kNBozoR8gOvljFy3ZIOXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004156, "uuid": "fa05eca3-0246-4630-b734-3b41d50ef994", "value": 189036, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004156, "uuid": "d5845b3f-6fad-405d-9c8d-d05c1cabaa8d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004156, "uuid": "e8a6346b-631d-4194-8314-f5a819f3da37", "value": "Comission_1851374485_03172021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2991d7f6-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004245, "uuid": "ebaa4819-9a9a-4423-8818-2c8f58e84b11", "comment": "Malware payload (Dridex)", "value": "41ca013bfe3609b47736298bfe2f24ff", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004245, "uuid": "89f5fed0-45f5-4f50-9322-5563d1dd6330", "comment": "Malware payload (Dridex)", "value": "07125634a89a9d53523b5331f1f562f1a9611f79ce4eacd49574586147ffc029", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004245, "uuid": "db7b3f04-c156-46b6-bc0a-955bd46fae4a", "comment": "Malware payload (Dridex)", "value": "f03fd639e86c2d8b229175a4e49def48ceea2cb1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004245, "uuid": "0b31418e-7f29-477e-a425-fb0464b25f03", "comment": "Malware payload (Dridex)", "value": "4925e89a24300db9102b72a62abb594c58fd850ca99fba1ca8dab2ab257b6132a2df15415b3d72bf719b40aed6b36adf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004245, "uuid": "450d132b-b3b1-467f-a8de-115a5197340e", "value": "4224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004245, "uuid": "82323f1b-6062-420c-bdc7-10e60f2221ad", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004245, "uuid": "d51763a9-36b9-471f-8e3c-7a38b5fbc121", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004245, "uuid": "35e0abf6-b94f-45d1-87e0-84b7850acefd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004245, "uuid": "3c852916-a520-4928-b7b0-3d0758c038cd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004245, "uuid": "9e99f779-ad70-46e1-bda0-9444234fea5f", "value": "07125634a89a9d53523b5331f1f562f1a9611f79ce4eacd49574586147ffc029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d788653-8762-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014291, "uuid": "d463b4b9-c852-4e01-870b-415ba8974798", "comment": "Malware payload (Dridex)", "value": "99924fea333c85290aa4897507d8609e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014291, "uuid": "52c08a56-cfcb-4f85-8c24-e631f78fc82a", "comment": "Malware payload (Dridex)", "value": "074023b4798296f9245a9b967806ba0cf27b86790fc4d5f8c0a86c38d8e2d820", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014291, "uuid": "746d8afd-64c7-4039-876f-363d92875266", "comment": "Malware payload (Dridex)", "value": "51da7a4e2239901ae47df08f35555cb0e4f645a1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014291, "uuid": "6622e271-0c8f-4ca9-b411-e4aa279c143c", "comment": "Malware payload (Dridex)", "value": "77d5bef5477c9cf297a5a5364ee0b2bd61f95f4351ade645f44217e0e69a9f4bf621bbfda9e8e49df4a24ea5a964d2de", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014291, "uuid": "24ac84a6-613b-4e5b-8ddc-7b0525536b9d", "value": "A224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014291, "uuid": "5cc8885c-36c7-46ac-a473-8f54d97578b3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014291, "uuid": "8ae6d192-6468-4115-8793-83634b2a5df6", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014291, "uuid": "868a698e-4ea1-4c69-b87e-49506f50faf7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014291, "uuid": "bd921d86-ea3b-41b9-ad8d-debf7da97b08", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014291, "uuid": "95a9a2e7-4570-4c1d-8d48-7c538df12490", "value": "074023b4798296f9245a9b967806ba0cf27b86790fc4d5f8c0a86c38d8e2d820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20e7728-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004071, "uuid": "e8f1303f-84ff-4221-b27a-ad56a66237ee", "comment": "Malware payload (Dridex)", "value": "2bff5d88638a42e2663a4d107667ebd6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004071, "uuid": "09e344e4-a70e-4636-ac5b-2e641abf7030", "comment": "Malware payload (Dridex)", "value": "076526e11f0078fe721a21b51e8ad7c00a7af990b46950dc4f19468dc52d09e7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004071, "uuid": "0b83e6af-678c-401e-bba0-c4bbce89ceab", "comment": "Malware payload (Dridex)", "value": "c4412a469da36bd878cad47519e6a36c127e60b2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004071, "uuid": "392b408f-0a8b-4f9e-9119-abe5cc3477e6", "comment": "Malware payload (Dridex)", "value": "2a3ff12a06761dbf37d7d7d6f8854c006d919d39b95b4b4f24149d36803da36e3540174c7cd4ef13e2ee60c5eb590aba", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004071, "uuid": "31efbdab-5e1c-4052-a5c8-767edd537a67", "value": "9E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004071, "uuid": "70c701c2-4d82-4af5-b71b-64dc7935898b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004071, "uuid": "62a3222c-224a-42c2-8592-dc7cba83f8ff", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004071, "uuid": "2fb214aa-6beb-4abe-88fa-021a00080e5d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004071, "uuid": "651ce918-625f-4b10-9490-d20deaeee784", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004071, "uuid": "e98914a2-0614-43aa-9419-03fdf5c8fa0f", "value": "076526e11f0078fe721a21b51e8ad7c00a7af990b46950dc4f19468dc52d09e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffa65b7-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004095, "uuid": "3ddfbbdf-5470-463f-8c2a-f5cd87accba8", "comment": "Malware payload (Dridex)", "value": "ed10acf007abdff35b26c317818619f2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004095, "uuid": "33be3604-5c35-43d4-b3e8-040de72f4c6f", "comment": "Malware payload (Dridex)", "value": "0771287c5ca291a8c44f6c5d18bf7133b862b002c35efe25a0561050ca18d7a8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004095, "uuid": "a8447a0a-7f45-469c-9325-c30065151acc", "comment": "Malware payload (Dridex)", "value": "a4d9fe2b632daf8f5db011ca7f76a0cca8b23b2a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004095, "uuid": "908002ed-6cde-4150-b72c-145760bcb00f", "comment": "Malware payload (Dridex)", "value": "340633b9933462b74c6c7e48ecbf03fec81c63dabcd19b5cf3fcc40407b082f6cb93912d46dce85c146ec3b379e4ece1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004095, "uuid": "71757c9c-44c7-40e7-ae39-148d1ae3b6d4", "value": "A624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004095, "uuid": "219c57c1-75e3-4633-a983-3731d4edc642", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004095, "uuid": "ce2fceff-084d-442a-a4e9-277ff2816627", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004095, "uuid": "14c05af8-358a-4428-8011-83d973e11734", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004095, "uuid": "3db513cc-b81a-4f05-851d-13ea241e2ce9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004095, "uuid": "a63ac14c-ab6b-4c9e-b451-e49f23a87e3e", "value": "0771287c5ca291a8c44f6c5d18bf7133b862b002c35efe25a0561050ca18d7a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2935ad-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001701, "uuid": "78d87410-3393-45c5-ad04-3c2c1efcb260", "comment": "Malware payload (Dridex)", "value": "fd4faea7ff11a7fc5db3632656d71313", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001701, "uuid": "f5812914-3a91-48fe-96b6-706adce788c1", "comment": "Malware payload (Dridex)", "value": "0779c1420bdaa67cc565dbed86e2c687bc840a968f32b5e5cb61ad27f150d3e3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001701, "uuid": "c5d577de-0824-4810-aa8a-a5b7a5323723", "comment": "Malware payload (Dridex)", "value": "6fe013d0b9f2dafad41cb2a0790b9d5d0abaac6c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001701, "uuid": "1ea093b1-b3a8-4302-b225-8855467abd54", "comment": "Malware payload (Dridex)", "value": "e6a02ddaca938d36b24bc38aff7e3b30ac8a3fdf38ea7b95809cab3a81fabb7b4ce2f1192eb56770dc43e3e8d0783ce8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001701, "uuid": "3cfccf29-29ab-4720-8ee4-66322337517a", "value": "6824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001701, "uuid": "c1758ec2-bc2e-4dd6-9987-e14b332e978d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001701, "uuid": "da47e75b-2589-4f55-9e8d-bab9c4ccdc20", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001701, "uuid": "3d482aba-4b1c-4cc5-8358-d95d617a23fb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001701, "uuid": "5d248233-aa08-4d5c-815b-1c39bff97789", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001701, "uuid": "dcb8e57c-ef10-4f07-9fb5-4e44426a4e6d", "value": "0779c1420bdaa67cc565dbed86e2c687bc840a968f32b5e5cb61ad27f150d3e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290d8488-8718-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615982340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615982340, "uuid": "ef038f2a-9837-4f03-8d0f-5d980d2556bf", "comment": "Malware payload (AgentTesla)", "value": "bfd4bba3ee63af388f25cfc529082adb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615982340, "uuid": "5c457190-220d-43c8-b794-c8169a5d919a", "comment": "Malware payload (AgentTesla)", "value": "07a3430d04be2962515ffa22aadf6d3a5e4564931ef20ae8cd5215b3914ec620", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615982340, "uuid": "1bb04156-16a8-4d02-8e24-dab816bd8a3b", "comment": "Malware payload (AgentTesla)", "value": "7c14b76aa6f58cd8b74c124b7afdcba63f60fa2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615982340, "uuid": "41e7d42b-1e09-454f-8d42-16c97bd45dc6", "comment": "Malware payload (AgentTesla)", "value": "7997f5da72c66cc176b3b82c604a58c3752f3ed7db40a89812bb5bdbf7e4f2614643119e33804004ac704252446a7a5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615982340, "uuid": "37ffa3c5-de18-4c0d-bf70-e41b4ff46dcc", "value": "13F36DA8E991CDD4CBCFC9D94A1E3A952033FA79C6C36CD64428F3F50B9267F4A16850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615982340, "uuid": "f67fd79f-2e57-4aeb-9632-2882918d1d1a", "value": "3072:lhKpZts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8e52P:2pZts6vVGt/2l8nxpKJTJznhdDT+8OGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615982340, "uuid": "9b160b12-008f-4f79-bcfe-1ad1a6a12252", "value": 165479, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615982340, "uuid": "b885eb64-8ccf-419b-8b17-0667e21cbc87", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615982340, "uuid": "e946162e-2e07-499b-8fba-5c36e7d6a437", "value": "order K095805.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4fa071-8752-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007446, "uuid": "9c5dba6b-b302-4d1c-a818-94264490390f", "comment": "Malware payload (Dridex)", "value": "6cdec8b633e08caa399af10088fa4b4c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007446, "uuid": "695d46da-bc6a-40e6-a35d-b653c5398829", "comment": "Malware payload (Dridex)", "value": "0800a1034f852386637d4807494641ff4ffbab86095161b9cee3dc5e21c9a222", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007446, "uuid": "49b0eba2-0269-4ea8-a874-bc9f3acd33f1", "comment": "Malware payload (Dridex)", "value": "1541f5465799a79aaf9c5c5e57e5b73634bdd467", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007446, "uuid": "9ebd19be-f2b0-4618-968b-b4480caa9cad", "comment": "Malware payload (Dridex)", "value": "f9e6e7d11134601bdc180ead0ab6fcc01611a1c45928d68e5f6bff5742ef729c375339274ef69865b87a6a3b87537c0b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007446, "uuid": "6a49e443-56ea-4a39-8723-bca615b09816", "value": "5124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007446, "uuid": "f4b8721f-a285-46ca-b43d-1689172fdf6a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007446, "uuid": "732ac312-8732-457d-a23e-ab48bc361bc2", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007446, "uuid": "cad0aa6a-27ae-4ea0-ac4b-65418fdfa9b5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007446, "uuid": "e5ace45b-4dbe-49fb-87fe-725dab0d055e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007446, "uuid": "aa205ec3-fc40-44ba-b156-25427d7adbf7", "value": "0800a1034f852386637d4807494641ff4ffbab86095161b9cee3dc5e21c9a222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16ff7e6-8718-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615982595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615982595, "uuid": "47d4f71a-eef4-4772-99c5-0b4750f6749c", "comment": "Malware payload", "value": "844d06a617687dec8baef97423d3a6e1", "object_relation": "md5", "Tag": [ { "name": "bitbucket.org_tanake5518", "colour": "#FAB907", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615982595, "uuid": "977f0be9-2f18-4bda-9c5f-f3ed09230867", "comment": "Malware payload", "value": "08d215fd35494280e6397e8bc527bd6de64eb78a73acd3bd07a01da376ed4cb7", "object_relation": "sha256", "Tag": [ { "name": "bitbucket.org_tanake5518", "colour": "#FAB907", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615982595, "uuid": "c53badf9-7588-4ffb-8a68-8a5eedc55289", "comment": "Malware payload", "value": "ce4bf971d64c3dcb16b720b3291e5c34de91035f", "object_relation": "sha1", "Tag": [ { "name": "bitbucket.org_tanake5518", "colour": "#FAB907", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615982595, "uuid": "14eab9ba-ae56-4dbc-bac7-dbee2b5e2c99", "comment": "Malware payload", "value": "dfef90d910a8012c6497f8f88b184ed1d9bf35778184abdf14a94bd71a6a34f0e29431fcdbb9edf689f3a95ff2188432", "object_relation": "sha3-384", "Tag": [ { "name": "bitbucket.org_tanake5518", "colour": "#FAB907", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615982595, "uuid": "2991082a-b376-4546-a255-e0e16b5ec5a5", "value": "BB2733D5BCF7218BEB91463A256BCB780CF416E8A648491847246C537BFFE32E0199F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615982595, "uuid": "ab61207c-6bbc-4b8f-8e7b-3bb83f450351", "value": "393216:jtKgICYntWuBAaWdNWgUYflqQBlwSjFce/f1MSo91pAc:J+ntzAaWdsgZqsxCeX1MJpAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615982595, "uuid": "d61fd487-291c-4a45-8e25-69ba6359414a", "value": 20547863, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615982595, "uuid": "b126085e-cb97-4256-99c2-f0692467ba27", "value": "application/x-7z-compressed", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615982595, "uuid": "23e7a0d4-1062-464e-8ff2-eb19242f1fa5", "value": "bitbucket.org_tanake5518.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d101e8f0-86e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615962006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962006, "uuid": "6cd98c08-fd32-4d72-8cee-858ac1c0982a", "comment": "Malware payload", "value": "9b4b2040a7e979ef48cda803b17efccc", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962006, "uuid": "f09720fe-eedb-415b-b432-55fc3f211a24", "comment": "Malware payload", "value": "08d6bfb3f6015113e7635af07e0fc4f6616e90e45580768b7e2cb043f028785f", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962006, "uuid": "1c5331bf-d881-4eb4-bfda-aa7506371260", "comment": "Malware payload", "value": "75986e79f26608e3df20abf76bbb491b56da93a9", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962006, "uuid": "53b25737-f747-4b0b-a7a2-82f02bc1983b", "comment": "Malware payload", "value": "e5510bb8050173bf593d11172b20ca0f0777d4b6c2cb9c3537b1111f2b0096804481a7b4396c57773603fcfa2bb38a34", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962006, "uuid": "435b0ba2-addd-4e47-8644-a5a778f46e52", "value": "92F36CE8E991CDE4CB8FC5DA460D7A951073F979C6C36C8A4428F3F40B9267F5A1AC60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962006, "uuid": "efe4bcf1-f114-4f56-90cf-1b6f4ed58ab6", "value": "3072:+tNJAvFTnx1//kUWwyJi7eLbkrMrN6EetrKYWZ6gq6AVKlG5hEBYRP2dJ7:+1KFvkeeLbyA6EeNXvgGVKlchEBgP2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962006, "uuid": "789972fc-cf50-4caf-a080-556a149d665f", "value": 165420, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962006, "uuid": "86e2e837-d439-4374-bafa-57874c2a7009", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962006, "uuid": "05b8f39f-02a6-44e2-a8be-b4aa0ead0b8a", "value": "Swift Copy.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bd7315-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "49e38574-6581-40f0-89ec-8249f197ca35", "comment": "Malware payload (Dridex)", "value": "7c2c7dd0d0542a863a6db3c6c1554df3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "0d577f4c-8ec5-4557-80c1-ef75e8ac8072", "comment": "Malware payload (Dridex)", "value": "0915fa3543b544081d5eca580efc3e8f64b3d489ae03644e978759b01567a9ab", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "fd7d1b96-fd8a-403b-8a48-bf615027bd9f", "comment": "Malware payload (Dridex)", "value": "48bf14e8d81c10e08377f93abf885e33397d536a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "6071f07c-1c1b-4888-8027-32651e29a262", "comment": "Malware payload (Dridex)", "value": "21bf3fdd2cfb008144b11d6c6bdf6d42b24da3b9c182e078bf902f93c929d579cacc2b1145eda42e7fec50a272f0279c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "de95c739-7cc9-424a-948d-38706bd939bb", "value": "4C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "ecde242f-4dc6-4b31-9c80-49cd32636b30", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "190931ab-d600-4fa7-8bd5-1426ecc27fee", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003729, "uuid": "c811c447-a8c3-4507-b1a8-4e0f3901c390", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003729, "uuid": "aae2f7cc-e09c-4826-8524-4c6d4f8ca225", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "e34e5b92-e375-4d67-b2aa-d8dea003ff1e", "value": "0915fa3543b544081d5eca580efc3e8f64b3d489ae03644e978759b01567a9ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d1a7ad-8767-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016390, "uuid": "b120f481-42c4-4c10-a2dd-e793db32263f", "comment": "Malware payload", "value": "f5dccf5b39fde944ebdd7f5a5b18b9ab", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016390, "uuid": "69d8e672-3489-469b-8f0f-bbf45233696c", "comment": "Malware payload", "value": "09767e1df7a52090a1783544ecb3b4ccb7db0450e89d5ad5f567b25bf85d4c6d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016390, "uuid": "ecddb9e8-c251-474e-b584-72d8b4952353", "comment": "Malware payload", "value": "d9b0eff4232569d7f839f078ac5c196c84bf49ed", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016390, "uuid": "d64ef679-e538-4484-bac0-c87e0c6e9aa9", "comment": "Malware payload", "value": "8e04dec460ec5f6d6b578e382cd0266eea7b26ee0b2c59afb12c56ba33729ed343b4f2cdb58921dee5639881a4901736", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016390, "uuid": "40fdf072-9908-4f4c-b110-975a911aa2c7", "value": "2724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016390, "uuid": "7932fd3e-6d74-4fc0-8f24-96a38da89d1a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016390, "uuid": "76a92646-81a0-4689-bfc2-8f0a6af8e2dd", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016390, "uuid": "7531526c-5d5f-40cb-a5ef-843e2d81c061", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016390, "uuid": "9cf3da41-4e4b-4c83-8110-24e6fd9f9abd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016390, "uuid": "05a09845-7a2d-415d-bd05-1c19e231c6cc", "value": "09767e1df7a52090a1783544ecb3b4ccb7db0450e89d5ad5f567b25bf85d4c6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372008d9-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615984511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984511, "uuid": "b8a897d3-a829-4916-a1ff-01572003fd5b", "comment": "Malware payload (Dridex)", "value": "8fca6e42d7665f199a46ae049a5f696f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984511, "uuid": "cba1189e-c4df-4abe-b643-24f462e7197f", "comment": "Malware payload (Dridex)", "value": "09bf4d559da04c4d06b696f0c644c858d4ad015537b3422b6fb5ad03d5522cdc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984511, "uuid": "a886eed7-b53b-4c24-830a-b3335f03f388", "comment": "Malware payload (Dridex)", "value": "c3b199f357febcee0d1aad72099b7809a42af766", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984511, "uuid": "019ccbb9-9413-4c6a-b317-172b57cc059a", "comment": "Malware payload (Dridex)", "value": "72d3cbe06e65e28410ab7981f04b9bf75e593f22be7e0920f54b82512b3d4a3eac5c351408be69ecf9ccb531b629043b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984511, "uuid": "ad7bdad7-09a9-4880-9a7a-55ac83102c77", "value": "C014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984511, "uuid": "b8e96060-dfb6-4b21-8ebf-9fde63fdcede", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984511, "uuid": "7445a2ea-0c13-475e-ab6a-10eed5c6a1a4", "value": "3072:U1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ai78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984511, "uuid": "18deb6e1-d3a0-409d-a090-f344fd25b36a", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984511, "uuid": "2ca0755e-63e6-48d2-94bf-a4b4467cde29", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984511, "uuid": "eca956c2-e02d-4e6d-ae39-48634de67a1b", "value": "09bf4d559da04c4d06b696f0c644c858d4ad015537b3422b6fb5ad03d5522cdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80152547-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005249, "uuid": "f7cf19a8-4db7-4665-a927-7f43c02fe760", "comment": "Malware payload (Dridex)", "value": "b14813eb062609ed75c2e56df9820143", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005249, "uuid": "f2d8816b-ae51-4b83-9af7-0081a25e7c79", "comment": "Malware payload (Dridex)", "value": "0a1e16881c6c70bae346d4a83a8cd452caf45b5c5ad85a84cfcc2dfb2df0c1c6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005249, "uuid": "02a038a1-a712-40a5-beef-b393a35e211a", "comment": "Malware payload (Dridex)", "value": "f1330e220a682f7db9f4ad85fe49f7692699b514", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005249, "uuid": "4949579c-b49c-4a13-a6c5-6edde5e51a4d", "comment": "Malware payload (Dridex)", "value": "27ec517f789a80e6d13587b349e9b0707f75114343134885d1c2d71bbcc6c628c59608838059800092bfa0b026e51ae8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005249, "uuid": "3aad381e-e126-4e64-a285-7c1c2cba93d2", "value": "AD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005249, "uuid": "c4bc3ff9-6d5f-4348-a7b7-ddc16491f450", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005249, "uuid": "44c61c8c-b7ee-4320-bdc1-815124355fda", "value": "3072:99Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:99Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005249, "uuid": "ca9a13b7-ef84-4f21-b9be-5e9c5fd59c30", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005249, "uuid": "9ff2313e-4d0d-47c9-a571-147c2386a193", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005249, "uuid": "7fa46755-0b57-4f68-8bdf-f2b6dc8e800f", "value": "0a1e16881c6c70bae346d4a83a8cd452caf45b5c5ad85a84cfcc2dfb2df0c1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe05a7e-875c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011799, "uuid": "eea54933-044f-4407-abae-a2392598d8e2", "comment": "Malware payload (Dridex)", "value": "b563e212e5315891f7c14287fd958a0d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011799, "uuid": "d0709459-aca3-463f-91fd-98eddf5a2143", "comment": "Malware payload (Dridex)", "value": "0a2613b13d31fdd58c74267cd0e807da64f20708a21a52d29d5e648416c53386", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011799, "uuid": "a3f58181-18f5-4f86-85fa-b7e4f918bc31", "comment": "Malware payload (Dridex)", "value": "b14e71ce2cb3d4eb40eb55aeca4b6bd81d10cef8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011799, "uuid": "f0e2073a-a4b0-47df-8adf-b288ff6a9e87", "comment": "Malware payload (Dridex)", "value": "4e15f65305a50e4d9fe3b77ef36bf3d7c8e5027a890a500098f1b2e6650dd81b300e80cb112e4e0b6711f9781a0bafd1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011799, "uuid": "98f3e63b-15c7-4b51-9e72-97805342dfa1", "value": "AC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011799, "uuid": "95e67869-ebc7-4ff1-ab0a-4f945f71576b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011799, "uuid": "9bc0ae8e-ff0e-44bd-9e99-b619ae4a5bd9", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011799, "uuid": "860bf6c0-d609-430e-968d-8fd97c9ec7cb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011799, "uuid": "d8c89fe2-dc3b-4ece-a92c-4cc1f799939d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011799, "uuid": "666a89ae-7913-4680-b9da-79e2d7cdd92b", "value": "0a2613b13d31fdd58c74267cd0e807da64f20708a21a52d29d5e648416c53386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb80765-8746-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616002240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002240, "uuid": "5aacffb1-ff97-436e-8f26-cee82ba553b5", "comment": "Malware payload (Formbook)", "value": "8227a43e03e82c1fb28e6b87a9c00757", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002240, "uuid": "c188e03c-dc36-4f54-86d2-04818ab67fa0", "comment": "Malware payload (Formbook)", "value": "0a342e264f4e5b3edb3eba7474505f38565a9ad481f39678631cf0b3951a237d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002240, "uuid": "c2255da5-b0af-40fe-afb6-13c1d436caca", "comment": "Malware payload (Formbook)", "value": "361e36113c6da045fb74a185dad6434caa297a3c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002240, "uuid": "2ab777ea-fa2e-4273-a7ee-6bb7d5703bff", "comment": "Malware payload (Formbook)", "value": "6e35bb52332f7c34b65fb77b90dd729d61d09e1b49e6e5501eb2376f571d905fe93b8659e57e9936bb61c2f104acf759", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002240, "uuid": "6951ce25-3486-4991-bdaa-0cd6dbf8293c", "value": "BA0533B506E90A6B8F112795D3C9BC0F947EA56B6BBB543C3A05F0CBB8DD6FC4082944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002240, "uuid": "ca490273-f053-4330-b544-d201b706bc10", "value": "12288:1n79v4p8iIoybRWK+Xyesj4ldohWv7GhIfQdyb6LKkpqw6dzG:1p4DjyAK+XyepbpvlQybaKkZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002240, "uuid": "b3641592-98a1-48e8-94ac-b5e416339d25", "value": 806139, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002240, "uuid": "c7452c3c-be79-458a-b89b-4e6f9a857c82", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002240, "uuid": "18e45ce8-4f70-45db-89bf-0f991f29a5d3", "value": "LSZEC2101115860\ufffdHBL\ufffdTLX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b1eb09-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003923, "uuid": "ae2a16e0-7782-4e1c-8449-e16ae6d29ed6", "comment": "Malware payload (Dridex)", "value": "6a5a259af3f0911faed4a3ebfeea40fe", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003923, "uuid": "a36e2a26-8a80-4bc3-ae01-90b62e803426", "comment": "Malware payload (Dridex)", "value": "0a3e1b9ec487ffab77340e8233c05e1ca1e55f1eb057323300080d276860fa02", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003923, "uuid": "3bdd2793-2909-4bc1-8100-6b79165d6448", "comment": "Malware payload (Dridex)", "value": "4492e80f1803dd7da8dabf188dfc47666810b4db", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003923, "uuid": "f6046328-1310-43f6-b312-605d81957c44", "comment": "Malware payload (Dridex)", "value": "c2b6dedc6535c10a0b515b11cda76f52fe76af4211434009263391bb2849e3d64fc7ff90ead9f046532090529518847e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003923, "uuid": "29bee8da-e56f-4407-9ba0-967a251acff8", "value": "9524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003923, "uuid": "fb02ca7f-3351-4bcb-9540-a66e62460aa1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003923, "uuid": "567a390a-47db-4b13-be8f-964fc2449974", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003923, "uuid": "114c057e-9f3b-483c-bc79-72b372f8bff3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003923, "uuid": "eb29524b-5e73-49d6-9d77-00e8bb1b4ab7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003923, "uuid": "953573f8-d0fc-42c5-a513-480341ace79a", "value": "0a3e1b9ec487ffab77340e8233c05e1ca1e55f1eb057323300080d276860fa02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9258c9f8-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004421, "uuid": "1b691bd0-67ef-4335-abce-5d2d684fb845", "comment": "Malware payload (Dridex)", "value": "ce109a600c4cee97c326798c5bb0e271", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004421, "uuid": "f427bbaa-1507-4d2f-b057-1f34283838f5", "comment": "Malware payload (Dridex)", "value": "0a41b67eed1991c435c4d76a35204862f66a07cb6efad9aa08c1999c1074ba44", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004421, "uuid": "076e33a8-f3b6-4c6f-9cfd-45c48915ba86", "comment": "Malware payload (Dridex)", "value": "1f612b4087fc186cd2db55af984ae77577e5be51", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004421, "uuid": "6be0d146-6e76-4e29-bb16-95b2c7975218", "comment": "Malware payload (Dridex)", "value": "c9912f6c6f7b0d62151852ded150b737494f5fa9a56a6d82e40e6d1ed1c1ffd27fda4a299a15e4e5055788b59e1bafa3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004421, "uuid": "5e7310d8-270c-4014-a9cc-a12fd129167f", "value": "0124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004421, "uuid": "908e9334-6aba-4031-ac75-51379b5842e9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004421, "uuid": "b82f3a33-42b3-4d32-b26c-454b08fd8aac", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004421, "uuid": "cec526d4-cf0e-4a15-a7e8-80ff9ccc4e26", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004421, "uuid": "30b36c3f-4992-4d81-88c5-8028f4d2ec4b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004421, "uuid": "3a649d22-f6d5-4a1a-a3ce-4e79416913fc", "value": "0a41b67eed1991c435c4d76a35204862f66a07cb6efad9aa08c1999c1074ba44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d333310c-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "63902777-22a7-4a02-85d5-117ca06885f6", "comment": "Malware payload (Dridex)", "value": "ef6b4a57391fccbae2a0cb32dbb91a20", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "aef13a46-2d38-4265-ba8a-369f52ba7f9d", "comment": "Malware payload (Dridex)", "value": "0aa58a67584da3aa4ca072742fb16790543fe956b67e756d4fc3633f92018cb6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "c2cfd9e3-13c0-4802-b6fb-346b53626444", "comment": "Malware payload (Dridex)", "value": "ec361e89a97c1cc9ef3d2f63ea690d9a462b1933", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "24e4bf52-9e1c-48e5-a16e-e3c2ac722cf4", "comment": "Malware payload (Dridex)", "value": "10a4630ef12afc127b032a7abe553615ac793b8bedf65be3dca9b1020cb29715e69440f6a3afe6cc18a1ccdefbc2bbad", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "87c64cff-7143-49f1-9b93-94d9d951375f", "value": "BE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "6af488ce-af5c-4217-99f4-6932a2b7a8c3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "8c0fef44-0bd7-484d-bd12-8bd2088a314a", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004530, "uuid": "5d4e16bb-a8ab-49b6-b6a4-70ab108ff685", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004530, "uuid": "42c11783-1cc2-45c9-b012-8ca3b19d5189", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "3753eec3-c2d6-419f-a605-beca3ea526a0", "value": "0aa58a67584da3aa4ca072742fb16790543fe956b67e756d4fc3633f92018cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cedebb16-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011394, "uuid": "4bc812cc-291a-40ba-bd48-0cbb7ef6781f", "comment": "Malware payload (Dridex)", "value": "2198cd3b9fd677f055345ac1b03eaac9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011394, "uuid": "1fc9be74-8c42-40d9-b6bf-e12f5ae16a27", "comment": "Malware payload (Dridex)", "value": "0b8b5aa79bd3e1a4c7018c7e553882d78055d36532ceb4f78fc0f3afecb99b03", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011394, "uuid": "1a33225f-ff01-49b4-b576-c5b85af2963e", "comment": "Malware payload (Dridex)", "value": "8c8877da0ed4103baf9c9ad6ae49d072192e50ea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011394, "uuid": "7da6fbb0-e1dd-4fde-ac26-4f7311656ce6", "comment": "Malware payload (Dridex)", "value": "b9075bf3817a3aa175186c03f67596ab1f556ba379f490311bfaaabc9fdf82b2f9016c76d343178ef4533cd3fbdef331", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011394, "uuid": "734511f2-d536-48de-89d3-89a3a61425a0", "value": "F924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011394, "uuid": "7c2a7a76-4feb-4078-8af1-183fc8bb9fa9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011394, "uuid": "8fe08c12-3098-413b-9045-9a2626f63101", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011394, "uuid": "74a77cb1-cb00-4bb3-86ab-c4e1d3b2740c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011394, "uuid": "68ed4706-f47c-4110-955e-8d62a18b5400", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011394, "uuid": "22c74daf-cf4d-4362-bd98-905092bdc9ec", "value": "0b8b5aa79bd3e1a4c7018c7e553882d78055d36532ceb4f78fc0f3afecb99b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205f4358-870a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615976312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976312, "uuid": "577f3eb7-b0ff-4ec1-ad2f-949fe1ddef89", "comment": "Malware payload (Formbook)", "value": "23b6bba3e57cf15284314ceb49b8ab58", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976312, "uuid": "559d17cc-f7da-475d-aec7-e5e83a6e5c1f", "comment": "Malware payload (Formbook)", "value": "0b9e947cdb87e99e587d7c933189de60617b93e456303c58acecfcde1f7a2d36", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976312, "uuid": "38beaeec-bf67-483f-848e-fa3748890b6a", "comment": "Malware payload (Formbook)", "value": "6b18014caab76295c1422806b320967f162bb096", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976312, "uuid": "51704ec7-8f6d-4be9-8eba-4123048dc9f2", "comment": "Malware payload (Formbook)", "value": "4db6b280cb797ea739e824a13dfe3535fb3aa82bcd39797bab8a68d47a5e5cc470384f5c417b732aef985337289261cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976312, "uuid": "08685b19-c0a6-41ca-8bc1-0fa239181cb7", "value": "87B53383A9C3DF69E16D14F496CDDD346421CC225BAA99237316371634BB03BE2E235E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976312, "uuid": "0e547a4b-dcd4-4d1b-9f67-d1394c19fdfa", "value": "49152:oEZppqq0CxTEPTpR6jk0K4yrGsCZCw7tlOhTa1dkNIOxzZS8Bhk1cG:oEPpqCwduKRCZCw7cT4d0vxzg6hE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976312, "uuid": "a7980c54-8e44-428b-b2c5-e81cb13104b7", "value": 2490368, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976312, "uuid": "6b7644ec-014f-4127-a15f-da7dd5d75bd5", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976312, "uuid": "317bf738-3f4f-428d-a465-647ea7b2298e", "value": "MV BERGE MAWSON.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c34709d-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615962132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962132, "uuid": "eea73caa-34b4-44ef-bcbd-d139e259a841", "comment": "Malware payload (Loki)", "value": "0cf6a7806e1f1ff00f69248acf5f65ea", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962132, "uuid": "805fa075-7e7c-4c09-8750-f966225cb92e", "comment": "Malware payload (Loki)", "value": "0bc74a19b014414b1fed76380d0ed3f361b730b76610cd17fffd52113c3e4748", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962132, "uuid": "b642cf42-4b96-4835-881e-5a6d983e65e7", "comment": "Malware payload (Loki)", "value": "e1b59c586218c4e812ad40e04f2847541d474051", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962132, "uuid": "be21e1c8-bcaf-4bf7-a653-6156af775ce7", "comment": "Malware payload (Loki)", "value": "d62348114000a0cb176c7d36696d35e1c01e6edc97f6b866442bac1cd5e14ec1724ab1568c470c2574056feccece71bc", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962132, "uuid": "d2a7312d-edb0-466e-bbef-9f3a9194cb72", "value": "F7B523097CF04F02D62A60316DABF35619B1AD72F5CDCC07E22233D52E3E5945A9A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962132, "uuid": "3078758d-1f87-461c-ac77-af0fba2040ae", "value": "49152:I9JBOt33ivIUsCKfVXSnFC3wFmW18a4EtEkJYFTdjMzkVOkHKvpE8abtxS77wCP:gBOtHivjsCKKaEay2ThMzk0pETx3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962132, "uuid": "72d487f3-f3fb-434b-8d1a-66896fb2b8b5", "value": 2383872, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962132, "uuid": "e689e7a4-a02c-4473-9cf9-cdcfc60aa0cf", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962132, "uuid": "988d8ee8-c8fb-4fb3-9871-191803769ab0", "value": "Bank Details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67d9464-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003703, "uuid": "daa427c7-2fb4-48ec-9a03-00fe83e067d6", "comment": "Malware payload (Dridex)", "value": "ab98d26e4186d6b2985cfee13d52b962", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003703, "uuid": "c3ebc843-3523-4638-accc-86a42af6a7ba", "comment": "Malware payload (Dridex)", "value": "0c4cdca0f6ed4e4019c8030e83d48acb80d5677cca2937a747e19f69079bf192", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003703, "uuid": "042d36a8-e359-471f-96c5-84f4694a66a8", "comment": "Malware payload (Dridex)", "value": "3a62c32496bac21aefe3a84a55e226b482392d48", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003703, "uuid": "5013e37d-f3d6-489a-9ab1-983629057a7a", "comment": "Malware payload (Dridex)", "value": "8b887266f3823eedb45ecfbcfc443211cd3ad4b52457273481dfe1da442d9b04b8e44e1765d0f5980ca1ed7b8ec8939c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003703, "uuid": "569d9e51-6265-4efe-a0ff-74d5d490947d", "value": "F024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003703, "uuid": "e8770161-c3e5-43c9-bb15-1f80850e40ff", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003703, "uuid": "b3163046-d678-4aaf-9908-50d03bb3d13f", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003703, "uuid": "4c80405c-dce4-4637-8903-474a946f0489", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003703, "uuid": "25c23562-1f52-4e5f-93d1-afd4c33c5878", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003703, "uuid": "5c229729-efcd-4b18-b193-58bfea4da633", "value": "0c4cdca0f6ed4e4019c8030e83d48acb80d5677cca2937a747e19f69079bf192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1471fd29-8758-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009793, "uuid": "755de2b4-4513-4cee-9ca6-34b6b7caf092", "comment": "Malware payload (Dridex)", "value": "3e6fe3790e641f543282fb622396fbc9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009793, "uuid": "3c977ca7-04f2-4bdf-8b5e-aa34203e720d", "comment": "Malware payload (Dridex)", "value": "0c5368d7024e6388b2df9577d331eede50f5f6641056ba100347210b70555ecb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009793, "uuid": "288313dd-d4e2-4c41-b31b-a34777fa4cb6", "comment": "Malware payload (Dridex)", "value": "2a3e0fb91accb92bd43c0a7b5a16638e49038b74", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009793, "uuid": "a3824107-aa18-4a51-a53d-f46f4fa97e97", "comment": "Malware payload (Dridex)", "value": "3abe041e34111658ce556a9b21bbb3f5b4ba21c45cc28af65e0eca939115de8dfaecb8d50fcbeaf320f502fa8485d150", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009793, "uuid": "a60ea82f-c3e7-4adc-8758-1b78949e64b8", "value": "0E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009793, "uuid": "8f6dd4a5-9d84-47ca-9e7e-7f6f3917d975", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009793, "uuid": "140af795-b82b-4583-a4e2-0318989bba58", "value": "3072:w9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:w9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009793, "uuid": "3bdfc32f-39ca-4735-9410-4e28d9238efa", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009793, "uuid": "8bb48c86-d69d-4a79-ae73-d72c8db968f5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009793, "uuid": "ef32417a-250c-4da5-ba62-b225e9929e1f", "value": "0c5368d7024e6388b2df9577d331eede50f5f6641056ba100347210b70555ecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a839e5-86f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615967995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967995, "uuid": "2da28135-a521-4df7-ba56-70a751b8d85a", "comment": "Malware payload (Formbook)", "value": "4087e66ce1de6f14aa5b41196556c6c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967995, "uuid": "1bf9608f-69c1-4ac9-81eb-f4b798f695e8", "comment": "Malware payload (Formbook)", "value": "0cfcc28cdab9675c1a09f88af826490e0e35e4292d7eedf174f9dac055d8085d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967995, "uuid": "1b0981c9-76c3-403d-bb7d-0c98e0b76ed3", "comment": "Malware payload (Formbook)", "value": "8bbdd549e066142800f468b620412b801eabc765", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967995, "uuid": "60d56ab4-99db-4592-8cc3-ef0f9ac3fe25", "comment": "Malware payload (Formbook)", "value": "127f16c5376b1a292f6cdb73532ca8dbc413c3cd920dc6a6eae10042f43479406cc18f4e0e77921f8df480e34117c901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967995, "uuid": "f968a0ad-6a7d-488b-b538-7404787c9553", "value": "60C4014223B87BA5E17517B90C7D460023F2F9045776C2FAAD99F0DD09A2B18DAF4B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967995, "uuid": "b8b40979-a28b-4547-8ffe-deadf155da9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967995, "uuid": "9d7192c3-50b6-409e-b78f-a3f754165fd9", "value": "6144:imxYBtmE1z+kujP2DmkJ4YJuQWy/ze3TK6hBtmel+DzowcI9hcluXtt3JrzywG+Y:iN1psPcnGYJuQWwzISelkSmfJzElP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615967995, "uuid": "adfde567-1209-4ba1-ae3a-689ccc975033", "value": 567296, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615967995, "uuid": "d3c1ec30-0f10-4246-8230-106cdc616fef", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967995, "uuid": "e3104ef1-d007-4108-ad95-a96db3d99f9b", "value": "4087e66ce1de6f14aa5b41196556c6c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a4cfeb-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005443, "uuid": "2ecc1802-50d8-4e99-a1e6-ecf1cc407944", "comment": "Malware payload (Dridex)", "value": "b47431d01b3c280e28e8a5fa87d14e69", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005443, "uuid": "b760e4e6-fb26-4fb9-9fb6-a809b400cf55", "comment": "Malware payload (Dridex)", "value": "0d1a12f34745c8045b3cf538845c0a60ed200ef278c492164ee09fc02611f754", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005443, "uuid": "481ca4d2-3a59-43c0-8808-862018a56810", "comment": "Malware payload (Dridex)", "value": "4029a4aa4156c128d3090db904e5329edae58d35", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005443, "uuid": "387a3a7e-2cd0-487c-9a61-2933f25784af", "comment": "Malware payload (Dridex)", "value": "b8a4d0438babd8623d241d2d337d78b592636a6ad2bb00a7051c180883fbda6fbb0bf3a0a7b58635757e35e25fa99d97", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005443, "uuid": "65498fb2-9b4c-41e4-bb25-6283d40d9a85", "value": "E324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005443, "uuid": "c88e96ed-db09-46e5-83ad-f9bf4ed255c0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005443, "uuid": "07f4702b-b59b-459c-9af9-60037d40bc11", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005443, "uuid": "14fbc8fc-24d5-4359-adcc-fdbc4c8e50b1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005443, "uuid": "a66d8573-cedd-438d-be71-69a26c52244c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005443, "uuid": "8bd16b72-9e1a-4b6f-ad1b-d8228869ab82", "value": "0d1a12f34745c8045b3cf538845c0a60ed200ef278c492164ee09fc02611f754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387c3ef3-8761-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013719, "uuid": "d1ae109b-af6e-4ade-a13a-43587a5e02b0", "comment": "Malware payload (Dridex)", "value": "d4ec2dceeb7aabc10a0f7f9f72d9297d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013719, "uuid": "b78a00ee-d6bc-4ef6-92c7-9702a305a71d", "comment": "Malware payload (Dridex)", "value": "0d1cf94ddc1935d7f43af803b1d2dc27b3837541d8a0f922ea2465c609428b49", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013719, "uuid": "0c70dd3a-e62b-44d9-91fd-819086969c91", "comment": "Malware payload (Dridex)", "value": "69bf1c000c0206427e35524b223f9260132f85ba", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013719, "uuid": "bcd37788-bf8e-447b-81ff-ab74b54fabcc", "comment": "Malware payload (Dridex)", "value": "c37a8551e40a5b500410f55fefffbc512e59878532e5a97e51b28d6977e3728b4393923ea559ee81c84af60ff5e78645", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013719, "uuid": "a28561eb-fc27-4cc1-8457-6e8310951d6b", "value": "F924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013719, "uuid": "3542878f-4a0e-4ba9-a90d-4039375eb644", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013719, "uuid": "b9052632-e907-4edb-8a12-cc67f8930035", "value": "3072:S9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:S9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013719, "uuid": "c1159fd0-959e-422d-b9a6-9db5f5a4db7b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013719, "uuid": "855b6a69-bc5c-46de-afbb-dda53ee46d0c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013719, "uuid": "d850ff91-107d-4659-a19b-f1e3b93c9112", "value": "0d1cf94ddc1935d7f43af803b1d2dc27b3837541d8a0f922ea2465c609428b49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5012c60-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003674, "uuid": "af684a41-2796-413a-8510-771fc44883c1", "comment": "Malware payload (Dridex)", "value": "ca0ff2af0fa0dd648a885e3278963a8c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003674, "uuid": "4e74906b-98f6-4573-a818-c8587940efc6", "comment": "Malware payload (Dridex)", "value": "0d42560d0fed1838f057452e3fa6d98510167a85898a8a2ab4dc978de171b59e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003674, "uuid": "4142d84a-9bec-42d7-9a34-23ed0692e41b", "comment": "Malware payload (Dridex)", "value": "b05a1192db20376441e805471cee97f891d59ff9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003674, "uuid": "ed7bec51-5db7-469c-a5c8-072a0c4db86f", "comment": "Malware payload (Dridex)", "value": "4c4bfe19d3e026157f0f14c2d935cce1f274aba105bee9f1c1e68e7d3b705423a3562a18f9bde203a71a461940e8c307", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003674, "uuid": "103cd113-d5c5-404c-bca1-6e823d347b42", "value": "FB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003674, "uuid": "d0d11892-4cc8-4a83-908d-591622d36df6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003674, "uuid": "638a9055-36b2-455a-befe-4e08bf17b7b4", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003674, "uuid": "e974c683-d016-4406-8311-728814a0a8eb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003674, "uuid": "d61498bc-0c53-45d5-a373-50b13c4a5c9e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003674, "uuid": "76f256d5-7371-43a7-8e80-2f020fb5cace", "value": "0d42560d0fed1838f057452e3fa6d98510167a85898a8a2ab4dc978de171b59e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91237f97-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001842, "uuid": "786e566f-68d6-481d-9401-66f6cf43ec8f", "comment": "Malware payload (Dridex)", "value": "fa224c2284e146361ff6914cc06fd008", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001842, "uuid": "8d4afea3-81fc-4d7f-8050-b2a1dbdefe37", "comment": "Malware payload (Dridex)", "value": "0d944f1aa268c774479b464c5eedf68ec5f279c1f3c3a694fdf0dbe82645a8c6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001842, "uuid": "c60827fc-a105-4c88-9961-222fdee9fa32", "comment": "Malware payload (Dridex)", "value": "8d041f425a8f585a5f7ba22db9a633b79d634db3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001842, "uuid": "3779fceb-fe7f-4d37-8394-14210f401da4", "comment": "Malware payload (Dridex)", "value": "b720ae80e8270623aeda8ea927dd835573a8a0dea650551d5b05fdcae54ead0aa97d223b8fa55f5cee389b56904dffa0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001842, "uuid": "22037da5-e6dd-4544-8675-41c3da2cb68c", "value": "FB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001842, "uuid": "a0144f56-7eac-4bd5-9aad-0ccf0777f720", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001842, "uuid": "4ba7e5cb-0c9f-44a3-be00-d472cc3e2e40", "value": "3072:n9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:n9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001842, "uuid": "e6cfa178-626e-4374-8c8a-cc54f1a79e99", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001842, "uuid": "c6d4487f-d460-49f5-b698-eb19b355dd61", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001842, "uuid": "625270c5-2bdb-4eb5-bb54-4f57ebd4ae80", "value": "0d944f1aa268c774479b464c5eedf68ec5f279c1f3c3a694fdf0dbe82645a8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39a45e5-875c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011885, "uuid": "9fb63e21-4490-4f71-b018-74911d46d1aa", "comment": "Malware payload (Dridex)", "value": "b589d60b785a8531bc560bf2babc32f5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011885, "uuid": "9737a2b0-8bf7-4645-a91d-e2174aa18913", "comment": "Malware payload (Dridex)", "value": "0dc9355715fa24138c68292eaafee29906dbef22b4fbcf16f2141e0e6efe98bb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011885, "uuid": "48365c94-e8db-4fd1-930b-3cde0ca4a3d9", "comment": "Malware payload (Dridex)", "value": "da8b8bcc5bf67c7b0848b0054fd4a236ea89e2da", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011885, "uuid": "18656fa7-f541-4ca5-8a39-87a6a8311ad5", "comment": "Malware payload (Dridex)", "value": "c21b3082b27bd09d61882f15aec1625a4a874c43b5a9dd27c14ca461a4d2c770e9c40b549bd380c34893ca514e242c22", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011885, "uuid": "c9b1f380-bbb3-4a89-8724-b67a33f3e26a", "value": "6924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011885, "uuid": "90dcbd44-ff68-4415-80c0-5576f48dab63", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011885, "uuid": "7ba0c230-0a3b-46b5-ac99-22afb354618e", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011885, "uuid": "02e7f712-05ba-4b42-a40e-a67521ec1847", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011885, "uuid": "6d8e3505-9e25-410a-b9ee-33d48b6975be", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011885, "uuid": "e2f71d92-31a0-49e0-ad3c-6d9c4a690b86", "value": "0dc9355715fa24138c68292eaafee29906dbef22b4fbcf16f2141e0e6efe98bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cd121d-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1615984515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984515, "uuid": "8790c23e-bff4-4037-a659-cd60597624ca", "comment": "Malware payload (CobaltStrike)", "value": "56d7ae0250296d3cc6a5de3ea0386c32", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984515, "uuid": "107d5793-9b4c-4b66-a54b-69411190ef79", "comment": "Malware payload (CobaltStrike)", "value": "0e30a27d44484b9baa56e7b6050581e3edc3bd1b426057c85824d0cac493a3f1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984515, "uuid": "c32e44c1-c445-4577-b2c4-46098413e635", "comment": "Malware payload (CobaltStrike)", "value": "3cfba4b65925ea397e6c780af61883c3b5269312", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984515, "uuid": "f8463ba9-390e-4290-9ff5-5bfa1c5332ca", "comment": "Malware payload (CobaltStrike)", "value": "1ec0f6c0070cf0251aab1d6e40e7620785efbd83d1c7f4f84e23bb42aa9684fe19b14885677902324745dc5feae96acd", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984515, "uuid": "dc956ded-5533-45ee-8803-32e0ae3547af", "value": "CE54CF6A64231158F48F3C789AE59A79376A5C3ECD1B0D75C97B8A3C993303014FBAD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984515, "uuid": "8ebbedea-0fe4-489a-9987-184d61512dd0", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984515, "uuid": "4a3d96e4-7c6d-4a30-93ee-ea99316dcd4a", "value": "3072:lRVfcmvKwmHE3iM6+sV2VAVztoaC7nzlbfmTkcwlsnO0LJjCdvBcmn7v+A5V28lm:lRvvOESJVXVZoa6zlaw6O0IpvBlD61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984515, "uuid": "aad0ba84-e139-4490-838a-f264c73614e7", "value": 284672, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984515, "uuid": "38c79e38-2d9e-49cf-8778-49462293bea7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984515, "uuid": "b99680d7-f5f4-416d-bb24-fadfeb179fe7", "value": "0e30a27d44484b9baa56e7b6050581e3edc3bd1b426057c85824d0cac493a3f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed691b2b-8721-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615986535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986535, "uuid": "4820150a-27c4-4aa3-9c52-2601b60d37cf", "comment": "Malware payload (SnakeKeylogger)", "value": "415f374b1fbc15e332532ab3da118570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986535, "uuid": "43d52296-3937-48dd-8f3d-edb56fb17e6f", "comment": "Malware payload (SnakeKeylogger)", "value": "0e3b90dd2bb885d5c780ba8d50897ab651c24644c283ed76bae6b09c25bd23c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986535, "uuid": "cb8e2f3e-0406-4b6e-a18b-9eb1a4c56e52", "comment": "Malware payload (SnakeKeylogger)", "value": "7d54288cac88958233c1cfffd6f12a61b9f21b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986535, "uuid": "55cb83cd-8555-47a1-8ca5-fd7bee06910a", "comment": "Malware payload (SnakeKeylogger)", "value": "de0ce8f6560bcb06b81336042b7192f857841c76e6d3a109bfaecfab37374ee9abd54410b6aa7e535c226351c3995364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986535, "uuid": "07874b90-4929-44c3-8ab1-d1b7323c5e81", "value": "12D4E0ADB6551323DA1603BD58DA75C0E73AA07A1E26FFF4089940991623731C2A37FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986535, "uuid": "70f0437b-62ea-4237-a730-40a9e6790f50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986535, "uuid": "127d9229-e7b5-477e-95ad-3910ac171b58", "value": "12288:qo6Ilxwk6vY1mJrusEIkNdhI8UW8kVLOl:7nohvgmJREIMdhJUgVOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615986535, "uuid": "4b7e6622-5bcd-4531-8166-94d87e6cc5ab", "value": 604160, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615986535, "uuid": "7091fe48-95af-4450-9416-b2ffc3fd5680", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986535, "uuid": "a6926b26-e0b2-4278-99e0-f55750af8eb2", "value": "march order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b35db21-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615968680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968680, "uuid": "784077f4-bb1a-413b-bc95-e9cc7aa4ce96", "comment": "Malware payload", "value": "b91ce14fbeb12ab2233d195a4c71cd33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968680, "uuid": "4169d3cf-7554-4b59-9669-838575145e1b", "comment": "Malware payload", "value": "0e4915d612b1d930e773f70acc9f86c0263a86e5103d0ac52fc892db0a899e8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968680, "uuid": "6b16748c-1d55-429a-a616-9f94339dd20f", "comment": "Malware payload", "value": "3b681778853d40baedd0162d3d0d5b30730094a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968680, "uuid": "c4b974ae-a717-4d78-9111-148603b61d47", "comment": "Malware payload", "value": "7644ee843f937fe4efbc2acb76137700e5c682c2b559482bcdfe40e6dfe0b08a61514827b51a1a5556822c31279ff895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968680, "uuid": "2e80abd9-b8cb-4c9a-802c-f233bc5d9967", "value": "7A4370E92998C4E7F09CFD73B4813941943816F76805AE6F49C94583982AF933EDC26F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968680, "uuid": "08917e1c-d7f0-42d0-ba5c-8cc31b8e55ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968680, "uuid": "871bf771-e8af-4e1f-8375-62b0f9233f79", "value": "768:nSrNa1MZ89fO8pn+CPYXW7tPJajWA6Z5JKZ3Ry/yFtlLT6DZ9QRJGfMFYVGflvxY:neNa1MZ89fO8JVPYmRQjB+kge7Tgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968680, "uuid": "5bc2e473-ff6b-40ad-83f5-1e5cfe957d37", "value": 56496, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968680, "uuid": "ec559968-dcb1-46ad-89bd-e0dd0e200867", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968680, "uuid": "1757a630-6f0a-444c-a7e6-93655572d8df", "value": "b91ce14fbeb12ab2233d195a4c71cd33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35b01a0-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "5f0d316e-e04e-486a-a04c-99fb5883dcd7", "comment": "Malware payload (Dridex)", "value": "e662f345d3c95c936925cc688ca3b52a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "a45590ac-91b4-4a9f-bed2-0c9bd1343f2b", "comment": "Malware payload (Dridex)", "value": "0e67d896bb25ab037d99569d44ce15b62a4ba479aa7c42ff7821ebe7e0603988", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "87425f52-f327-40e5-978d-8d194b1f4938", "comment": "Malware payload (Dridex)", "value": "ac5775efe92926ec62349fac410dd8674e43dd66", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "81cf9bb1-7e88-41f9-87c8-c535eaa67bca", "comment": "Malware payload (Dridex)", "value": "a1a4859ff520c78379b2e835004057f7465a332508d8bb64de5e6e25be0da1a9f373bd759b346c07b32776e49ede9302", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "927716d2-ea14-4569-897d-c2db7de18baa", "value": "F224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "be27a971-4e7d-4c35-8e2e-d009c6798697", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "08b20d01-a32f-4665-bd11-9a7dbc0e8ece", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004530, "uuid": "bbd1010e-0dcf-4112-98f0-cab536701531", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004530, "uuid": "1b7a7f51-d261-4c4e-895f-3fc2ad1e85b7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "05697f6a-a167-4579-b926-dec788104af5", "value": "0e67d896bb25ab037d99569d44ce15b62a4ba479aa7c42ff7821ebe7e0603988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b22939f-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "beb3a59f-4d22-4c4a-813b-e78e20dbac38", "comment": "Malware payload (Dridex)", "value": "226c1832e82b46798494c98285dee2de", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "a4344914-3b67-455e-8759-28f51309821b", "comment": "Malware payload (Dridex)", "value": "0e701f82bafdabc478d95273f2708a0088b881f88caaf3b5696e2d9a4dd3f63b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "0e6534ed-4ca1-4d53-985d-dad9dbc7d5ed", "comment": "Malware payload (Dridex)", "value": "ebdb4c0a820a250655c8e8cfeb34087950927557", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "dab585c8-fd77-451b-824d-8711a08cc969", "comment": "Malware payload (Dridex)", "value": "58f1c4f4b98bb64007e73f50c0e339f09003fb7584146b8c85e202c07e2ec1fd4eedfdc63824b531225e4b28d77f81c7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "70cdfc08-78a3-4af9-b98c-7091c8a9ad9a", "value": "0A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "143d85d2-2168-41e4-9606-4cb2cab8760d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "98cc21d8-7061-4205-8705-0746dcbb5034", "value": "3072:k9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:k9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003845, "uuid": "1cb765d3-3a03-4dd7-9aa7-3ed6b76cdc9d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003845, "uuid": "28c60e33-e101-4c9b-b657-2cd407604605", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "920f72b7-ac2a-4b14-aed3-1a72bc4685a3", "value": "0e701f82bafdabc478d95273f2708a0088b881f88caaf3b5696e2d9a4dd3f63b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d750856-8751-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006909, "uuid": "b93d84e0-df1b-4088-8865-2037803d88e3", "comment": "Malware payload (Dridex)", "value": "b1625ca62416f62009a01b4dad9eecef", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006909, "uuid": "368ff155-a954-4e66-9d58-516095187fd3", "comment": "Malware payload (Dridex)", "value": "0e7a49ee5c6f9933001df6eb48f057994d5f195fa5623d3786b0fa195f19121b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006909, "uuid": "793ac7e9-d1c8-4882-acdb-0a44e8de959f", "comment": "Malware payload (Dridex)", "value": "92a7ace704033a8679d918013d89a762129b00b8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006909, "uuid": "bd36ed2e-f27e-4f20-9c2c-9f9c36dc494b", "comment": "Malware payload (Dridex)", "value": "295a6fc70b02c4b710da65c3f20ce3f14504d76eefb7824690af7360ea6e7fad69df5b38e4c1b30f7a0048acea7d98a8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006909, "uuid": "a39a4199-e09f-42b1-adda-a5a645cc9219", "value": "DE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006909, "uuid": "8e426253-bd89-41c0-859b-ff1529218415", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006909, "uuid": "508153ee-c6be-4cd1-bf02-ae866ff3da18", "value": "3072:x9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:x9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006909, "uuid": "1b01312e-8be5-4ba7-9a6d-3086e609e236", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006909, "uuid": "a0054a63-a211-491b-9a8f-d6e020ca53d1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006909, "uuid": "e2717178-b71c-4a72-b898-8d90ea236dd5", "value": "0e7a49ee5c6f9933001df6eb48f057994d5f195fa5623d3786b0fa195f19121b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a975d03d-8721-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615986421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986421, "uuid": "3d848c18-6200-4044-a3cd-c4ca247e9eb0", "comment": "Malware payload (AgentTesla)", "value": "a67d64c8229cc984339be7dffef1c853", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986421, "uuid": "324af973-f23f-48b5-a74e-5523a245e835", "comment": "Malware payload (AgentTesla)", "value": "0eaddf903612f52f211fb2d39ef8aceda9b9b5d5f96c0d6f106e53ddb1d94bce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986421, "uuid": "5b1a9877-0835-4c0f-a7ef-364358e4ff0a", "comment": "Malware payload (AgentTesla)", "value": "04a2df6153d6999cb86843f1f2057235d5933315", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986421, "uuid": "51192d93-a951-413e-a217-494376be63ff", "comment": "Malware payload (AgentTesla)", "value": "53ece6a240008831729d6fc8e8f972174c035276cc43e4307dec51190b5e1e5f689ca7116143382c2bac5f2988b88ba5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986421, "uuid": "ae0fbc18-c3d5-4779-bb54-0e291e0505aa", "value": "49C4F14523B0BB29F0B41778583E5A106BF2FA459776C27EAD81B0DD0876B18D7F4A38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986421, "uuid": "672d6be1-fb5a-4e86-b76f-1a852a486d1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986421, "uuid": "075457fe-f166-4c19-b5de-728badef83fb", "value": "12288:KVJ1LYIDj13HbZtlxsVy3iRNZXuo+UHiKeSQP:KNkI31XbZ7x53iRjuoDCKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615986421, "uuid": "d522e44f-d73c-41bb-ac4e-71dce55bf986", "value": 574464, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615986421, "uuid": "799b0234-851d-452b-bcf2-cc24e1b3fd79", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986421, "uuid": "1de81939-9383-486f-ad70-449403ffe7c7", "value": "XnrLrbE3XTAEstX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a2aaf8-8712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615980076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615980076, "uuid": "cc132a5b-f366-4f98-8e28-a122d51cd25d", "comment": "Malware payload", "value": "08cf173c4b00bbe0bb42dabbacfb20d1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615980076, "uuid": "e65c1b25-0880-4de4-9fdd-0b4ccc72009d", "comment": "Malware payload", "value": "0eb2fcbc547134e23411233a29610e38c0755476cb8d7b04c5fc8ea827470d83", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615980076, "uuid": "3259d081-7897-4f96-bcb0-675c34a149c5", "comment": "Malware payload", "value": "d092ba8889f33f569fd94ee56a0beea814e3d715", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615980076, "uuid": "7f25a221-4918-407b-9136-04c65b9692b2", "comment": "Malware payload", "value": "2fab68cf4831b902cffc551415688f8c1784ec507c3fa501542cd6b7581e4d4d87745ee83574b9d19333eceff9f9f443", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615980076, "uuid": "8879a8f4-62dd-42a4-aac7-839de1d86bbc", "value": "D88312270E0B6027DD28C043587ACFC3AAA1ED393034CDEED7DF59D4699B094572A7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615980076, "uuid": "16a4df41-0b13-469a-82e5-5feae32fd567", "value": "1536:oDlqv82lq9sHZgaCybkjR3jyHInaJU0nWjAFLhl92BOWZ1YmXD3uhPXy/A5CgRV:osvlqyCybkjR3jyQ0QAFLhpWZLwLwgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615980076, "uuid": "6135621a-923d-4112-a4c3-cc2dc8a34353", "value": 88640, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615980076, "uuid": "a6272eab-f628-442f-9325-d73f5d7c1245", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615980076, "uuid": "33315b94-9c8d-4ce9-8466-c48d7c1a03e9", "value": "DHL Shipment Notification 771037910321.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aba52a5-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615968357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968357, "uuid": "918e82c1-98ce-47b2-8f43-a7ba68bd5dcc", "comment": "Malware payload (RedLineStealer)", "value": "ba513fe18017bb5631a81f2da4a38933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968357, "uuid": "69237fef-5d1b-4d92-94b8-b02a0548261a", "comment": "Malware payload (RedLineStealer)", "value": "0ebab35c1d6c8bdfc810aa740f9038ce35e578d294c70df70686a3a3082d8332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968357, "uuid": "9935c3c4-da15-4e1b-83fd-7812bb3cd889", "comment": "Malware payload (RedLineStealer)", "value": "99ac277a7858f2b6e8c02f23ab17a6711189f316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968357, "uuid": "874f6eb7-494c-43e4-8e5f-3d872984c6a9", "comment": "Malware payload (RedLineStealer)", "value": "22ce33a394a711a43e4b3aa61b31530284d2a92174086f0cfd8e82c5ef2b83ca614a6893bf0786d9cc2cb0beedb94219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968357, "uuid": "4b9f92ae-5ceb-4739-8e89-f39a8032789f", "value": "3CB41288B760C82AD44A0D782D6BDFA47F24FEC11D5C674AF586B31F4AF5B42E408396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968357, "uuid": "380a84e0-aae2-4a21-8ba1-b9762856cbdd", "value": "caa5e6a2892587c2324418efee31c648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968357, "uuid": "2c9df363-1f33-4087-a180-70cde938db13", "value": "12288:97iLxBGNINxDRhDqaRQTBRwrl1MWsXI9a+2YO+:97iNBEmxfqzNdTXI0+2YO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968357, "uuid": "03918fdc-71ad-4707-a83a-94e557fc825b", "value": 525808, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968357, "uuid": "6732ed24-e373-4102-af5a-dedd31af76ec", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968357, "uuid": "6927a568-6d67-4807-a4bc-c6791b429790", "value": "ba513fe18017bb5631a81f2da4a38933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4fcc55-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615968521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968521, "uuid": "8ae7a4cf-fa55-4da0-94d4-ca31f4e0dc7e", "comment": "Malware payload (Loki)", "value": "e3b58a4667e60e096b55117de7a0d777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968521, "uuid": "7b22ddfc-5bab-4cfe-b007-dcdc17faa38a", "comment": "Malware payload (Loki)", "value": "0eeb01a2217d5c03c6b0af239dd46e5840f80dd7c16b8dc7a996defbaf334fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968521, "uuid": "476e9bb9-a70a-44e3-a00c-64d32c17d6b8", "comment": "Malware payload (Loki)", "value": "7e8f9c0dce33ac90ab106439399a9f9a737f09e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968521, "uuid": "77ee5204-0199-4516-814d-bc74d92dcf34", "comment": "Malware payload (Loki)", "value": "cf7cb1b924730c41776d90273215d4e44bd9b02db51273c7ad9b5f924486f35dafc25a801b748958d1b2e07132cacea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968521, "uuid": "d11dff94-a065-4d69-8754-56971ad564da", "value": "46F3015222E2DCE7D5C71B7529FB579EF2FBE2100665D28B07602F3A28701CBDE51542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968521, "uuid": "b344efc7-6af8-4a0f-9d20-31eb34d38c5e", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968521, "uuid": "6255bef3-e183-469e-ae8b-afe4123dcd93", "value": "3072:ZPA6jXFN2McHkkb7eW7OIOF95VtTuBqy7De1p2lHdRLH9NJbfWjAcx0cCPyuoda+:ZhjmPBqJ95W7De1pCRLvdfWjAabdaV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968521, "uuid": "1764cabb-c607-4f3c-8f9c-0e414b25210e", "value": 158363, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968521, "uuid": "3430813d-7431-48e7-9ac1-1cc5bc856da6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968521, "uuid": "4f8e24ee-15fb-4ab0-bf13-20a6dff3ab4f", "value": "e3b58a4667e60e096b55117de7a0d777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e362e144-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004557, "uuid": "4303b1ea-7890-4b1e-95a4-3e2ed3078ef0", "comment": "Malware payload (Dridex)", "value": "bd7069de5d1bde40341f59b991d39ca3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004557, "uuid": "85f24e8d-cce8-47c7-984a-752668992618", "comment": "Malware payload (Dridex)", "value": "0f07bea623c1bbb5d406cd8689993038a99c44e0541d9ddd75fe38a0cd6c1fa7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004557, "uuid": "2623aa13-07e6-48da-a1bc-61ea264758af", "comment": "Malware payload (Dridex)", "value": "9c6d4d595f67fa1eda2bd03aafaebb79ab610d7d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004557, "uuid": "db40eed0-ba69-484c-8a1a-3af1a2cb9255", "comment": "Malware payload (Dridex)", "value": "54593bfdd7a20bf68edabaf3b057d57a905d3893930971f75fbcf866f9d89962ff84689671186c7f49cc624027cd3c42", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004557, "uuid": "492f717e-13d0-451a-b0fe-8fd3172264be", "value": "ED24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004557, "uuid": "262047fd-3739-4e90-b6c7-d0756b388ea6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004557, "uuid": "4b2f2922-b40a-40b5-bc2b-9e8eedadfd84", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004557, "uuid": "8704c09b-7fb7-429f-aca9-fd0cc388612f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004557, "uuid": "04f5c59d-6df6-4aad-9e9e-35ad77dc5932", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004557, "uuid": "44e287b6-7d2c-4d6e-af22-20f56ddd0688", "value": "0f07bea623c1bbb5d406cd8689993038a99c44e0541d9ddd75fe38a0cd6c1fa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c865b9-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004218, "uuid": "71199484-0ac7-4685-9d21-11e9cb4f2e33", "comment": "Malware payload (Dridex)", "value": "0830a22b22ed284ed7a32ec022c774b9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004218, "uuid": "2d41e6e9-cdfc-44c9-98bb-eae78effdf06", "comment": "Malware payload (Dridex)", "value": "0f0c0533714e19dd0b6a56e623e25dd3ad69b03d3c85800fc1f2443811f17214", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004218, "uuid": "9536571a-1034-4612-ab82-196913403dee", "comment": "Malware payload (Dridex)", "value": "a1688c5808754b0b8d905cc7b91ce4b647395613", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004218, "uuid": "d5a35329-2e9b-4fee-845e-61b9f21a4be4", "comment": "Malware payload (Dridex)", "value": "0c3727681e0dd1a8f5deb390c33f364de902aa99d762c6f9e739eda94bfc68f1ffc4cc739308d9e575498266671c8d90", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004218, "uuid": "09fe4812-cf42-42da-8718-395a66790786", "value": "CF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004218, "uuid": "f8354a9e-07b3-4158-8673-6d8625612fdf", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004218, "uuid": "ceb152d9-7e8e-46fd-b347-67561baaee30", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004218, "uuid": "ddb7b603-c9dd-424e-9771-e76fac9a9cff", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004218, "uuid": "2cf5bfd3-9202-4c31-8df9-fe17477c60d4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004218, "uuid": "d57d2de7-1a4c-4b1e-ad20-2f11b44f1f8c", "value": "0f0c0533714e19dd0b6a56e623e25dd3ad69b03d3c85800fc1f2443811f17214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d7bba2-8724-11eb-abe1-42010a9c0039", "comment": "Malware payload (CobaltStrike)", "timestamp": 1615987534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615987534, "uuid": "4a0b47b8-e175-4b8e-b076-532743a5d173", "comment": "Malware payload (CobaltStrike)", "value": "a1e3e6b9e3d3bf7f66af8e9b650b2f88", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615987534, "uuid": "01f7d86c-f7b9-421f-b638-fccdd8f566b6", "comment": "Malware payload (CobaltStrike)", "value": "0f1fb6ff690d1b40e8aa3302cb638b73b65920616ccb9ec2c32069d41875ab77", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615987534, "uuid": "66b20e9c-c15e-4eb7-8a5a-1da690610b8c", "comment": "Malware payload (CobaltStrike)", "value": "fae65a929b80e5c089f392918b631b382ec6e45b", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615987534, "uuid": "05a3920c-24ce-4417-ae12-3993a698d68f", "comment": "Malware payload (CobaltStrike)", "value": "3cfee3269c2a41cae35b9117b51be8bbc6c0ca7e8b9c8d214c6d510f23a71b64346ab27cd623c75c64a912707ba14fdc", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615987534, "uuid": "a4c0a168-3704-4141-8de8-9e46ea5be6aa", "value": "5C42FA3DCD68423FC2B7C23DC9DB8A03F591991B270DEE4A60D773A65923183B99216D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615987534, "uuid": "d22d11b7-10de-48c1-9da9-e939d9505b9b", "value": "192:riv0hxq63spYjkH4VYH9gZv2EzNQ5uM22zzELXNXY71CHEsS15Zoc1Pru3:ris7q59H4ydKv2ERQ5AwwjKJCkl1TPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615987534, "uuid": "b50ccad1-3387-4ecb-994f-4db9f364cad6", "value": 12288, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615987534, "uuid": "dc0b1777-8779-4e87-bd66-ecd54758de52", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615987534, "uuid": "faa6d53d-a9a3-4551-849f-56fdc719929b", "value": "0f1fb6ff690d1b40e8aa3302cb638b73b65920616ccb9ec2c32069d41875ab77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3098f81e-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003827, "uuid": "e01c1f2a-dc3a-46e1-8de8-b1237fea7fb8", "comment": "Malware payload (Dridex)", "value": "cc162c71e87c1553e14dbc44064b5f0e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003827, "uuid": "77686876-950f-4d6b-9474-f4f6fe320e3b", "comment": "Malware payload (Dridex)", "value": "0f3c4cce7051ff124ae61a69243efc5709ef2e6b523620b1fd0ae43c82fa0fcb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003827, "uuid": "680963b4-c4c2-44ab-a1d9-039c917b2147", "comment": "Malware payload (Dridex)", "value": "89510ac185cd1a6173cb933adbbd04b46a163256", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003827, "uuid": "22355ea2-2df3-4551-945d-d4ef4a9ca7d0", "comment": "Malware payload (Dridex)", "value": "f7a5824cd2c4631f88103bc81e65e3e0ff1d8f0ce8508735fe82fe0a451a001884016fb0d833902e5693261ab8ba5b93", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003827, "uuid": "253f631a-ca09-443c-8ba3-94b369f4bdb4", "value": "1B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003827, "uuid": "71b0f9ec-23a5-40a6-80d6-6c387cea8d7f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003827, "uuid": "c03e4c9f-ec98-44f7-898b-0c2bff006466", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003827, "uuid": "e3565b1f-f2b9-4d51-9538-74ff756c5462", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003827, "uuid": "a04db787-f64b-4a8b-8d4e-ce733e90df86", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003827, "uuid": "35fc75b7-a9ab-42d0-b229-81eabe673b1e", "value": "0f3c4cce7051ff124ae61a69243efc5709ef2e6b523620b1fd0ae43c82fa0fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0d9ee4-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004219, "uuid": "35601039-5d20-4a14-80d3-b7b12b2c9dda", "comment": "Malware payload (Dridex)", "value": "aea82882e2181a650fec59db313b42f8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004219, "uuid": "2a237fc7-f4e3-4b26-b4e1-c8d1c8726c95", "comment": "Malware payload (Dridex)", "value": "0f47aa319223e2953afa8713dab989a3c2a546195a56eb7bdbf872a2017b791e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004219, "uuid": "d4b91d1e-1ba2-4ae0-ba1b-8eb1cae50606", "comment": "Malware payload (Dridex)", "value": "f90093d1811cd2a6b428d1c0fad09088edcefb5e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004219, "uuid": "6ebd7069-f272-4f36-a307-67e7ce345796", "comment": "Malware payload (Dridex)", "value": "b526e4f80e07c70f6a63720700bba8038bd492cbaa8d05bc87ccc7397411418f1afbe45db8e688459922d8756ba062a0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004219, "uuid": "eaab1f5d-932d-4b0c-91f1-300e3977a37e", "value": "6924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004219, "uuid": "0608566f-9351-4ade-9058-f5e6868cc834", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004219, "uuid": "f142d00e-5fe5-48b3-ad1f-6c9e7e08feef", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004219, "uuid": "63f98577-6370-4784-ae0c-cd2c09eaa413", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004219, "uuid": "564f0a58-b67e-43a9-83a2-b29738460a64", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004219, "uuid": "66f0b598-0ec0-4c1c-9b4d-a9cc217b909a", "value": "0f47aa319223e2953afa8713dab989a3c2a546195a56eb7bdbf872a2017b791e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de803e09-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004549, "uuid": "03aa478c-587c-4f72-b64f-c8f6a341761c", "comment": "Malware payload (Dridex)", "value": "9880a023d94bc0651457098710c9f6fa", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004549, "uuid": "a1efa59f-a3f4-4724-bbe0-1ada499acec1", "comment": "Malware payload (Dridex)", "value": "0f7c6c0409323e9e1cd728321f9ac91d2c29513b8ef5d665b2f2b8ccdc250ffb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004549, "uuid": "f1020fad-131a-41a4-8b34-6099463ab9e4", "comment": "Malware payload (Dridex)", "value": "285dac04f2fddd5df75e1502885dba2907cf6c2b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004549, "uuid": "d76792ff-2f6d-4605-819f-8c4ae2a5c59b", "comment": "Malware payload (Dridex)", "value": "c466cb3435ab9a33d99fad814f826da59028de614739c23633de40d158f88d749ce649854ab5969fe4cc2715b2630497", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004549, "uuid": "a0a568ab-df13-4f44-a981-114c24d22759", "value": "3124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004549, "uuid": "6313b0fc-388b-41e8-a60c-d8e33a7b19c6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004549, "uuid": "c2dd2021-ae1b-4666-bb4f-517258a22068", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004549, "uuid": "ea0ce1ac-3ce0-41ca-b57b-cbbb82ac2633", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004549, "uuid": "9b597c44-f2a9-4c4d-af09-791383e42b04", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004549, "uuid": "2c60666d-bdf6-4e16-9392-7e3eb0c7c9d9", "value": "0f7c6c0409323e9e1cd728321f9ac91d2c29513b8ef5d665b2f2b8ccdc250ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98512cf7-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013021, "uuid": "ff78c060-742f-4134-8567-0efde6165795", "comment": "Malware payload (Dridex)", "value": "8a426ffa4c4410d6271fb3cf80c4b25c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013021, "uuid": "bf27c3d2-4064-447d-b9e7-4d5811f52728", "comment": "Malware payload (Dridex)", "value": "0f8d4fa6487f79e4017e218366c4d42dfd5c59a63a777ee1dcaf00e3d0ed3c43", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013021, "uuid": "d9201954-f8e2-4478-9f7d-17762f4bff28", "comment": "Malware payload (Dridex)", "value": "27e6a3f7ece254addf7f36854484f89b6344bcfc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013021, "uuid": "9cefe89a-c5ca-42a6-b90f-9f99313aa4b0", "comment": "Malware payload (Dridex)", "value": "a74966abf5c9688f292dd4222f87d971b0e4e287291f870e1a928e4ce36a9031ab596cffd08f13a5c3356d97f81a5096", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013021, "uuid": "b329bde2-c530-494a-8168-0bfa09b97037", "value": "EB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013021, "uuid": "f3c5b057-1298-4df1-8392-41e4b76795d9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013021, "uuid": "8877db2c-b059-41e8-a381-a3df61804c37", "value": "3072:59Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:59Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013021, "uuid": "634db9b8-4134-48a7-8b1f-f70223721d30", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013021, "uuid": "7e04f9f5-0cbc-411b-95b4-57c924e44d7d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013021, "uuid": "46819897-4f1c-4e9a-85a7-e686c371d466", "value": "0f8d4fa6487f79e4017e218366c4d42dfd5c59a63a777ee1dcaf00e3d0ed3c43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49deb839-875a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010742, "uuid": "f63f0684-51b5-4d86-be00-491d8e395fde", "comment": "Malware payload (Dridex)", "value": "4a75f9555bc9e09b223196a25d9c0ee6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010742, "uuid": "d93ad738-77b2-4c80-b3f3-562553c696ae", "comment": "Malware payload (Dridex)", "value": "0f93083052e2a896d74f9b7530349a7925d94a94fe8ba3de2f36629fed0bfbbb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010742, "uuid": "b98f3679-963a-4c47-9bcd-88f1fc1e67cd", "comment": "Malware payload (Dridex)", "value": "1be56b9e4ffc8cfc85be5025a8ece291893b42be", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010742, "uuid": "d8c7fc6d-ccd5-41c0-9781-4fae8e101016", "comment": "Malware payload (Dridex)", "value": "c9a0a3b7ca77cf1f48cea4fc6a72babdf4c167cf003d4f0215afd0820aef521c32b4cb6a93092b20ae8f4fbc7915dd99", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010742, "uuid": "d2a108fc-221b-4eb5-b434-fd9bb22ac524", "value": "C324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010742, "uuid": "d416a71d-a3d2-4d6b-8976-e66153645624", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010742, "uuid": "5d7bfadf-49f6-4636-83fa-c0ce865b6913", "value": "3072:b9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:b9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010742, "uuid": "65b17e37-8224-4334-a144-3626585833cf", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010742, "uuid": "81b7d8c3-9e5c-4a4d-a352-a36e046eedba", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010742, "uuid": "af365b40-fa6a-49b3-8efb-221f2675383f", "value": "0f93083052e2a896d74f9b7530349a7925d94a94fe8ba3de2f36629fed0bfbbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6a6672-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004335, "uuid": "6e42e2aa-b05d-4fd8-a5ff-49768f2175da", "comment": "Malware payload (Dridex)", "value": "14bfb310e5ea03dbaa5e93e22df4b575", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004335, "uuid": "c3309fbc-e723-4b23-b50a-b25035fd51a1", "comment": "Malware payload (Dridex)", "value": "0f94d93fb03f87df53041d6396e8df2621016883d2c9761a028ce53ae79d2b01", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004335, "uuid": "b44563e1-0a33-4dc3-992e-c0368ff25467", "comment": "Malware payload (Dridex)", "value": "c5e00b772c8782db313d7bde34b3fd09ba9fcd21", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004335, "uuid": "f5c17077-a55b-45bb-801c-2a28aff5e514", "comment": "Malware payload (Dridex)", "value": "a9baa5f0dbc632b534a27581301aaf5f17542d1e29ceac668849e769437562843d88834b68a590bedba1fe9809fff736", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004335, "uuid": "b42eac41-19f7-4d8b-bf85-68d37db7dd5a", "value": "7F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004335, "uuid": "f4234e46-00f3-4f26-bc41-2cb79961811b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004335, "uuid": "c8c732f3-ca97-4549-97de-22e8a69f30be", "value": "3072:o9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:o9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004335, "uuid": "6a082f6f-3e23-45cf-b088-495ec9be0d88", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004335, "uuid": "9527bf25-cdac-4ed0-9eaf-61638e268e93", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004335, "uuid": "daa42fec-a24b-48d1-843f-ad7bb9c18a77", "value": "0f94d93fb03f87df53041d6396e8df2621016883d2c9761a028ce53ae79d2b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99516b9-86c4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615946612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615946612, "uuid": "dfa40f13-9117-42a4-8c59-0ec66e70823b", "comment": "Malware payload (Dridex)", "value": "67f3afe932227bf28163f183a21b48b2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615946612, "uuid": "c8a7a2ac-f98d-41de-8634-0ab580071a7b", "comment": "Malware payload (Dridex)", "value": "0fb7b2d36a1cbff7acca81a56aa4543a0e3bb0e3471215bf5a251ceee3b7541b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615946612, "uuid": "9be5f836-a849-4fc2-aaa8-0d733680d8f2", "comment": "Malware payload (Dridex)", "value": "58c5d13c8402ab110be1523ad97906b583cd2ac4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615946612, "uuid": "9191cb8b-5458-415c-81d8-10eeeab3f2fd", "comment": "Malware payload (Dridex)", "value": "0d70e7915a918824c59d96f945130cef8b36649a309a16b132f9105f2a3806f57d8869afb5877cc56161623206812600", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615946612, "uuid": "ff581f37-236c-422c-9cb7-89476aebf382", "value": "D914AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615946612, "uuid": "6c4babfa-cb0e-4b20-a5c6-d5242aecd504", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615946612, "uuid": "aa652beb-bba0-44a6-a301-364c21b17267", "value": "3072:c1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Yi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615946612, "uuid": "4abe0990-c433-49ea-933e-bcefd4811bd6", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615946612, "uuid": "79a1831a-3106-40ae-81d9-51f3d58923bf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615946612, "uuid": "e4cb5845-0df6-4958-a9a6-95768862deb6", "value": "0fb7b2d36a1cbff7acca81a56aa4543a0e3bb0e3471215bf5a251ceee3b7541b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16654055-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004213, "uuid": "23a9a279-c54f-43c0-86c1-2c0d4da5efa2", "comment": "Malware payload (Dridex)", "value": "b6df2609f3f34cd1a78ca1e48d70d2b8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004213, "uuid": "1b7de4d3-3eec-4f54-9f6f-c494f7c1b677", "comment": "Malware payload (Dridex)", "value": "10ac9fac0b8c966e2dfd9f4de41bff5a6e7777c198cd09aed137452aba0e934b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004213, "uuid": "e8af0c3e-e2e7-4f68-b922-903b722b14d1", "comment": "Malware payload (Dridex)", "value": "ce37cffab8e3e1aad96a82a97611a46120e0e555", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004213, "uuid": "5886546c-2bf1-499f-b24e-c2e4be407b09", "comment": "Malware payload (Dridex)", "value": "d1e9be32bd7af089670ece5d346a5aeef794cba0097f5519d1195015ccb9d0ee9b7d3adbdf192021ab78e6dc27f9f0db", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004213, "uuid": "1606a3f3-22b7-4a9e-8ac7-90c7219a8567", "value": "2D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004213, "uuid": "4a40422c-0502-4ebb-a319-7c6467583628", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004213, "uuid": "672e10f3-260b-49f6-b5fb-4ef0b70789ea", "value": "3072:L9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:L9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004213, "uuid": "f9b44a5f-fe14-486c-9443-d57074735a5f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004213, "uuid": "62d1a299-9813-4d36-93ef-3f2679d5cd5b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004213, "uuid": "71604b81-1570-4197-a52f-9a3ecdc9518b", "value": "10ac9fac0b8c966e2dfd9f4de41bff5a6e7777c198cd09aed137452aba0e934b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2298b6-870b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615976948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976948, "uuid": "8f7d6535-de59-4783-91c3-bab6aa9a2df8", "comment": "Malware payload (Gozi)", "value": "7b1625df389eb989064056ab5207234e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976948, "uuid": "f962e5bf-6cff-4954-9a17-f8fc7faf21b4", "comment": "Malware payload (Gozi)", "value": "10d0cd214468977ca01267d4e74b2ad431595bd12dbc6b04e04a6e50081e6514", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976948, "uuid": "ffd4f7f0-6a5b-4396-8afc-72e462538a55", "comment": "Malware payload (Gozi)", "value": "7879c4e3b8dc98bb06550bfca66046f819d63795", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976948, "uuid": "5257f381-bab1-4067-9990-b22677915781", "comment": "Malware payload (Gozi)", "value": "5e935733b4fc9ac3ee2f91b3c742b23eb8f1c6e48083f91aaf50dc8f7cbd6687214e43e73832da61e70515178922a686", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976948, "uuid": "0925a428-45f7-45c3-b793-ac9fe8dae3d7", "value": "EBA4D021B5C282B2C133823A4878EA65DF78BC710B3858CB379D12774F796D1563BE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976948, "uuid": "92ce5268-1b28-4497-a360-ae71237aa048", "value": "25f2108c27a9983e93c5c39e2411e7ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976948, "uuid": "d995932b-37eb-4e02-be7e-b16743c615fb", "value": "6144:qvBZP3Kj73uoS2azm/TE35zCOcNKnu6Caa9aZ/0Ndasyv4KgvRw/vP983wiYA:qD3ArBKuM1CRuEvbNdbyv4u/X9awih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976948, "uuid": "8c717969-42a6-420d-a902-5e88d0a05175", "value": 466432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976948, "uuid": "032aca0e-1335-4ed6-8d4c-489264b63c4b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976948, "uuid": "91ff9a54-adf8-4183-8174-b8047e8aecdb", "value": "7b1625df389eb989064056ab5207234e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35694da7-86ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615964322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964322, "uuid": "c7021841-f2dc-4232-a8b5-00f695cc907d", "comment": "Malware payload (AgentTesla)", "value": "f48cdd2346c138514121885b90c69c50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964322, "uuid": "f3ad824f-b29f-44ab-9f64-a813fc319e73", "comment": "Malware payload (AgentTesla)", "value": "112f248bd983696a69465381b2ddadd26bb41419c649b54afd83db67bef21e37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964322, "uuid": "7299f638-0b4a-46c2-8e73-fd302216f275", "comment": "Malware payload (AgentTesla)", "value": "7f456c8620faa998679bf9c286d2dff4bb32355c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964322, "uuid": "de910060-bc75-4549-848b-d11274543e07", "comment": "Malware payload (AgentTesla)", "value": "55bebf0db3a442a6e771daefd2b6f5cf5a217075590717941cdcb319f3c8667130e62f5db486d88e1195df0a320c0814", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964322, "uuid": "739eabcd-d78a-4fce-b33d-d9fec8f76430", "value": "9AD4E06DB7980363C55203BD24DA75C0EB36647A1E11FBF8289840991663B70C6A7BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964322, "uuid": "b48032cf-4b2c-44bf-b224-e4de0e361ce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964322, "uuid": "601907e0-756e-4579-a4c0-356fed14f0e5", "value": "12288:KZP1qe+TW+/dgZ8ngYlJRYRpyUJuUZvJZ0ByLWk+ys3uY:i16ewZ4phPZRLyp3uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615964322, "uuid": "0d776289-5946-4b53-a6e7-095edac776f2", "value": 604160, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615964322, "uuid": "b655689b-06df-450d-8670-95ffa190ea2f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964322, "uuid": "13367afd-1786-42ac-b7ff-c13be091a20c", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c110fa-86fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615970141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970141, "uuid": "8c6f7375-6035-4da7-975b-9279780d0d73", "comment": "Malware payload (AgentTesla)", "value": "7f1ee673e5ed3726372e1e1bcd4b3a5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970141, "uuid": "4008a5ea-720f-4d88-873c-1a165cc53101", "comment": "Malware payload (AgentTesla)", "value": "1135dd1add5582b252fe397ecf075bf400d0f63c085daacaffd20f753700b00a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970141, "uuid": "1ddf88fa-8167-492d-8935-8185d8cde5a8", "comment": "Malware payload (AgentTesla)", "value": "5bebfc4c34a6a207a6f7807e2971bbfcbec6a805", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970141, "uuid": "26dac5c3-a891-4da2-84f9-c63c6a44d3bd", "comment": "Malware payload (AgentTesla)", "value": "daa1e11a160fda48e320fdefad27220041a3fffb9eb775e62decd7b0545e5ba9afd032d5a895298ad55df90005db1395", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970141, "uuid": "bc017098-7935-483f-b5d3-0c504a6e6a24", "value": "6035DFAC3320769FC41BD932CD942C24EA60A466235BD3B3A4536DDCB94D69ADF700F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970141, "uuid": "5b16f64a-5650-4802-994b-d78cdcbf0f94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970141, "uuid": "dc3f8643-7252-4e3b-bfa1-17c72f905c3c", "value": "24576:eJ2P38lOLlZ4hUOO+mlrj/zgSUeuxp3sjaKgv04U2Vo:e4oeOdmlrjJUeub8vmU2Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615970141, "uuid": "5c2f521c-d151-4381-a1d5-0f4b97f35bd8", "value": 1127424, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615970141, "uuid": "f069a4ce-9320-4e36-b2b1-5233dc2a2a32", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970141, "uuid": "8d15945a-95cc-48c2-88d2-3c2ebef3976d", "value": "7f1ee673e5ed3726372e1e1bcd4b3a5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8da4ae0-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003224, "uuid": "ac4bb5be-087f-47ff-be22-da82e2b2e41a", "comment": "Malware payload (Dridex)", "value": "72760009f8b9c8c50470d71d7c721164", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003224, "uuid": "d6774e72-d1f1-44dd-a611-98d5945a3b24", "comment": "Malware payload (Dridex)", "value": "11498de2435de66908a94e2cf3629b6d2ddae8ce080cd2e42a492dab14c2ec98", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003224, "uuid": "8ca23d8f-094c-4c96-8362-8fde2b184afe", "comment": "Malware payload (Dridex)", "value": "cd986bbafe354e64f33a98ad4ba2ebeb7c3bb591", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003224, "uuid": "4c0ff6c7-c8e5-4f14-a32a-6e560c48998f", "comment": "Malware payload (Dridex)", "value": "8cf9c13e8a59c9dc9757351bbfa838abaa8886f10eb26b54c2c7b6762b0e5f4a9c9551d9ced96778ef6391de74b4b1f2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003224, "uuid": "a69d22ce-94fa-4215-9e48-2fed119a201b", "value": "1924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003224, "uuid": "6fa3d92f-f595-4fab-a36f-2af34022323c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003224, "uuid": "91e96693-caec-4a25-8e34-a251b636b402", "value": "3072:49Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:49Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003224, "uuid": "77a4f196-7b46-4b36-a8c6-a55133eb4c0d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003224, "uuid": "ad4ded25-78b6-4768-9412-1857d684d829", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003224, "uuid": "b7cf2f96-87ef-48c3-8d26-b293bccdf27a", "value": "11498de2435de66908a94e2cf3629b6d2ddae8ce080cd2e42a492dab14c2ec98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29043f5f-8763-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014552, "uuid": "70b129ca-d60a-426e-b473-812dd540a86c", "comment": "Malware payload (Dridex)", "value": "80578417cf775a9b04cdd42ef3599746", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014552, "uuid": "7c39b28f-2ae9-4ff1-a8ed-863598c33c3b", "comment": "Malware payload (Dridex)", "value": "119d1d4e41d6d172c562107de90be70af927248d5af3c73d906961ae352ab37c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014552, "uuid": "ade2a318-eaf4-4fc7-8405-6e3758105cbc", "comment": "Malware payload (Dridex)", "value": "c62f6c5e37af0ee1d48839d27dd4dbc1e902bf35", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014552, "uuid": "dd7f332c-7fcc-44de-8a68-071519dd4d6c", "comment": "Malware payload (Dridex)", "value": "64e9378092733136da6e2af0d4b70c92a0c92a0c7ce01c7e84982bb1fc6367682d9117fd52abc8f428f1747c2ee57a28", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014552, "uuid": "e14a2c12-d855-4c1d-9403-f43a5db76c22", "value": "D524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014552, "uuid": "ee582db8-c55f-4a19-9f5d-e31593512cff", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014552, "uuid": "60f01172-f65d-4bc6-8544-8b51413efe74", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014552, "uuid": "165db742-fb8b-4fe0-aace-1954308a944a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014552, "uuid": "364a4e2d-6c06-404a-8c80-3e9fa83f54de", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014552, "uuid": "173fa970-340b-44a4-97c3-bddccd90941c", "value": "119d1d4e41d6d172c562107de90be70af927248d5af3c73d906961ae352ab37c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc733f-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003957, "uuid": "c73f8237-50f8-44d3-be81-e869fcf86690", "comment": "Malware payload (Dridex)", "value": "eb5012e87f637f1ee0487e8c1cf189da", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003957, "uuid": "773daeb6-f1f7-4705-8f9f-916885624731", "comment": "Malware payload (Dridex)", "value": "11c48b2ca994d71c56fc06e5fdf3db7c08d39c4429b8d6b031c9ebd28e10431c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003957, "uuid": "9adf7ea3-bd8a-4676-b872-995a55ba59ba", "comment": "Malware payload (Dridex)", "value": "8fc9fc6484d605f8c0cd46c0c82e915d3d977f37", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003957, "uuid": "43332ef1-b856-4f57-ae9d-8c5841527def", "comment": "Malware payload (Dridex)", "value": "edc95edeeafc72e6ca5c8c4506b1be4c759ed82972e30389d88f744cc40b03af0f46282bc7d66c60800fdd10f2056fdb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003957, "uuid": "437b4b9a-2177-442e-bbaa-e6840a8ee251", "value": "B524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003957, "uuid": "a0a09422-ca4f-46e1-94aa-18bcbd38b6f2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003957, "uuid": "be3ede88-af9e-4182-82ef-54076d009438", "value": "3072:G9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:G9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003957, "uuid": "e9a31283-ced3-436d-812f-e8944e8e0214", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003957, "uuid": "50031b67-7b13-4979-9299-6d1e65b2b007", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003957, "uuid": "6fd2fe37-cdb7-44d4-a94a-c130b2548772", "value": "11c48b2ca994d71c56fc06e5fdf3db7c08d39c4429b8d6b031c9ebd28e10431c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009be39b-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1615968528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968528, "uuid": "90352d61-1d6d-4164-b62d-7df7e3548193", "comment": "Malware payload (AsyncRAT)", "value": "286206b316bafdf5df5942fc5879a222", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968528, "uuid": "5c219d30-329a-4aca-a75b-d84defb77790", "comment": "Malware payload (AsyncRAT)", "value": "126e59a870aa1720a4fb37e975e4fcd163dea2b503503afc49c6225ad60cb33f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968528, "uuid": "e8f97603-ca82-4e41-a4c6-605420c0a22b", "comment": "Malware payload (AsyncRAT)", "value": "4d8825270dbbde0f55cdd7b4c7dca23918cf04dc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968528, "uuid": "29631d93-288a-413d-bef4-1b37d2dfccc1", "comment": "Malware payload (AsyncRAT)", "value": "95db5f282157edcfeabaeee43c29e9e58cdc024aabbd2a727dd3c9c9f6b243e540431df95116967597900144804bef22", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968528, "uuid": "de1c50b2-958b-4ef8-9f7d-82e6ded9be04", "value": "B1E0EBBA5228CF83309F0BCCA90054F84C22A02F8BB4F1F10070C962140BC292E5EFC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968528, "uuid": "0cf862b8-47ab-4a47-9a07-1f74af15a8cf", "value": "6:YuAuPRizzNkRkibEry6XSRQSfITcSdJeAXpcHxNKFYvAbxrUU4oKkfXDLyM:YuvR86bEWRQIUcm+yYvANruoKk7Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968528, "uuid": "7d036d81-24fe-4141-9e7d-66c3413ae473", "value": 308, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968528, "uuid": "1271b5b4-0484-4a45-a9ef-74a4974de696", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968528, "uuid": "0b8b8482-f683-490e-a9e1-91d00e5cc0c8", "value": "Invoice-ID-(5519012341210).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cf3aa5-8750-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006384, "uuid": "92095b6e-1710-4675-9c56-c7aa9d111ebc", "comment": "Malware payload (Dridex)", "value": "8da7d039b06e214c6d389cf1a7991cb4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006384, "uuid": "d8a30a97-bd62-4a37-bb82-9cd3214db1cc", "comment": "Malware payload (Dridex)", "value": "12f23166406b8c55381d8ecb6b3e4f5e1c6e3c9b008334208e5ce495db4f1b7b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006384, "uuid": "4650d02c-1291-4ae1-9909-c972ac4a43c3", "comment": "Malware payload (Dridex)", "value": "3732eb9782c47e7016a768e1b4a8a73d31af30ac", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006384, "uuid": "f5f245a3-233f-4a19-80ad-d0dda239ab81", "comment": "Malware payload (Dridex)", "value": "6ca02053a7c8b7dd733572b6b42c057aa2554060b80dde07af6b37afa43aa68f16648a48b8ff55fdc69c46e400b9079a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006384, "uuid": "9c3c8701-e5ba-4c41-a958-4d9ed690ff71", "value": "4124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006384, "uuid": "69190254-48cb-44ca-afc3-3d4cca1514eb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006384, "uuid": "95be0c73-45c5-4b66-b7ec-c28dcd6aa86c", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006384, "uuid": "036f82a5-0a23-48c2-87c0-5b6e69d928b0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006384, "uuid": "cd2e1f25-ffe4-4ebc-b0a5-cb1567a197c1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006384, "uuid": "5506b341-1b3c-4bf9-9062-8d9f09500b11", "value": "12f23166406b8c55381d8ecb6b3e4f5e1c6e3c9b008334208e5ce495db4f1b7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471ac881-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001718, "uuid": "bdf2744f-d01e-48c5-8e81-52a4592afd27", "comment": "Malware payload (Dridex)", "value": "8935a17f732c785b6906435bdf09b85f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001718, "uuid": "964419eb-774a-44cb-a39a-938f5ac1286e", "comment": "Malware payload (Dridex)", "value": "1300e3d9ddb8c57b8f62d5e6e18d454e8cf75d5c90d7c6cc751d140e9eed436b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001718, "uuid": "6eddb295-ae70-46d2-99bb-fd9d6353fa7a", "comment": "Malware payload (Dridex)", "value": "7b6d4dc535df8275b85bb19697369dd8498894a3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001718, "uuid": "3152e6ba-06cb-4f3a-abf1-2dc02ca1c8d5", "comment": "Malware payload (Dridex)", "value": "4b8e3125edfcc674bef08011a8f4724eb624c5ca03da68ad61aa499cdf16757978576e213c5ec729e9f5c6afb8382460", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001718, "uuid": "b1016607-475c-4899-9d5f-74d2d007e262", "value": "F024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001718, "uuid": "85c2167c-5e7e-49c3-b5a3-b9ca2151b62b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001718, "uuid": "828672e0-5304-47a2-8a20-3d37e5215c30", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001718, "uuid": "f46b91dd-df67-4ef0-b9d0-5749137b4959", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001718, "uuid": "b1c0eb91-c585-4659-884b-deb7b6782660", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001718, "uuid": "ce75a6f2-d415-4210-969c-2e214dc6d28e", "value": "1300e3d9ddb8c57b8f62d5e6e18d454e8cf75d5c90d7c6cc751d140e9eed436b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a772fd8-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005213, "uuid": "afb13f20-ba88-495b-b5f5-e48070de039d", "comment": "Malware payload (Dridex)", "value": "ebe599b640a27d9a72750fca968be5ed", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005213, "uuid": "5870061f-5fbb-4f92-8934-a5e0d2de305f", "comment": "Malware payload (Dridex)", "value": "13a815a7d695ca9c63a5f471a16f0723e3923d6a9d3b4d71f54f7446fbce176b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005213, "uuid": "b0fff7e9-3db1-4935-9411-6581da428cc4", "comment": "Malware payload (Dridex)", "value": "cbca51fe93f8277b0b8a6bf4e068529f79403c84", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005213, "uuid": "f56ef263-51f6-4351-bfc5-a450142b0d19", "comment": "Malware payload (Dridex)", "value": "2fa7a8786394ea8f9148b4116c4377887d8b01e07059f0cdf37971cb45e256b340719d9bd9c40bd39c7187a48afefd5c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005213, "uuid": "7dbeca7a-e010-4ea7-84d2-5c8abcf36628", "value": "0224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005213, "uuid": "46a40f38-eda8-41cd-a217-292d030c812c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005213, "uuid": "e1529afb-0ebd-4669-b1dd-a729fee74eb2", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005213, "uuid": "6b51f372-9d46-4cbf-96a3-1e293b75bb15", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005213, "uuid": "13570215-540e-4e97-b08d-c8dca5c1d4b4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005213, "uuid": "f25d000a-1016-4d7b-9b4b-e0343462dddb", "value": "13a815a7d695ca9c63a5f471a16f0723e3923d6a9d3b4d71f54f7446fbce176b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af022993-875d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616012200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012200, "uuid": "2822ae37-40ae-4c98-a37c-0ab6bad35aa2", "comment": "Malware payload", "value": "0fe7399231a23b630b764c5cd5f0e676", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012200, "uuid": "39d28cf8-074b-4374-bb68-338ce7f49c28", "comment": "Malware payload", "value": "13d51e5dec218431ea9e85ded0a80f272f2b07f8c5b24f52a38630b919706879", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012200, "uuid": "77d7b763-cc28-4217-9466-fb653360e55f", "comment": "Malware payload", "value": "bb46e671781ca93a048762a676fdb7f635426059", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012200, "uuid": "86d33eb1-c2d9-41c4-a44a-c459022a7bb7", "comment": "Malware payload", "value": "0771fbdbd71f0772d46ac06818316b3d74bc9bfd667836a21733d6391644ff2b95f39e33d8c70d78164fcb8b9cdcc254", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012200, "uuid": "00ef329b-8c2a-455c-898d-f385ec244f2d", "value": "2624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012200, "uuid": "bbb4ca38-d899-4e8b-a2df-e0c196bbc1ef", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012200, "uuid": "c040e76f-9d19-4f3f-92e7-4332ed1e50da", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012200, "uuid": "e2543337-fbe5-422c-9325-3f1cf055be80", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012200, "uuid": "0990d342-1c0c-4c07-9af8-ec119f6d8fe9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012200, "uuid": "36a090c0-912c-49cb-b007-a9090e43f327", "value": "13d51e5dec218431ea9e85ded0a80f272f2b07f8c5b24f52a38630b919706879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f605139-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003154, "uuid": "6e436072-8a85-4ad4-b1ad-7b4bdf83cee4", "comment": "Malware payload (Dridex)", "value": "1603c0f84da4a639f618a086e317b889", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003154, "uuid": "cd053c30-135b-49b1-affa-4ad4a1b17ac3", "comment": "Malware payload (Dridex)", "value": "14e6cac63c4f9b631c79ea47a6696a3981c2dc07d9831497a50e1cb285011956", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003154, "uuid": "3f6f8d2e-1139-4ca3-880d-928647d69fb3", "comment": "Malware payload (Dridex)", "value": "fa43c94f863879601548cd70787fe7ee413bdc79", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003154, "uuid": "928eed1b-1bf5-401f-b00b-badcc9592e6f", "comment": "Malware payload (Dridex)", "value": "3f8c6397e7d31b5d607239ae5004163317e11aa1d55b6aebdb790e09e7c0e4946e247f37081febe0fe8b9bde5b3d56e4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003154, "uuid": "1e553884-b9f1-4fe5-a7c6-c284ef07e0a1", "value": "AF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003154, "uuid": "861ee376-de5c-4630-9537-81541bfb6c2b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003154, "uuid": "215730d7-a3b9-4763-9a10-16b8cdaf207f", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003154, "uuid": "ecac73d5-cefd-4148-a4d4-9c11cf4d6f26", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003154, "uuid": "8348b1b2-7d27-496c-bd76-43e532435a42", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003154, "uuid": "a9dbfc06-acae-40ef-a798-814e3e5d579b", "value": "14e6cac63c4f9b631c79ea47a6696a3981c2dc07d9831497a50e1cb285011956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fb237d-8762-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014148, "uuid": "86314a28-0ee0-4df2-b6db-731280c58e6e", "comment": "Malware payload (Dridex)", "value": "b466b86ece4e0942bc8ccf82da6dad2b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014148, "uuid": "7d87fc25-b41c-4c52-bba7-ef95b896b760", "comment": "Malware payload (Dridex)", "value": "151a3eba7af13a8a7f41e4541af6d009640d9d0740d56b8b9b51fd98182c037d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014148, "uuid": "3f614d9a-13c7-4577-88fa-eac33ec3d1bb", "comment": "Malware payload (Dridex)", "value": "beece42d7d4fb4d26ab4b5a83f9d23444d6fdf12", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014148, "uuid": "0f5e9075-df88-4af2-b0ba-b3d3df7bf17f", "comment": "Malware payload (Dridex)", "value": "afd50fe5464496451eae2f745fbac597cfa6aa8c503f6a9afce9f79f201c860b59efddda5869a8779fe2e6d73108a2e2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014148, "uuid": "9a28f5fa-4afb-42f8-a569-cee6f09a2eeb", "value": "E524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014148, "uuid": "7a97e4dc-0baf-450f-bfdd-699191c11f62", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014148, "uuid": "de2bd0e8-1a0c-4f51-bbfb-1628367b7634", "value": "3072:L9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:L9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014148, "uuid": "00b32472-111b-4c65-ae0f-b920e1a26149", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014148, "uuid": "b269c037-b9e8-4eec-9cea-416341165d4d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014148, "uuid": "d12bd9c8-9254-4b62-bae4-3a9958ee39b3", "value": "151a3eba7af13a8a7f41e4541af6d009640d9d0740d56b8b9b51fd98182c037d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422f87e7-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003857, "uuid": "bf5b2a84-59fc-40e9-95eb-ed920d95a95c", "comment": "Malware payload (Dridex)", "value": "68b3a67e4c76463d1d33f1635e21b571", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003857, "uuid": "b317ec4f-5b9e-47f2-b5d1-792beb60f504", "comment": "Malware payload (Dridex)", "value": "151d72c95477c1adc7a2e6604bb5da8a287c4a7ad68bb678be489534843c927c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003857, "uuid": "5c4dd0cf-ce32-452c-9b23-1e3788fabc8d", "comment": "Malware payload (Dridex)", "value": "1255da0118105413a339a3e21e8ece00ff82f800", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003857, "uuid": "f5b2cd91-c6bf-448f-833e-7cf3056d9b92", "comment": "Malware payload (Dridex)", "value": "e58ee266f1f313cfbb1cc83fe933f1566bb2582dbb233cfe66cc7d7ded86f0b8a3c3ff5f0b12a32423eef29b5feb3c0a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003857, "uuid": "62be18ea-0189-4a1b-9e21-2d1c77f83b45", "value": "BC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003857, "uuid": "6d623460-a8c9-4fe8-b018-21e171637988", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003857, "uuid": "7cdc1e63-938b-43dc-9663-40156945af08", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003857, "uuid": "96dc29a9-d5cb-4cff-9776-98f9ef7de822", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003857, "uuid": "485f1846-c112-4d30-99f0-1fae90a77f70", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003857, "uuid": "0ca2c7e7-e784-49a3-b5a8-dc8173d0c573", "value": "151d72c95477c1adc7a2e6604bb5da8a287c4a7ad68bb678be489534843c927c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ddc14a-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011248, "uuid": "0fa13701-fc26-4e69-b544-61bb34004037", "comment": "Malware payload (Dridex)", "value": "1d5daecabd0c5dc1d0108c7c5fec223e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011248, "uuid": "c25ae747-7344-4d30-b94e-a89a437a8b44", "comment": "Malware payload (Dridex)", "value": "155beeb90bf95735a88c1595b3d5ae85988295eed7a551415c2cca1ab366052f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011248, "uuid": "8b32854f-98c2-48a4-898a-ddc1a50e4dc6", "comment": "Malware payload (Dridex)", "value": "4cc123440188e5428525a988066bdaf86ac3fb08", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011248, "uuid": "c30535ca-223a-4972-a492-5ff99eb8c5a9", "comment": "Malware payload (Dridex)", "value": "9291628ec10e6f06bafaa943b58aa0de1421c563d961794f78f638c72429f9e05f0d790498757a6f2f6e0496d0fbf8e3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011248, "uuid": "d3049044-08d1-4b72-9140-bd46cc0a47b1", "value": "A424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011248, "uuid": "bb1dd283-9b3d-4536-91af-3da0a55b4e52", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011248, "uuid": "8995398e-3e9e-4419-891e-b59af1344ec7", "value": "3072:u9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:u9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011248, "uuid": "1ff5c479-a335-4010-ab0f-d6822708c3de", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011248, "uuid": "493da4b3-34ff-4291-b22a-d2b9eca391d1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011248, "uuid": "873a97b6-3782-4560-bedb-d8d41ec00497", "value": "155beeb90bf95735a88c1595b3d5ae85988295eed7a551415c2cca1ab366052f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb6de42-8765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616015496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015496, "uuid": "24aa19ff-50fe-4b48-8171-3157c2856560", "comment": "Malware payload", "value": "58b4b8af839615fe6d2b6e01b96055b5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015496, "uuid": "af432767-1cb1-4504-8e73-cfae4333453d", "comment": "Malware payload", "value": "15817e942f13a027008af81a646aca60e00b73476ae6cd39e962f6c068718f47", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015496, "uuid": "84b11f5d-10ed-465d-b746-c0e62cc210d7", "comment": "Malware payload", "value": "1b0854ca5dcb281a3f0bc56d29c95f1647e1e9e9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015496, "uuid": "5baab935-bf65-4867-b17a-b59f3d866cf8", "comment": "Malware payload", "value": "b130defeffa30599cb059f6a1279f22336d0a7dc3c7955fa3140eb3f9775e39e0a8f6935bbb9a9e9857c6f579d8158cb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015496, "uuid": "414b36fc-3947-445c-8f5c-df2bf5cffca6", "value": "AB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015496, "uuid": "34671cea-a900-441f-9b9b-c84e1c6460e7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015496, "uuid": "7859b0df-9987-4a9b-9d65-9173da6d3211", "value": "3072:r9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:r9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015496, "uuid": "8f05d4db-65df-4a5f-866f-b5b608a7c1b4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015496, "uuid": "a308da3e-243e-4cce-a2c1-6ac656cc55fc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015496, "uuid": "f9552f80-ba22-4d7d-a734-1ac64a5ebad1", "value": "15817e942f13a027008af81a646aca60e00b73476ae6cd39e962f6c068718f47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe30853-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615968419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968419, "uuid": "6f93de04-c281-497e-bfbf-a73b4ea93d26", "comment": "Malware payload (Formbook)", "value": "cb1e69315573d5d73866784b56b988d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968419, "uuid": "be68ebf4-d11a-4e23-8fbf-2c1636951f89", "comment": "Malware payload (Formbook)", "value": "15820e3fd46bdd63239a9b5cd178176752316de2b2cc7d5e4fce251b0a9afbe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968419, "uuid": "84f54bfb-38ac-4c8c-86fb-6c47ef9458aa", "comment": "Malware payload (Formbook)", "value": "96b4c61156e5d4ce680093d00554356201fb5f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968419, "uuid": "917eeb52-42e3-4f6a-903d-c0a6b5f6c5d0", "comment": "Malware payload (Formbook)", "value": "c1f065ff39a5342dc3089351b899fdd18ffad10170500010d80372985ae5a574ba8d9c56645c3ba40a3345673983f251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968419, "uuid": "3c33099c-39b7-495e-a00b-2fe3b4d0801f", "value": "7EB42440BB7087A98551F37FD6EBA31A13A2F4FB8A20979367491FB1D8D10D2784E5C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968419, "uuid": "5dbe0de4-2598-4e30-b9f6-d7078f06155a", "value": "3072:mi/xxc4ydv+EdjS6fAAkyU2jTB2yjFwr4C4gfTT7Okyp+6Jp6j0kvMPR7LpnVTNR:EpA39gIVabFyX8qoolhGdSZMSVCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968419, "uuid": "3eabad72-1c7b-4bd8-b868-880c239b1dca", "value": 509992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968419, "uuid": "862d5f0e-6767-440f-af5f-8e29ed63f074", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968419, "uuid": "d57c921d-a6cf-4ee7-8512-83a7a1f516c9", "value": "cb1e69315573d5d73866784b56b988d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda2cff8-86e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615962054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962054, "uuid": "2c853963-4512-467c-80a8-9fbdd37fb8f2", "comment": "Malware payload (AgentTesla)", "value": "f583c8b85b8a66f89af5b27024377acc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962054, "uuid": "311693bb-72f3-4d15-8645-82bdaee665ad", "comment": "Malware payload (AgentTesla)", "value": "158491653a0ddaa4369ec680ab2fc40cbf7621d900b980747bd87bdf794d63bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962054, "uuid": "109b4ec8-7886-4d4a-888e-80a38c482a0b", "comment": "Malware payload (AgentTesla)", "value": "53fc98f36a3581a4312a19b2f8084486aab43a4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962054, "uuid": "53ccc444-7cf9-4e12-a28a-bc805b5b5f89", "comment": "Malware payload (AgentTesla)", "value": "8ce30f58af74bd28228de6ba4d96f474880b473cc653b81b2fc9988b60ca0c66f3d68883ee076e217a31b05d995272fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962054, "uuid": "65ab0076-3b25-4b12-8b36-f9161f8fb494", "value": "9444AEBC75047DE62A6F56ABCA96BCDC13A6263299CBA8CD4074B7C30463365FE12C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962054, "uuid": "984260d0-4e7b-432d-906e-b9352ae7f001", "value": "6144:nFvZrWThci76sc0YvO6aaucRCz5GV/GdIbIYQZ+Zry:FvR4E0p4e5IEpZ+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962054, "uuid": "ae5fbc78-7b8f-4cd6-8e14-226e1157946a", "value": 255819, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962054, "uuid": "46bb52d1-be02-4e10-b9d1-d9af376c9773", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962054, "uuid": "126473fc-beb5-4b13-9313-61b1400cf0e2", "value": "Technical Specifications.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3ddc0a-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010400, "uuid": "c9027cd1-c71c-48d9-a275-e007aa978991", "comment": "Malware payload (Dridex)", "value": "40a6aa7bd04d4c98ecd149baa158ba48", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010400, "uuid": "d311aef9-d418-43c4-9e9b-712f30bb36f9", "comment": "Malware payload (Dridex)", "value": "168cd8f97fcd721d007d9445f107d21a5bd822e285bd04e08dbba09e91c2bc9e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010400, "uuid": "11db1253-e3f6-4f6c-8533-21cdf7095c83", "comment": "Malware payload (Dridex)", "value": "80d1c80291db10f6258f80ded92686c37f0ab4f4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010400, "uuid": "1db0ee3a-03e7-41bb-8a4c-af358ce2afc9", "comment": "Malware payload (Dridex)", "value": "a794c8fdd9d9c5d03e008ca257fd9f68c3663c38184ae5fe5f3d800ac3049336b08fce48c0b923eb20067ab98e9094da", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010400, "uuid": "42cd47b9-a418-454b-a07d-4a4bbb6bbbae", "value": "1224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010400, "uuid": "0deba61d-84d4-42a5-a716-fa9130333d47", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010400, "uuid": "fe9afe2b-b7af-4f59-8cc8-87183b0509fe", "value": "3072:m9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:m9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010400, "uuid": "1c995db7-2f0c-484b-919a-d1ef08f6fdbd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010400, "uuid": "5fc3ab32-a0a5-4f4b-9af1-e88af8f3b8f7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010400, "uuid": "8704a54a-b816-4ae8-bc08-b162d2101ab2", "value": "168cd8f97fcd721d007d9445f107d21a5bd822e285bd04e08dbba09e91c2bc9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0e457f-86eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615963207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963207, "uuid": "63d929c4-b2f7-44a7-856d-90bdd0c04ffa", "comment": "Malware payload (SnakeKeylogger)", "value": "fd48bbd5b180b4c8767e03ea9a16ed72", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963207, "uuid": "60b79529-8f4a-4a70-8e6b-e6aa1c0ce4e0", "comment": "Malware payload (SnakeKeylogger)", "value": "16b48feccf564fe560c611fe56aa75bb668c62a71bfb2f8681489c1818b056e9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963207, "uuid": "ae5c0b8c-52dd-4b8b-8bd9-af5a5a170055", "comment": "Malware payload (SnakeKeylogger)", "value": "5ebdbdda738f0dff172eb0f042eaeb60d66d8516", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963207, "uuid": "33e9cd80-77d3-48eb-b7c5-cdbd88b12409", "comment": "Malware payload (SnakeKeylogger)", "value": "328561db02aa11755f09946b183ca56f74c2b55ee096cac20663866b522f497a4b53ef2ea5c1ee91eb00f8fb3e898fc3", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963207, "uuid": "7665a0a6-06e2-4298-b214-909ec1080704", "value": "C20533CE00B53533ECB42B6A55D69FAFB040749A7A0DC82B7871C9E5944112F38BA7F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963207, "uuid": "824c6061-ffab-45a4-aa91-9275a01891fa", "value": "12288:BXtbh3mzYEydXCW4pxiCMIyQ4JCUY3S0B5i5gbRGK0+QdBub/niwrB30acl5Cuk7:B/XBcWt5QlUY3S0B5g7+x3ivGuk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615963207, "uuid": "5af4a7de-23b5-4361-b102-8a30915217ea", "value": 845466, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615963207, "uuid": "836b9186-9aa0-4b49-b286-1824e4d04944", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963207, "uuid": "db7168b7-8959-4ed0-93d7-1cc89b208022", "value": "34007#40FT.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a91abc8-875c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011602, "uuid": "6e16cf5b-c23b-4228-8159-6b9ed070ea1d", "comment": "Malware payload (Dridex)", "value": "0e066de9da998655a0dc523e776213c6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011602, "uuid": "2810b70a-a38e-4aa2-9404-603d7984b73e", "comment": "Malware payload (Dridex)", "value": "16d59ccc9402a0eb67c43e4c0055857074c3cd36ae3381f15f956ce523901eaa", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011602, "uuid": "9e09528f-c19a-4bb4-9ca6-f6c1ca171877", "comment": "Malware payload (Dridex)", "value": "ff9f9406a3ab94af5b4f3d59336d408fff4724ff", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011602, "uuid": "b44db6e1-2c60-4b35-ad50-c97d685a6758", "comment": "Malware payload (Dridex)", "value": "5ba442ff4c9e2ae455dd5aeafdcdd51961a3c4c3ce3fb69c00709fdd55392536afa14d781ebc9f64d4da42a73c3bc8a8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011602, "uuid": "a264ef30-61e8-479f-9f21-847f10da282a", "value": "6224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011602, "uuid": "409df697-01af-4ac0-9198-efd6bcd9d848", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011602, "uuid": "feea59b3-29ce-4545-9638-3c339c155985", "value": "3072:s9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:s9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011602, "uuid": "3d5a4a36-1ffc-4136-b9ea-bc81e8814a09", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011602, "uuid": "08911f95-a92c-4aac-a55e-bd1436abbf00", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011602, "uuid": "aa271e69-942c-44c1-85a1-ee63cb293881", "value": "16d59ccc9402a0eb67c43e4c0055857074c3cd36ae3381f15f956ce523901eaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c21cac-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017061, "uuid": "05572600-72a7-47fd-9150-75507cc3d9dc", "comment": "Malware payload", "value": "aa01f08f8ab53b2d23d0c8ca342cc0c9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017061, "uuid": "f8bcc725-0001-4cb3-a6f2-62083f0aa62b", "comment": "Malware payload", "value": "17546c2abcb8aef062f0e28fb9c455be7c937443fff12b7120c1e7b291451d11", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017061, "uuid": "ac1b03a9-7736-4107-a6f8-cfa9b21eac56", "comment": "Malware payload", "value": "7bc33935127a5a93395c527548fd95f962b179d3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017061, "uuid": "b4c2b336-a419-4b2d-9a02-247147e0d87a", "comment": "Malware payload", "value": "3b502d6f06380384d976550316b2489861b848669cb5bc8950834e3f0abe9a28f9f9e0281fa94b2e730e3196acfffb88", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017061, "uuid": "80c80261-e5c6-4e28-8b4a-f176c1c2693c", "value": "A624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017061, "uuid": "0097ba1e-c81a-4e70-a00f-55c8284b11e0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017061, "uuid": "c283b46e-b46c-4262-a12c-17b2a0e4cc3a", "value": "3072:S9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:S9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017061, "uuid": "3dbbd09c-57c2-4dda-baad-1922275b760c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017061, "uuid": "65c6c0d9-306f-44cb-85ff-79a768fdd81e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017061, "uuid": "1b3f1866-48ad-4ae9-a565-12a993ecccca", "value": "17546c2abcb8aef062f0e28fb9c455be7c937443fff12b7120c1e7b291451d11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e51d1d1-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017299, "uuid": "3a932975-dff2-4b78-9db6-adb9c779612e", "comment": "Malware payload", "value": "a563c50c5fa0fd541248acaf72cc4e7d", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017299, "uuid": "601ce703-050a-4f56-b2d0-45da27e1fdff", "comment": "Malware payload", "value": "180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017299, "uuid": "3021a796-0165-4d07-8104-67d9294e3178", "comment": "Malware payload", "value": "4b8c12b074e20a796071aa50dc82fe2ff755e8f6", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017299, "uuid": "db6426a7-1537-46e4-bdca-4ff65a291ba4", "comment": "Malware payload", "value": "359d0bc15309e0eeb9ee1895275a3183389cd8ee24fe294d375e23e56abd0f2df2ea3d6c2b4b176775124a924ef9aee6", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017299, "uuid": "bb21a8e0-efe2-463e-af8e-6bc707aa4f39", "value": "40D4C510F25186B5CBE2227724CE622DD6DAAC6C1EB745DBDA507E6C1B723D02DF824C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017299, "uuid": "28df7b75-3870-4a02-8c3e-d3b95eaa9f72", "value": "66601be2b1137d46793d7b753c44f961", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017299, "uuid": "0cdc8d1e-b967-497d-9123-69c9dd71bbd6", "value": "6144:LA+0uP79QAbIhsU2Hl7A6P+ZT6EnW5TMGRx4S7SM22C4:LACbIhs5He6PtgvS7SM2T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017299, "uuid": "4f39fb9a-1bb5-47ba-b683-b7b3c45d1b7d", "value": 650752, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017299, "uuid": "5296f8ef-8b7d-4853-bcf4-dae00b9cee65", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017299, "uuid": "7e7af76c-8715-40ce-b40b-68353b3fdec5", "value": "a563c50c5fa0fd541248acaf72cc4e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6398bb18-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (DCRat)", "timestamp": 1615968694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968694, "uuid": "f9fd4f03-b629-4a1e-b63d-63433bdf42fc", "comment": "Malware payload (DCRat)", "value": "5ba86988b432c61b0ce7e8d3bac7dfcf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968694, "uuid": "a6d6eadd-eeaf-4770-a490-82b5e4cce636", "comment": "Malware payload (DCRat)", "value": "181c211f5a2775a8ba6a3d7a28dda6b6a4d8834376a2da11e03c46de66eccb9c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968694, "uuid": "fa8bf04b-1f5f-465a-866d-be918e2f8712", "comment": "Malware payload (DCRat)", "value": "021238040d259d10530bf6c9b39f4aa152f8c6ec", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968694, "uuid": "bed4a924-4685-4cab-9136-5443ba84fad5", "comment": "Malware payload (DCRat)", "value": "fdc33e25207d8241fd7c46258858baa0748738c8b47e56243361829965a13826a4440783c356db4960b799622cf46f02", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968694, "uuid": "2bf1c6e6-8430-428f-853a-c50f261e2260", "value": "690696496F0F65529EB3E1E6D2E3647EEE09FB3D20A629885094E390F7434D58F48E70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968694, "uuid": "d6297832-d4e6-457c-8819-156456120f18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968694, "uuid": "4573621f-9d35-48c0-82f4-dde933c54748", "value": "6144:XvfO7BkMbCgNeQ0+7erZAjtwHMwtvEO7kpxv/Bv7JJur/avLQ/mF0ljzH7NpI+A0:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968694, "uuid": "392a8428-0cae-43d1-900f-844d34a78696", "value": 3956736, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968694, "uuid": "5cc4aea7-a296-431e-9bd2-b3b35e5ba848", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968694, "uuid": "dfd0a908-a17e-4aa8-8c8a-7576c075654f", "value": "5ba86988b432c61b0ce7e8d3bac7dfcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36dd311a-86fb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969908, "uuid": "7e18d452-2b41-451c-971a-e71b8e063ae6", "comment": "Malware payload", "value": "d48cd8cdb53fc3908516117d732563be", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969908, "uuid": "cbcd8ee5-7e72-41cd-8457-0deb672ccec4", "comment": "Malware payload", "value": "1865437561fcab67ee4cb3727b470da3a81abfab2a17d38f70dd491cd01781ef", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969908, "uuid": "a846bffc-44b0-4d97-b705-dfd0411a7909", "comment": "Malware payload", "value": "1f244c356118cbedf8e48a6fecd679ca4641fda0", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969908, "uuid": "d518ba07-ecd9-4661-a7ce-707940e40192", "comment": "Malware payload", "value": "d72e979dfc07a2cbc2f2745ac2c59119cbf28b5a44a8f7b1d583f90529c88bf5d4b501ad1496bc2544cc783029d517a8", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969908, "uuid": "b35efc6f-7578-4364-8f5a-b5e209b9ee21", "value": "E175BF241BEEE059F3739D7462F4EBAAC8AFBE721A07401610B9776D473BB446C43126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969908, "uuid": "806dd140-f410-4943-9e03-ac358993a458", "value": "24576:jf4GfOORBgGeavsXTCP/yg3f6vuaKvQs:jTWasIJP6vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969908, "uuid": "f02a3ad9-b64f-482e-a2ec-569c95daa4e2", "value": 1638400, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969908, "uuid": "814afeee-bcca-4092-bb2f-f04b22c0e161", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969908, "uuid": "2e5eb369-04c0-4b85-933e-dd6ed0f82012", "value": "Additional documents.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114f8fb0-8705-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615974139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615974139, "uuid": "601a786c-f74b-47c2-b790-f815ae3bc1d1", "comment": "Malware payload", "value": "aab7f6d0f1ff5e75cc8f974e7334f945", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615974139, "uuid": "05dcbe6f-e7fa-48de-8701-129c7dae3715", "comment": "Malware payload", "value": "1918595b01b0ad4f3b2a585bd100497d730be340cf37f32d122932d59555c559", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615974139, "uuid": "058ecf74-16ce-449d-8388-7e674a6a1dbd", "comment": "Malware payload", "value": "1c5d94a193949c893105da16a726fd4350f47a0b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615974139, "uuid": "c8ec8366-799d-4df7-9698-39c5a40434f0", "comment": "Malware payload", "value": "f7aeb73a7ab7fe4df31510a9f07fe86031c58d73000c854aafbb048b8114f018ccb0c86673aaa614d897ca909e4758de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615974139, "uuid": "7de96abe-f8b8-48e3-979c-804ca473df22", "value": "8AE42361370C124297C7E2A252CA3795A5B37263BEE71E4BECB1FC617E40B81C64CD66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615974139, "uuid": "99a76edb-803d-4be6-b5ce-fceb1237bd6e", "value": "12288:yqRvIb8a6u7L9U89qm8A3blne9mAT8U1BRIAH5h7iLbWOfmvxaiUBkiP:hRvI87ILX95bw9mk1zbH5humOBiQkiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615974139, "uuid": "2ce60104-bd83-4b3f-a039-3f6a9157865b", "value": 683008, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615974139, "uuid": "8c05bf1e-9305-46c6-9553-339803c7a7cd", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615974139, "uuid": "2e7abe68-5229-4276-8649-dd96e91c0cfd", "value": "DHL_DELIVERY_CONFIRMATION_CBJ0016032021068506.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6b7db4-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615984760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984760, "uuid": "50616642-8c76-4024-942e-9f3e89e14d70", "comment": "Malware payload (Loki)", "value": "1e959bde37e32d3da813d74d68ae4618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984760, "uuid": "c526de82-87f8-4b69-b139-0abef96e2c04", "comment": "Malware payload (Loki)", "value": "191e917300ed4d4a64bb92191f931e45e5f4e56374f65d2560beb4ff44f9f99b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984760, "uuid": "af3ed52d-8b95-478c-8a8c-d2eaf17c0044", "comment": "Malware payload (Loki)", "value": "0d5f31a635fe75e9e7788c0d906c02e6c1853d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984760, "uuid": "beaaae08-f896-41e0-b7ed-6a07f3146a31", "comment": "Malware payload (Loki)", "value": "3d3041fbd6c2bc32d1dde70146c5cbec4bfb2274653f0124538b99a954ed4f8186a6e688e941e1f6f54dac32cc4b0b79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984760, "uuid": "757c2af5-2af8-43c1-b359-06d6e786f0cc", "value": "27F3023E65F04977C29347B11AF5AEFBD2F2C21020206A6B07F42F7A68219D6DD1E163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984760, "uuid": "a01dbb54-c4b7-4263-8343-27ef7c1f34f5", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984760, "uuid": "1bdc82be-be95-4a90-b8f5-043cb902f8b5", "value": "3072:JPA6jXFN2MclPR0xS41Sy/WhzLxyGWFc2SMRG9u1UgUjMC1Q4gGloLGXfvU4:JhjmNPReIy+h5yRlGg1APbDXfvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984760, "uuid": "2eba3f1b-1dfd-4cd9-ac0e-8094a64ba08f", "value": 158445, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984760, "uuid": "d82973ef-0144-4c29-81e6-3569e2e96870", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984760, "uuid": "f864cae4-6ca0-4265-937f-769426ca913f", "value": "Angebotsanfrage17\u00b703\u00b72021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98206a34-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615969212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969212, "uuid": "a966e4c4-242c-4222-bd76-6dddd46b8343", "comment": "Malware payload (RemcosRAT)", "value": "e81c10dcd86bd4ef1ab2089dba2a4445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969212, "uuid": "715c3cdd-a985-4db0-a69a-64b0fc6ffcc7", "comment": "Malware payload (RemcosRAT)", "value": "1996c20ae87e2c3b831a778f261eebf74007b1a8f3714a66205ebbef58f1acea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969212, "uuid": "a76671d9-9e36-4e52-8a0e-5c4a56fdbb31", "comment": "Malware payload (RemcosRAT)", "value": "83be2dc3ebb394f71d261f1370ccca5ab4ba775f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969212, "uuid": "2bb5da1d-e1c4-46c2-b6c4-eed5d281b0f2", "comment": "Malware payload (RemcosRAT)", "value": "11ae57c900f57379ccd58fae6fca18d042d08caec42aa6b26c1ba967e7d0fbed4b0d901e2dc4ec6f5612a85af6df0ac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969212, "uuid": "395a6475-935f-4c51-bfe7-f48b70e74ee1", "value": "FDE25449289FDDC0D9966E7CB6FA4147823A78BACE54B86F04F1188B4C5721BCF79231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969212, "uuid": "7b13e516-096c-40c2-85bd-bde617c70ce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969212, "uuid": "d67064eb-629e-4465-84cd-6f1bafff897a", "value": "384:UGqYn9kfTt2qZoiwm9B3xrJjPEbPNmFTQWgaCeZkYcRkdX+XG4XC0B:UGIfPoCNwPIFTQWEeZK6duwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969212, "uuid": "956226dc-d2ec-4bf9-abf0-3672d0a1efcc", "value": 32256, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969212, "uuid": "5747dd90-b7cd-414c-9fad-323a8b29a140", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969212, "uuid": "77d99205-70ea-44ce-b2cb-ec838c6e4212", "value": "e81c10dcd86bd4ef1ab2089dba2a4445.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f966fe-8768-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016674, "uuid": "ddf27a52-e08a-4033-bf98-af4711f32056", "comment": "Malware payload", "value": "ff8ee877ddcd36fc1223da7e18821b6c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016674, "uuid": "3bd76f54-3c33-4bd9-95ea-26c27a228376", "comment": "Malware payload", "value": "19996a06afd682762bf05157e57983ff40814dca4fa8ee5e84eae54b57dfa6d6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016674, "uuid": "242a4246-1248-493b-8bcc-e73d25018d1a", "comment": "Malware payload", "value": "e2b2f13948fd853af5b5ab139de9c142de3083cf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016674, "uuid": "e3cc4a7c-757d-496a-9078-1ae5b0afc770", "comment": "Malware payload", "value": "c4b4af1f5d7864e621ec2dda545414981efd534d4ccf3756879e70bf2bf8a18d69c2fa71fe748a4b9226124fb75002e8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016674, "uuid": "0da6b73c-a633-4163-ab98-994d877f86a8", "value": "0124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016674, "uuid": "89366228-7b8c-4f5d-a8c6-6fefe9df1137", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016674, "uuid": "b491bb02-e1f5-4fae-9981-71075cdf3ca0", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016674, "uuid": "0d080a2e-beb8-4863-8adc-75f731bedcf3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016674, "uuid": "c240096b-ef43-477c-8256-e1c83aeb43e0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016674, "uuid": "d29347a2-57b9-40df-a6ac-8b6203f11767", "value": "19996a06afd682762bf05157e57983ff40814dca4fa8ee5e84eae54b57dfa6d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3344a0b7-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005120, "uuid": "7e6d38c9-509d-4acb-8dfd-dcee622af601", "comment": "Malware payload (Dridex)", "value": "357543c4f7f95054023f4f66d61fcd9a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005120, "uuid": "a4028dd7-4d35-4e24-ae84-5f73e4319c7c", "comment": "Malware payload (Dridex)", "value": "19a7a281da1ebbb2adab665e8340696a81bd709486ee57da53e577b0b78385e8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005120, "uuid": "29697140-78a6-40a5-a924-4add6a323e5c", "comment": "Malware payload (Dridex)", "value": "65eccd15a8941a7dd0046ee53e308e620eafe1ad", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005120, "uuid": "d446cbf3-fa98-4c9a-8b85-3aa9f110190b", "comment": "Malware payload (Dridex)", "value": "e33e858848371096c5d57cc541aff0dce4baa3ecbe37338d9dc943fcbdbc36803624c79175292bb1464308ac97c0d7c3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005120, "uuid": "c8e9c8a5-4995-406a-9992-e69fbec75dd2", "value": "C324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005120, "uuid": "8ef1e0c4-baa7-47be-8d78-bf867190d6b9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005120, "uuid": "0b8ead67-4a93-4b58-b08a-e4f14266f4cd", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005120, "uuid": "52f4a944-738a-4fd1-8ed3-5046ad028779", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005120, "uuid": "d9d774da-507f-4d8d-8ffc-00ed3407c2d4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005120, "uuid": "8c819c1d-e3c2-4e54-905a-a15d79c50b03", "value": "19a7a281da1ebbb2adab665e8340696a81bd709486ee57da53e577b0b78385e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0231513d-8751-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006756, "uuid": "d197e813-fe28-4fde-b9b7-221619749df9", "comment": "Malware payload (Dridex)", "value": "5480267d59f4d13e2262cdfbc5160def", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006756, "uuid": "e061222d-9393-4ee8-a006-c98a4ccbe230", "comment": "Malware payload (Dridex)", "value": "1a295aadbde3aa9143d818304d5804d06ef5d60d63eee0c2399dc4010f9cb505", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006756, "uuid": "f1fc208c-3879-4411-a681-702a45561bad", "comment": "Malware payload (Dridex)", "value": "b17f20c78641d5e5faa4d8b46594e381aaaa45a3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006756, "uuid": "14fee86e-dcf8-4fb8-b812-bd789c1f8da8", "comment": "Malware payload (Dridex)", "value": "8171dcd5eb81bedd0e89686bcab9162b8ed3402188d348c9807488e07f9933f867373267d8343580ebe46772fc7553d8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006756, "uuid": "253a03e8-7a7d-4487-aef5-2a17a9262909", "value": "0924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006756, "uuid": "39a8c07f-0a86-4e41-b668-55ed3680ac57", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006756, "uuid": "958cd05a-8db2-47b6-8d89-e5100f81edab", "value": "3072:o9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:o9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006756, "uuid": "3446b870-cae6-4029-bef0-6e8b2ff772b2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006756, "uuid": "e8def943-c42c-4569-bd41-50b4bfff845c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006756, "uuid": "73a273d6-53bf-4734-a702-1dea5f41503e", "value": "1a295aadbde3aa9143d818304d5804d06ef5d60d63eee0c2399dc4010f9cb505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e9e2a5-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003083, "uuid": "640c17d3-a6a0-4d89-9306-3c585b9cb422", "comment": "Malware payload (Dridex)", "value": "c2c07edf7ed00213c5bc7dd757c99bb7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003083, "uuid": "81502938-8716-4cfa-b1d9-f32f60a02fe0", "comment": "Malware payload (Dridex)", "value": "1a2ff2cb55a1bf595e2a1a959e90d9a91a7898d5cfd8536340eef09b6754a1c4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003083, "uuid": "dc2e2a84-2ca3-4986-b60f-f208b562871c", "comment": "Malware payload (Dridex)", "value": "cd6d9928a1b0753a6b713b0271e6bf7e49756808", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003083, "uuid": "06f729ee-6fd3-4691-b10e-4585daccc514", "comment": "Malware payload (Dridex)", "value": "2aa44f58efbfad452a5c85ef2324a65181007e50acb3545656fed06d8461a26f9116df93fdb56d10efa164b609f6b80f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003083, "uuid": "05918d18-142b-41ff-9ed6-8189d721d564", "value": "BF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003083, "uuid": "d667cc70-5d9c-4d92-a469-cfb0e61c9421", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003083, "uuid": "9703b711-1b2c-422b-aa87-3a90cf7016b5", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003083, "uuid": "95f92ba4-1c86-41bf-86d6-7fa2564ccb4f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003083, "uuid": "15f3bdc8-e4d1-4e66-a31d-7b211feb252e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003083, "uuid": "3d55c8fe-1e27-49f9-8ba0-eab78883c4b3", "value": "1a2ff2cb55a1bf595e2a1a959e90d9a91a7898d5cfd8536340eef09b6754a1c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a3c849-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017395, "uuid": "558af912-cb3e-4726-bf17-1138898621d4", "comment": "Malware payload", "value": "1fe8d49edb8db54bac28ebcd1bda4e6f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017395, "uuid": "ca6ff41b-f6df-4bd9-ae92-3b1b914e211f", "comment": "Malware payload", "value": "1aad65ca0aa60a98b16e8dbc59dc531b6054113e45f8a9539c2f2c81e2538eab", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017395, "uuid": "c4d0749b-78b6-4986-8cb7-d0a0bcaec5ad", "comment": "Malware payload", "value": "8d7a7ca993024d8fb49f45fbb1d1261480306fb6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017395, "uuid": "878dd20f-6bf1-4e83-bd52-189706e1a0ee", "comment": "Malware payload", "value": "340835a36ae74885af24ac2213b30a8c9f449c7839c1ba343aae205c99353277ea277e66fee3771ffbfbd09a68fbda1d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017395, "uuid": "df376417-814b-45cd-a69e-6c2e3e20fd43", "value": "AD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017395, "uuid": "27f0e235-a5fe-4cf9-9051-ca74e4ce1d17", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017395, "uuid": "83d2c2b1-2e6a-4eb9-b8cb-38d4a125833e", "value": "3072:99Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:99Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017395, "uuid": "09965b65-3710-4592-ad67-c36b5ef73fa0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017395, "uuid": "521d181b-257c-4540-9e78-bee9e0d24dea", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017395, "uuid": "00db453e-610e-4d2c-b2e1-98f7e544daa8", "value": "1aad65ca0aa60a98b16e8dbc59dc531b6054113e45f8a9539c2f2c81e2538eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8b7cec-8712-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615980012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615980012, "uuid": "40d5efb3-48c7-42f3-9d43-5b703aa251c5", "comment": "Malware payload", "value": "82bc19fa7184c064d05f308249c5d34a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615980012, "uuid": "eb5e9968-80a9-480d-894c-33f5f4fce2fb", "comment": "Malware payload", "value": "1ad305535a681901d7a91c96dbc52c875465f52ca03bebd3a197b6309d55669c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615980012, "uuid": "1f3d7982-c41f-423c-80d5-42351e22c138", "comment": "Malware payload", "value": "247b8047948e31c6be0ce27e46845ecd01ae6577", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615980012, "uuid": "406fcf0c-c8c6-475d-8380-47511c38ffc0", "comment": "Malware payload", "value": "bf3ee5765a0b9201578608675990db9467febe1af0cbdd9a7e01b210a1ed9b883b9d93eb32c5c18dee783ef038e95283", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615980012, "uuid": "38272cf5-891f-4390-9fa7-86b99c43bf5c", "value": "81E31264BE1E1A7EF28E61A9353D00E1E6B00EFD0CDCC86482D1DCFA971B1DD9999D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615980012, "uuid": "51ed0634-dc08-4e4f-bdf9-ecef7f3fec8c", "value": "3072:DiynXy5Mon6zTQwr8VHsFLySHbnCw1LZvqkvFNtSFTlcgPsiHZTcq4:DibznUvPFLySHL1LZikvnt6Zslq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615980012, "uuid": "1c427b97-0457-4d67-a6aa-cf61dc93bec2", "value": 152512, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615980012, "uuid": "161c6bad-4818-42e2-9493-db3f7cfb82a1", "value": "application/gzip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615980012, "uuid": "b89f19d0-6ded-4a3d-9192-40af6c96370e", "value": "DHL Receipt_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689c400c-875a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010793, "uuid": "4a6ddc4f-c0fe-42e8-98bb-fe47099547d6", "comment": "Malware payload (Dridex)", "value": "1ad5521ec7c9d048b9138f9a29506c72", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010793, "uuid": "8ea5f688-dea2-4821-b507-5592b59adbdb", "comment": "Malware payload (Dridex)", "value": "1ae08a6dc799d5330dce5e1a5919d17417cb7df12148b8cd0fd6c038d27e9dd1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010793, "uuid": "c2f5c60f-30ab-4edc-8bd8-bda6ef234ddb", "comment": "Malware payload (Dridex)", "value": "b92f4b8631a17a1827df941d72d35a6c4ddfc900", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010793, "uuid": "ff72777f-d426-4094-a032-31b99b427a60", "comment": "Malware payload (Dridex)", "value": "1f540ff05ccf09e0af00cf0b4de5994006e67ab6db4d59f5910ef155fd22450c4103bccf3bcc0d8f32fb3fbb296de170", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010793, "uuid": "bd7f5530-2573-4d1c-af23-be1f3ca015e4", "value": "2524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010793, "uuid": "124eb1ee-d5d5-4c64-a9db-9c4503d5b042", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010793, "uuid": "eb87fb67-0754-41d4-87e2-6370a802a17e", "value": "3072:K9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:K9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010793, "uuid": "23e2cc16-0f2a-4f33-b9b9-74bde094dddf", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010793, "uuid": "7d2532c0-94fb-4d61-9e94-a331256f3cc6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010793, "uuid": "3d7b548f-6260-442a-b4ac-24f4e56dd6a3", "value": "1ae08a6dc799d5330dce5e1a5919d17417cb7df12148b8cd0fd6c038d27e9dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6fb5a3-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "5f1145bb-7653-4c04-9fd8-f0aa02fa14f5", "comment": "Malware payload (Dridex)", "value": "3d757e22920a7ccb163328eea0d300e9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "87a52c0b-380d-4efa-88fb-0d7e124e77df", "comment": "Malware payload (Dridex)", "value": "1ae52e8bb8877fdac8e5451b76b7c01b360af538d6370952f3fa3439f1cb846f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "4d51d11d-b4f2-418f-ab8c-f2141e7e53c4", "comment": "Malware payload (Dridex)", "value": "1b1c12d7823fbfcffeb220ab50f317fdad3f2841", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "3105cf2c-889d-4613-823d-e3786ae5bda0", "comment": "Malware payload (Dridex)", "value": "d3b295a3f5c08dd17356d121b1e4b297935d4aed2f1500a81e2b33fcc2bee77a739b39ba225568cdaf09b6c018f1da66", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "09b06e97-56e1-4e32-90b3-69f0ea729336", "value": "3A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "1f93621f-6942-4a48-8251-95174a6e799f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "51129c39-62c1-4e70-a970-1c02777e7203", "value": "3072:i9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:i9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003956, "uuid": "1e9315e3-c5ff-4d49-8e0c-cdab654b1edd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003956, "uuid": "0684f18e-f65f-4d05-a960-11e71407bff5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "3ec1d3c6-ead3-4f35-b8c3-dc0ef80b91d0", "value": "1ae52e8bb8877fdac8e5451b76b7c01b360af538d6370952f3fa3439f1cb846f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc7ba11-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004225, "uuid": "958ca0c5-1d0c-496d-ad50-8f4ec1d1997e", "comment": "Malware payload (Dridex)", "value": "40d50505879ab490a150888e5f99068c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004225, "uuid": "24347e4c-9210-4bd1-b1cd-706867dc7321", "comment": "Malware payload (Dridex)", "value": "1b61e5f6c0575bc4a6524d8727926c1975df21b124a360613c8c683d63a81e89", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004225, "uuid": "0d8ae827-9485-4c5a-b035-00237d5ccbfd", "comment": "Malware payload (Dridex)", "value": "eef3a99b564109381d3e2969b7b5815f4f267474", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004225, "uuid": "cb544abf-fbca-4c04-8021-2368301f3fe7", "comment": "Malware payload (Dridex)", "value": "a357223b11e0d785335deba3a81ec07733659e065eb352d7aca56147fa7105c0b94c23492f1c970b517d910ffeba07fe", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004225, "uuid": "eadedce3-477a-4532-b7c0-02ecb9d7d60f", "value": "1324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004225, "uuid": "2615d56c-c965-477c-9055-df4e0059a5c3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004225, "uuid": "5ad50692-bb46-4069-ad15-4cdd4aee20ca", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004225, "uuid": "36cc6d18-5ee0-49a3-86ce-3b7845fa02af", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004225, "uuid": "c3adc397-1a82-4e95-9716-313339edd306", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004225, "uuid": "b6e031f2-723e-47d4-b13d-57076ee3fa4a", "value": "1b61e5f6c0575bc4a6524d8727926c1975df21b124a360613c8c683d63a81e89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8acfa6-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001807, "uuid": "b8c3c279-3547-4dcc-bef6-a80ed79accd2", "comment": "Malware payload (Dridex)", "value": "5902e502386deff74dd78e827130f734", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001807, "uuid": "61348240-8d1b-4c57-a4b5-352aa215ac20", "comment": "Malware payload (Dridex)", "value": "1bb3d2ecb614e87fe9169abb22fa5b41085bd791295d0cb9c6eb9715878f283e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001807, "uuid": "3c93805b-06bd-4d9f-b01f-c1fa74e48d3b", "comment": "Malware payload (Dridex)", "value": "9deb07b4d77f95a35697b452c914ae03379a4f12", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001807, "uuid": "74fb0e11-6ca0-4ede-bd9b-40e900990017", "comment": "Malware payload (Dridex)", "value": "c5baee854c3ba1df2ef800398fcc4e043ad3b846319277a8d8fe237d98a01304c012c23bab4668022d5c27b8a1414cb7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001807, "uuid": "3af2a8bc-4eb9-419b-acf2-89c36668d307", "value": "C824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001807, "uuid": "63618334-121a-4add-b77f-da15b04a5135", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001807, "uuid": "56243afb-a1b0-4d0f-a18a-07108e8226b6", "value": "3072:U9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:U9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001807, "uuid": "6ade5df2-adfe-4ccc-b280-45fc2f94728f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001807, "uuid": "ac81efa4-8a85-444f-804e-09b08a8a9286", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001807, "uuid": "219d9f3b-9c8c-4f91-8a0d-315cff8bd4f9", "value": "1bb3d2ecb614e87fe9169abb22fa5b41085bd791295d0cb9c6eb9715878f283e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3b6ffb-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615968363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968363, "uuid": "796fc493-abf7-4c19-a985-c5881d1254db", "comment": "Malware payload (RedLineStealer)", "value": "71d61ce15d3d8b02576ea4f1ce778bfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968363, "uuid": "56cc2c5d-6e0d-4e81-9ec9-b4a4d1c374a7", "comment": "Malware payload (RedLineStealer)", "value": "1bbbf691fab9190327d56aab3b93b70ef2b35353dcde740908c384ade4c7e6a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968363, "uuid": "8953c3e0-4b4a-4931-913d-3110259860ee", "comment": "Malware payload (RedLineStealer)", "value": "a606c39af456b886eaf2e088b6151d25fa39b774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968363, "uuid": "675305e9-aa72-43df-914c-e04aae0e64db", "comment": "Malware payload (RedLineStealer)", "value": "accb7191eaafaea604014a9b6b505a94465c91a3fe5fd03a42ec0dd8f33007ee757ac61510fd66ab881735f6496379c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968363, "uuid": "31d4fad5-0413-4bd5-b810-3283e3e74b8a", "value": "19C2293127F48A7ACC9E27B999B1C654CFB4E0555002FB1B8CC8618B3D17B91DA623F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968363, "uuid": "2208bded-6405-4586-87e8-2f1e4d43137a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968363, "uuid": "78207f1e-3524-4131-b771-dec024abe2bb", "value": "384:qmBnzdDjw3zjXFLk3879SFCSD/4vyvaLwSSaZch9I8F5M+UXVE:HnzdDcXBk38JSFERktlIm6bS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968363, "uuid": "01c07e03-8077-41e5-acbf-0f43b886f3a0", "value": 26624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968363, "uuid": "a857d72b-9e4c-447b-b310-cf84869ffe1e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968363, "uuid": "c3f187f0-9af7-43c4-b6a3-8dfb21f5f1af", "value": "71d61ce15d3d8b02576ea4f1ce778bfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccac7ed-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004062, "uuid": "c02b9976-509e-45c6-9cb8-e37cb46b7093", "comment": "Malware payload (Dridex)", "value": "8a53c2dfc46aa3ecf79dda9c55924406", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004062, "uuid": "31d79187-fdf8-4d14-8f60-88b3f007e0d0", "comment": "Malware payload (Dridex)", "value": "1bf157735d70dc74fc56be3550800a70ec2a526352a368585699d394054fdb0b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004062, "uuid": "ef3c6706-afa3-4941-834d-a7c20f79ae4f", "comment": "Malware payload (Dridex)", "value": "151459cfb3c898fd30b448519d82a99df546a1f5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004062, "uuid": "90d7b0a5-2d1b-403d-a121-a2d097dacd8f", "comment": "Malware payload (Dridex)", "value": "de1a46e6ec41d6515f26066c7f50b31658f8fd4140a5d45d1bb5bdfef14edef7cf0d5c7c787e15550732c272439d281f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004062, "uuid": "048084b5-6dcb-4107-a5b0-54ffda290afc", "value": "BB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004062, "uuid": "5fbfa116-1ada-4a67-96a8-2e9be06eead5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004062, "uuid": "ccdfd3b1-d5c7-4f81-b4cc-6abd24d79ca5", "value": "3072:l9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:l9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004062, "uuid": "24553b23-9b80-4c65-bd40-fe9e68c41775", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004062, "uuid": "d8ba21de-c639-40a8-8802-87a8eb3eb2e7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004062, "uuid": "c4aa6e64-6222-4bb8-9a73-a32ad42dcecd", "value": "1bf157735d70dc74fc56be3550800a70ec2a526352a368585699d394054fdb0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f4fb76-8751-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006979, "uuid": "da9970d4-87dd-4f77-81bb-cedf2daf3c23", "comment": "Malware payload (Dridex)", "value": "b6fa0e61dbc2fbb6113a4b6cc5a3017c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006979, "uuid": "07001a8c-3bfe-4c23-950c-2ab544b7b123", "comment": "Malware payload (Dridex)", "value": "1c034d9b116485ed0c02786a4ad8ab93f24f600d45cfa85340a422e972fd913b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006979, "uuid": "47fcf48d-ce85-4c8c-ae26-47254b0a71bd", "comment": "Malware payload (Dridex)", "value": "50cebebc19aedc9cf93f38e5d84b2f14cdd47063", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006979, "uuid": "71f5d70f-7cc3-406e-b8ba-ae6cd4a7d9d9", "comment": "Malware payload (Dridex)", "value": "a8da49dd0f9b525a3cf90768c5822dc595e39b096c2717211316e4c567caa5e3281ee5ece98b7033791a7d2cbe071425", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006979, "uuid": "0817a63c-ecb3-435f-aa9a-f381b7eaa5a0", "value": "A824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006979, "uuid": "92e5702d-e5cd-4fe8-bc9c-9277b8eca20c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006979, "uuid": "3fa08e19-75f1-4b93-8c26-3ec099875825", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006979, "uuid": "16688c8a-56a2-46f7-92e2-15464ac33331", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006979, "uuid": "0703e00e-cbb6-4965-b0e2-751af3b2a552", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006979, "uuid": "cdfb05f2-5d47-4044-8002-f597abbbd3c8", "value": "1c034d9b116485ed0c02786a4ad8ab93f24f600d45cfa85340a422e972fd913b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22110dd5-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615969443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969443, "uuid": "5dfbcc2c-8b81-4fec-b2f3-ff83fe4d9a90", "comment": "Malware payload (RedLineStealer)", "value": "531f5c0a5832444e0ad64c6742ef4a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969443, "uuid": "8e8d7f4f-352b-4097-991b-93395319d794", "comment": "Malware payload (RedLineStealer)", "value": "1c57ac747be31a6b70f4eb81bd3a92ac4c4261ae8d6f63c995af3aa2e944ba75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969443, "uuid": "7f02b531-07e4-4fe0-a7b3-2e2e38940e93", "comment": "Malware payload (RedLineStealer)", "value": "a36b4613133d7a78e455075218cc6b000602e66d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969443, "uuid": "ac7d2b65-c432-40f5-ae55-3dbb1d95dd13", "comment": "Malware payload (RedLineStealer)", "value": "c7262a786f4834ce3d047a365e00fef17d54261a939d6547381c26d439024c23a18ae41ef341592c38b3718c4d99d945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969443, "uuid": "ef79e528-0f91-43cb-b3c0-6493fef3ab39", "value": "CC657C50AC8328E5A322A757CECCE7C8DA537F3B19E26C5B7988E33394479508561F78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969443, "uuid": "d321ccce-a25a-40ad-ae18-d19d2db11704", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969443, "uuid": "e770cedd-e7e5-422f-942f-7f4dafc373b4", "value": "6144:3w6n1GIgggBUi5XYD0c4HSic8UQNLArJrI5goLn:3wcGzgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969443, "uuid": "bef702eb-ca11-4104-88df-baa8ecb88822", "value": 1463088, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969443, "uuid": "ebc5d654-760b-4289-9673-931564f280ea", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969443, "uuid": "44c126ee-0785-4e1f-a4c8-3afc8e6e905b", "value": "531f5c0a5832444e0ad64c6742ef4a12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590cc92b-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Arechclient2)", "timestamp": 1615969535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969535, "uuid": "c3f74cb5-6696-4426-9e30-1f2f16e85397", "comment": "Malware payload (Arechclient2)", "value": "1f0c86722e882c3a2e1b2aced5b338d6", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969535, "uuid": "a6a9d887-fe48-4461-a921-645030debb97", "comment": "Malware payload (Arechclient2)", "value": "1c83962ea10ce2aac61fe881ae8d79514148be5fc90c121a6fa285d6f640ee0c", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969535, "uuid": "57309f93-89d3-4499-bfb2-7377cd6df3df", "comment": "Malware payload (Arechclient2)", "value": "2a1c02f4dcd53906dda8703219b7505fad15df03", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969535, "uuid": "3494d7bc-c225-448b-9f22-41dad2bef5f0", "comment": "Malware payload (Arechclient2)", "value": "b181307dac6e6d55e72ca747af0dc74b27f954b60a3e8195669f7cb6cce4c1e8e4acbbeaa37ecd50f746fa3101ef0d53", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969535, "uuid": "438070f2-6e99-4443-9ff2-a147ab3ffdc5", "value": "49A4C4352AFD6304A0B3BFE22BD8F5D1D9EFF7225F0449592510631B5922E98CCA7632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969535, "uuid": "9aa968eb-7d7f-4dc3-b4b9-39d0ab416b0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969535, "uuid": "ec8d7a45-844f-4a3e-ad27-6b2ae7403ce8", "value": "768:GQhHZlSpiyA1HS1dAT0zocdB3KtvTe3DDv9mmLc5YlvmmLzEVYKDDYEwmpD3YemZ:phHZlQiV1SkT0zocd4y6ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969535, "uuid": "f7bd4997-2069-42d5-bdf7-525351721d06", "value": 492544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969535, "uuid": "42bc8618-faea-4775-83c1-ee14b870b6b8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969535, "uuid": "f127e856-0e47-458f-ac8d-c33557e36b34", "value": "1f0c86722e882c3a2e1b2aced5b338d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fecf8d2-874e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005517, "uuid": "3bc9e417-0054-4bb2-895c-2bddb8e43824", "comment": "Malware payload (Dridex)", "value": "1c272125a3c2bd9cbbd37999fa27533a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005517, "uuid": "ccb1a8f6-ca10-458c-9473-1e7e4a1363bb", "comment": "Malware payload (Dridex)", "value": "1ca9ae992ec23973c9cb38304b74db084f9c4af2fd7941806dd72e3bea9f7d3c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005517, "uuid": "2ff03d4a-41b9-4b08-a6f6-db0e5c0c1fd4", "comment": "Malware payload (Dridex)", "value": "10505e4ac59e942aaa74e563a936a20879fc0b53", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005517, "uuid": "e610b10e-bff6-442b-9c11-144790b7500f", "comment": "Malware payload (Dridex)", "value": "ffc0fd40f32bcca54dbc4455d1319de026f3eef35f035111e0bd1b6fbc2ff4b73c6ec424aaa4bc94d420bc150ead6d9e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005517, "uuid": "04d25054-9b86-4162-baa4-0b254e25769a", "value": "8224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005517, "uuid": "752b0989-814b-44fb-a59a-fb0012475a09", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005517, "uuid": "decb337a-1e58-4ca7-aaf6-e938c0133119", "value": "3072:F9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:F9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005517, "uuid": "bebd8384-3916-46ee-98af-c5c2f396788f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005517, "uuid": "c7577664-f0fd-4e8e-be5d-2ca3ecb42dc3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005517, "uuid": "8c1be8cd-d322-43cf-94a2-54d82b061425", "value": "1ca9ae992ec23973c9cb38304b74db084f9c4af2fd7941806dd72e3bea9f7d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1517606-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004526, "uuid": "3635e4e7-330b-45d8-b761-a8d702465a2d", "comment": "Malware payload (Dridex)", "value": "fedda921af4cf2deeed4fa3f755f6915", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004526, "uuid": "6ce235be-ea4a-4178-ab2e-42d543f440a2", "comment": "Malware payload (Dridex)", "value": "1caf7da6934165ea6ceea8ca6f6dbfd135fb5239d24e6442c6cbf444fe7473eb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004526, "uuid": "bd3b57d3-e0b1-47f2-bbf9-8e8d4e971713", "comment": "Malware payload (Dridex)", "value": "5ea3ea2315927766c87e741487514db928553b56", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004526, "uuid": "f1306e70-face-4ef5-bd90-d29c705639ad", "comment": "Malware payload (Dridex)", "value": "1fae5268927067391d221cbb99718ddd0f5337c0b81b03b496b9e9aec58d6e56cc48f6bacf9a78aea528c240565fa84c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004526, "uuid": "9ab76240-5ee8-4334-aa0b-950820158440", "value": "7324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004526, "uuid": "e1dcd89a-7631-4201-b7fc-3c3ae6d5af19", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004526, "uuid": "c587f33b-df85-42ed-af75-76ae39c25492", "value": "3072:x9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:x9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004526, "uuid": "f9642cab-dedb-4c50-94fa-a8ef69c78ccc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004526, "uuid": "5c190cc3-5105-4f04-9b29-5af431b696cb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004526, "uuid": "53e49a7d-4f3d-418b-aee9-87fa0c1a6e15", "value": "1caf7da6934165ea6ceea8ca6f6dbfd135fb5239d24e6442c6cbf444fe7473eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd57a1a-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005084, "uuid": "34a684c9-5f68-4836-a1c8-1956275b0d0f", "comment": "Malware payload (Dridex)", "value": "690e47d5725501a3442c6a785201e6a1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005084, "uuid": "82808561-5b9e-4657-bc65-d8cd359af927", "comment": "Malware payload (Dridex)", "value": "1cc15b7db6ac8b933f79a6e84e93015c9cf6b5653db66b7e5e2cc4b61a6a362b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005084, "uuid": "86096853-980b-479a-8742-d77d7cb1a1ae", "comment": "Malware payload (Dridex)", "value": "8a8d1d561ef2b09ae8a9c1e42e496c258da41210", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005084, "uuid": "d93d0b71-7f88-4e6a-8355-f5bb24c310bb", "comment": "Malware payload (Dridex)", "value": "9967dd2e2f17a4c019a4940151afd7a33789f91f38ca1802ecb6d6557762194f6ec136e8bfaf65b14f5d2293f8bb2179", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005084, "uuid": "a191d2bb-e9be-4401-8581-beca08c910b2", "value": "E924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005084, "uuid": "1213cef4-312f-4e76-9186-11e025746189", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005084, "uuid": "40b2993b-dfd3-4b41-bc30-636cf0096622", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005084, "uuid": "0c73aac9-57c9-41ed-91b0-5b7db5fefedc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005084, "uuid": "a6814877-30e0-429c-bb50-d18377a67188", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005084, "uuid": "86dfeeb9-fbd7-4c27-8bc1-050181b0a907", "value": "1cc15b7db6ac8b933f79a6e84e93015c9cf6b5653db66b7e5e2cc4b61a6a362b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964373c5-870c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615977369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977369, "uuid": "3440f340-1b3e-416c-b3c2-f956d1f334e5", "comment": "Malware payload (Gozi)", "value": "24e7b6a3e261bf1cbc810f9f07cdbdd0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "prosper-tv-2015.com", "colour": "#9EE98C", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977369, "uuid": "a7fee0ac-4606-411f-973a-8b3828e6ec2d", "comment": "Malware payload (Gozi)", "value": "1ccab1a1926170c44244510d67540357cf2a7b9073bc7fc319002f2b747d014e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "prosper-tv-2015.com", "colour": "#9EE98C", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977369, "uuid": "b35947e2-bef3-4645-8f25-1183fc9104fe", "comment": "Malware payload (Gozi)", "value": "f35abb3756e5034d291fc1164794013126da7529", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "prosper-tv-2015.com", "colour": "#9EE98C", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977369, "uuid": "6aa4a10f-47cd-4e04-ab6a-66f9331951f0", "comment": "Malware payload (Gozi)", "value": "40f487030fa97d72e48104ac0b65e8aec17448c2fb2e8fd790b86166b5d28a3f31fa2312f385ddae4d855d4db23fa055", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "prosper-tv-2015.com", "colour": "#9EE98C", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977369, "uuid": "3628dae5-e4dc-44f2-8d58-b0bdfa11e4ae", "value": "E6D4E12362C24336C433D539496594629F4AB8B23B3448EB769C217B5F736E0463FE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977369, "uuid": "5c609d16-86bf-402b-b0a6-833c3248d0ec", "value": "b851db331f15ad36e816a5c958a671c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977369, "uuid": "4124b0fe-c8fd-4b91-9f0b-cc5199a18290", "value": "12288:QxHGz7jrsxOZWGvw2uV+HZfyWdAHKHRnhtOJbIP5UsT9GdOxRCeg:jtWGvCV+5QoVhPNT961eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615977369, "uuid": "3a1638bd-ee4b-4bf6-ae3d-f761324c18f8", "value": 641024, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615977369, "uuid": "36e4069f-5ab8-42d2-92ac-9e57aacefe09", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977369, "uuid": "1a09cf34-8958-46b5-af4b-3ed31e9cb32f", "value": "kul6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57d8a0d-8762-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616014466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014466, "uuid": "c39d5207-7bff-47ea-b291-cb84b9bbe0d6", "comment": "Malware payload", "value": "fedfaba5126d71af54ef6b8db7315feb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014466, "uuid": "622c83c2-7d66-4e99-86ab-4dfb0be574fe", "comment": "Malware payload", "value": "1d15e986d39298e0c4449db5e9fcaa37226323f2eb9911072fd1b0a59bb7d9a3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014466, "uuid": "4e2e9c3b-2bbf-4802-a817-df6f706f36f9", "comment": "Malware payload", "value": "b576712a7733377936604a280c52624b92955394", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014466, "uuid": "9fdf40e2-f2e6-46fc-a2bc-676cd96155cf", "comment": "Malware payload", "value": "3641009cdda1d1fc9c72e403c8cd4f83274ee04f260409f01f36567fd2c8964a42b6404b22c0f80bba2b2fac4f08893f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014466, "uuid": "820eb8b7-b9d4-4098-a460-8ecf3bb91bca", "value": "7224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014466, "uuid": "a1e12f0a-1da8-436f-8bc4-716fba6d4de2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014466, "uuid": "5532a3f7-55d4-475e-a0d5-92688ae3cf52", "value": "3072:/9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:/9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014466, "uuid": "0f66cef1-e806-4b90-874a-b0d13012dfe1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014466, "uuid": "3839ca38-ea93-47aa-9489-c897005b7406", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014466, "uuid": "6a266b21-4c5a-4811-bc41-9c2528e7437a", "value": "1d15e986d39298e0c4449db5e9fcaa37226323f2eb9911072fd1b0a59bb7d9a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00555829-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008900, "uuid": "306a64b6-16a6-43d3-a728-658841c8c8c0", "comment": "Malware payload (Dridex)", "value": "5c16c119549f4febe11c6a43d004fbe6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008900, "uuid": "361197dc-77a0-48b3-ad8a-8c623814b340", "comment": "Malware payload (Dridex)", "value": "1d2bca74d7a69fd47b42ad8a4e71e9b2d24caf64df48a33fd07c11dcfd9e0285", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008900, "uuid": "edcfd27e-c8a4-486f-bc8e-86c4fab48fb4", "comment": "Malware payload (Dridex)", "value": "2f627fe8fdc846c8ff0023b54f33a5cc4a8ebcfd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008900, "uuid": "631b58a5-eacc-4124-8056-0c3538536b0c", "comment": "Malware payload (Dridex)", "value": "d64641f30e1de6ce4709b730791fc21bf9182348d8b78b4a5c091160477e6501093506427fc9735536ea314c93dec899", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008900, "uuid": "41db0513-b1a2-4d3c-819f-2491b82e6a8f", "value": "2E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008900, "uuid": "4760fbbe-22b9-4699-84cf-d09a7d39e6b9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008900, "uuid": "96d25012-284e-4b37-a224-e0da02d4f16a", "value": "3072:M9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:M9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008900, "uuid": "b1aa09d7-742f-45ac-9bac-317dddc50ced", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008900, "uuid": "5f3ee9f1-135a-413a-a628-d1e86a79113a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008900, "uuid": "f8338560-ac54-4d29-96f0-5c534b2c38c5", "value": "1d2bca74d7a69fd47b42ad8a4e71e9b2d24caf64df48a33fd07c11dcfd9e0285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a174c492-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969227, "uuid": "46497df5-2d40-46e5-a699-49510ace8d80", "comment": "Malware payload", "value": "c481259ad199b773339f168902cc7437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969227, "uuid": "808d367d-0c26-4e62-b4c6-793f035bf1b1", "comment": "Malware payload", "value": "1da5a6aac7197d1fcadef018775831885b715d5c37a3115777dc5c717ce6e0da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969227, "uuid": "67cdb50e-c1b3-4dc6-bff0-3af82b2af546", "comment": "Malware payload", "value": "4c9a81f2a9167f953109eddbd141ea8d078d13e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969227, "uuid": "83d8704c-6b74-4847-a3a9-dbcfff8a159d", "comment": "Malware payload", "value": "bd79b00160ff3ee03f23b11e3b7d00396feac770b0d78216ac8b8477d441285398a0240496de59ab107c0d434a7804c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969227, "uuid": "8703bec5-134e-41ce-ab4a-699941f19378", "value": "BD445F1075FB9058F6B37F722EE9F9F24CDFB6B1190BE0A930440A1E9A21A44CD76674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969227, "uuid": "817f29fd-9f36-4fa1-9768-ae7288629ba4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969227, "uuid": "cc14cc1d-70fb-424d-b6e7-255612f9911d", "value": "6144:SKZ99xDMMlG36rxMMlNu76Y996uSMH9Z6kMrlNfoMSMlG36rxMMlSHoSf6kYMH6/:SKZ99xDMMlG36rxMMlNu76Y996uSMH9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969227, "uuid": "a20bc342-6326-4886-8d41-2b2198d7a5f7", "value": 273920, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969227, "uuid": "07f0f078-de49-4f7a-8342-752a9563840c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969227, "uuid": "69a47c57-248b-42ee-b297-766a23cf94a4", "value": "c481259ad199b773339f168902cc7437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78704fc-874e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005745, "uuid": "34969e07-6b57-4caf-acf1-95f8bb3ecbe7", "comment": "Malware payload (Dridex)", "value": "545bb8a828d460e6758aaae571bb70df", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005745, "uuid": "97bc3b14-9450-4e51-91a5-cb3f4da347f4", "comment": "Malware payload (Dridex)", "value": "1da5cc38c1a40ea5fe8e8174b41d11352bb278c12e97d2c1db6b3a3fc7f5a43e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005745, "uuid": "bccdf792-531c-4c30-af97-62e6a56514be", "comment": "Malware payload (Dridex)", "value": "e2c0a8fbcf5723b08b3e5a3044c3c0e34ff4e9ca", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005745, "uuid": "fe2f0fa2-1b19-461b-8919-b823c3e33616", "comment": "Malware payload (Dridex)", "value": "f96f4fc0065b7ae75cdf6607683e05fb25cd521a8075075dadcaee0ec63e493f959b8087447aee0e6628d068bba270b9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005745, "uuid": "39f2b566-957f-4a89-9f13-d3a471b41382", "value": "D924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005745, "uuid": "24072fcd-fdca-4ef0-b412-3e15039c36b0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005745, "uuid": "ff03236c-390a-43c5-ab84-ebcb425f4715", "value": "3072:u9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:u9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005745, "uuid": "f47f13c0-0b91-4717-9ce5-947432b63a03", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005745, "uuid": "1e7e1f34-9a13-42f2-bba6-4452769ec50f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005745, "uuid": "93fb2d83-b406-4402-bac8-efea18a6ead5", "value": "1da5cc38c1a40ea5fe8e8174b41d11352bb278c12e97d2c1db6b3a3fc7f5a43e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d50fb0-86ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615964374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964374, "uuid": "bfdfff66-1397-4a1e-b539-5f5ce7cb5cc7", "comment": "Malware payload (AveMariaRAT)", "value": "b44c69f6c9d6e6f0638e2096e2cc1646", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964374, "uuid": "c1bd064f-9aee-4a1e-8363-f0d5e5eedb99", "comment": "Malware payload (AveMariaRAT)", "value": "1db8dca90cc4f57b8d96737bd5efb3493b1b62bf222d39740334ef1927214c6e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964374, "uuid": "1d206f6f-6fe3-42e1-b54e-4923894fb7e5", "comment": "Malware payload (AveMariaRAT)", "value": "798c6e174553e59392e32a94940d9784b2f288c0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964374, "uuid": "a47de717-ea2d-4cc7-8334-1bc548e51ad5", "comment": "Malware payload (AveMariaRAT)", "value": "fc757ffd4a8c0490793a8c2357cabf9462935ee79f32973b948e655a54a9f9f4dee51b73807ab1e4b861f1ba6dfa54ea", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964374, "uuid": "5eae2b6a-d82d-4161-8b7e-07421d3c6972", "value": "1E34E00BF5A88D02C5A95A31D1F2540077B1AFC312B1EA4BBC8EF35679537DE490A2F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964374, "uuid": "098068dc-0a15-4fae-b2f5-732c43d92ced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964374, "uuid": "1ab3f0c4-3d9e-48f2-830a-6ce9a064e981", "value": "6144:FiOYhDI3r0M+FdzcGVm73r0M+FdzrGVm3H4K46:4OYpUYReAm7YRlAmX4K46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615964374, "uuid": "0d2ef86d-04d7-445f-8b68-41214923f745", "value": 247872, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615964374, "uuid": "fa7e6224-39ab-4243-a87f-488605f7d024", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964374, "uuid": "42304663-fc5b-4d08-8419-a4802fc127dd", "value": "Booking Confirmation 17f43d80a-6f0f-4d89-926d-8d1dce8- Copy- PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05aa91f-8747-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616002860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002860, "uuid": "145f537b-90a0-4b3e-b279-6f780f80e182", "comment": "Malware payload (Dridex)", "value": "28c112ef24b1363f135619952603eaba", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002860, "uuid": "606c648b-df6a-4be5-bce3-764794930813", "comment": "Malware payload (Dridex)", "value": "1dc7f8a599df496ad6cc0cdae0c3e08ba71cebb8996bfc6501be34342ee251c4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002860, "uuid": "19623c54-0c9c-418a-b3ab-164b8c29f2b5", "comment": "Malware payload (Dridex)", "value": "636e3ed247a646fde888e376b8e5eb30658e1290", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002860, "uuid": "cec269d9-55b0-4cbe-be2e-da38e2e59eba", "comment": "Malware payload (Dridex)", "value": "8152c0f13ecd373ca621806580eb1cd7c98f2cb475cc8406c1b61826a8fbbd77052784eb3d5f180b737f4d7d31bf23e6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002860, "uuid": "4e2f1df0-ca0c-4f2f-a41a-be6026d09b35", "value": "D724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002860, "uuid": "ccc6caa6-92c8-471d-81d4-258e675d1e32", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002860, "uuid": "ba29fcbd-7e6b-4dc1-9010-76e0f9dbb031", "value": "3072:u9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:u9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002860, "uuid": "4235e536-4301-4046-bba5-4a4297f638f7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002860, "uuid": "0797bebe-600a-4d86-abec-36b5dfbe2bc2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002860, "uuid": "52d656de-d5c5-418e-b2b0-e5e901fdcc01", "value": "1dc7f8a599df496ad6cc0cdae0c3e08ba71cebb8996bfc6501be34342ee251c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1c6428-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615962182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962182, "uuid": "df3c6e9e-6ab1-48f8-9efd-951e6d4575fd", "comment": "Malware payload (Loki)", "value": "d95b6a75e2539bc456dc4ea02bac31dd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962182, "uuid": "544e8ad3-93e8-4b38-b978-de0b9a0fc8ae", "comment": "Malware payload (Loki)", "value": "1df41f85eabf9a1ee9af9e0d021e0bec07cc08337d049150ddb2c82443d31f94", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962182, "uuid": "7f00f111-1d3c-44f4-8c79-ddf19ac20ec7", "comment": "Malware payload (Loki)", "value": "50aa72543ffc93a24d855f34c3307a75fb97f61c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962182, "uuid": "ad8e5097-ef43-435c-a982-a6fc7ab17359", "comment": "Malware payload (Loki)", "value": "6ecee003a7552969b3a14b0ea5db4f8892f08133ebe0dddd0ec8a9348933db227360a8cf72c1d697a8093dc244c641ad", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962182, "uuid": "7dd05944-6db5-4b0f-b083-a4b817930dee", "value": "0BA53303CFC68F4CD41FA6399D6E64559A65EC521E154CE3735CB32938332B3B2CAA29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962182, "uuid": "110ea55e-53d5-4cf6-8887-28259d4d62f7", "value": "49152:zMxr7k3qhHQVbtq4wrJGVyOU4jSNE393MVw4j9Nm1uz15LiB+RUUt2V:YxrA6ZQVxq4wrQ1zS2NsBfmQz152+OUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962182, "uuid": "85d7171c-40a7-4e4e-88e2-cef814571281", "value": 2128896, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962182, "uuid": "eabc3607-048f-4341-a1bd-c718cb8d18b5", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962182, "uuid": "43824fce-48a5-4432-84e9-171ce3bf9b2f", "value": "payment_certificate.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd65452e-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004117, "uuid": "a1f76d2b-f83b-43c5-84fd-826285fa4812", "comment": "Malware payload (Dridex)", "value": "17c2f27cc6071b6914742f363f095e77", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004117, "uuid": "f1c3661c-ef0f-452b-ad80-89ccaf407f3c", "comment": "Malware payload (Dridex)", "value": "1e0446d317a836f7dbfea191a3582c3edde59f69b11fa98b28f2c9eaba879994", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004117, "uuid": "d446dfd2-573a-4a36-8441-2cff1e3c5d80", "comment": "Malware payload (Dridex)", "value": "901cb1ab64c8dc0882bb4f132c22dedebaa70ceb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004117, "uuid": "e5cf6c6a-405e-4760-a41c-9039b900f5f7", "comment": "Malware payload (Dridex)", "value": "97d437df0129060c5142b594f5f3e1492b354cbbfc7c798069a6d779b194387e8633033173fe014d2cac3d488c3fb40a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004117, "uuid": "c885f36b-0652-433d-82de-3d98e3f0ee42", "value": "AD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004117, "uuid": "421c4378-8009-423d-a046-46dd9fafcf03", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004117, "uuid": "9ee070cb-d622-4702-a22a-78f37a89b07c", "value": "3072:Q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004117, "uuid": "b7fd7d4d-1f32-46a1-936f-54eb1dd6ac75", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004117, "uuid": "09b50c0a-a35c-4684-a956-4c35f09cf340", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004117, "uuid": "d81afe32-d837-4f33-ac5d-a859b44c7dd7", "value": "1e0446d317a836f7dbfea191a3582c3edde59f69b11fa98b28f2c9eaba879994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddefe09-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001783, "uuid": "d8355b35-781a-40d6-af7a-0237eeed5c34", "comment": "Malware payload (Dridex)", "value": "0dbead06e2d41d6535134d6a5d80ec2c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001783, "uuid": "0e75329b-27fc-462f-b8fb-56c7daf3f8e5", "comment": "Malware payload (Dridex)", "value": "1e6ac301592e262a2cc2a6a83b7a2cc8016517f4fcb201f2573f3f96ba5213c6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001783, "uuid": "bc34f101-3a87-4fbb-9d23-8b2faef8b025", "comment": "Malware payload (Dridex)", "value": "1932d25637e57d224bb3715f080c1841256927b6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001783, "uuid": "4ee3b102-b4f9-4637-b12c-9595376969e0", "comment": "Malware payload (Dridex)", "value": "60fb112743ffc48a62fe8fca9de2c22d3894ab287044613b3f520a3918511f76150640c55cffee08e6bbe8073d830f56", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001783, "uuid": "4341475f-e599-4116-b8b3-a159c419c126", "value": "A224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001783, "uuid": "5b1e5a8f-b8e8-4093-a0a9-b7225953b2f0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001783, "uuid": "b6eac471-c23f-45e0-843d-ecdc7b63fcdb", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001783, "uuid": "bc3e8dcc-91e1-4354-8321-7d1625063f89", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001783, "uuid": "6837d513-86fe-4aec-9bb3-4e38a0b666ac", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001783, "uuid": "90b6fe2c-e4c3-4774-8cca-561287e10dd1", "value": "1e6ac301592e262a2cc2a6a83b7a2cc8016517f4fcb201f2573f3f96ba5213c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d21cbd9-86f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615966106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966106, "uuid": "1b74ede1-8da1-48db-8356-d18664664e0b", "comment": "Malware payload", "value": "8ff9c60973030bf70c51629affbb8141", "object_relation": "md5", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966106, "uuid": "ee088285-0363-4272-a862-f0843fbb4c05", "comment": "Malware payload", "value": "1e8b2960094c99626ed8409067304e8f2f3f9b623f056a2551c72b7742979720", "object_relation": "sha256", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966106, "uuid": "224b6e69-9b57-4bde-a2b9-6e3c897e946b", "comment": "Malware payload", "value": "0ab1fd731a256bdc25fa12f5290613e30623a6dc", "object_relation": "sha1", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966106, "uuid": "3f1a2847-ee44-4b4a-b4f7-8ff8400153ca", "comment": "Malware payload", "value": "c912a48bfe988e4a71ee3cc5d0895b34736f3b7dc41833e79fd055e178c5d99db4040f6dd3185e25a3ddb7e9abf97f7b", "object_relation": "sha3-384", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966106, "uuid": "3e14fb8b-e55f-41b5-811b-c4fa77dc2e3f", "value": "3FB3F10ED2141CA9C63A707FE305A8F4654DB361A892E50B2528FE0879E95F70FEF19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966106, "uuid": "4fc8d54a-73e2-41e6-bdff-314c62054bac", "value": "3072:+gOYPvsUtFARPULAZemMA5uAgz3xQGa9RVnfdCzSj:+FMFAeErgzBQGYVnfd1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615966106, "uuid": "95731ccf-2bae-4d27-9055-11eb3d013c32", "value": 116316, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615966106, "uuid": "08b9fce2-41c9-44b5-a37f-2ef70e8c5881", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966106, "uuid": "72db6856-ce88-4ef0-bdcd-28cf94b35289", "value": "1e8b2960094c99626ed8409067304e8f2f3f9b623f056a2551c72b7742979720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0e20ed-8764-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616015042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015042, "uuid": "4d5c7deb-77c9-43d7-a467-dffec036f692", "comment": "Malware payload", "value": "3f0d7194991cf544783c6faf8ca677e3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015042, "uuid": "7185387c-c7b0-4ff2-861a-71c0408a75c9", "comment": "Malware payload", "value": "1ead5fd5a3addedfc80d1d773e8371de28b9140c4fa57d414b6620ee389bfe3c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015042, "uuid": "e341e478-0ab0-4565-90f3-e962a5c30a9e", "comment": "Malware payload", "value": "b19e4fd5fcec60b97a01c087b4f898c77ee560dc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015042, "uuid": "062cf7dc-dc27-4051-a200-93a1a07fba2a", "comment": "Malware payload", "value": "54a967719689d69ee3633a5b3211fb96abb967847fd808061fdf3b6306c9e575b094fefd3845b439196dc468aa658c1e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015042, "uuid": "c5d7fe80-5821-40d7-be45-e689257aa942", "value": "6024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015042, "uuid": "43acffa2-593d-4dd4-80e0-af7a17c6fc29", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015042, "uuid": "67a0afdf-f4d6-4665-b847-f15a4d3c5e57", "value": "3072:F9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:F9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015042, "uuid": "7444af2a-a881-44d1-9ce7-40882e6336af", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015042, "uuid": "5139494a-9153-44fb-82fd-4ae139f87dc2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015042, "uuid": "3439a100-151d-4fb1-b65b-b2db50cfdcec", "value": "1ead5fd5a3addedfc80d1d773e8371de28b9140c4fa57d414b6620ee389bfe3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6a293c-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004409, "uuid": "164ddcd7-d6ba-4411-9288-9d1bf0048dcf", "comment": "Malware payload (Dridex)", "value": "0dac72e041374b4e1117b188bcd7029a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004409, "uuid": "0cb6517b-0689-4c5e-89dd-614aaeb4be12", "comment": "Malware payload (Dridex)", "value": "1efdd5643f3b4b6b95266621d3b7757c8a7b49c9897e427e8f2833489fec2e9e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004409, "uuid": "d1b50888-d752-4e85-b003-115edacf878b", "comment": "Malware payload (Dridex)", "value": "599a534b43edf0bd58d5a60d10886a913007463e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004409, "uuid": "bb08c794-73ec-43df-8448-63485f01bad1", "comment": "Malware payload (Dridex)", "value": "c0930083dd8a7c7de146e930b79dbad68ac48b68901189bbe979f775d918203da55c459cfb2cb128adbe103a43de164f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004409, "uuid": "b5819e06-46e3-45e4-9aab-0255a6e1d13b", "value": "8D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004409, "uuid": "a50b5171-b0d5-4eaa-b941-3d166e1c25e1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004409, "uuid": "2a9a460b-cde2-4e1e-82c8-7669fd9931f2", "value": "3072:H9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:H9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004409, "uuid": "9a0915f0-0507-45ac-811f-aefb3fdb86fd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004409, "uuid": "cc42a1b2-a58e-4aef-8f08-87b8c5986295", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004409, "uuid": "fc182041-f500-4b93-b653-9d579a6a528a", "value": "1efdd5643f3b4b6b95266621d3b7757c8a7b49c9897e427e8f2833489fec2e9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbe474c-875a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010934, "uuid": "e4cd453f-3280-48d0-8c66-a4d45f4b93d3", "comment": "Malware payload (Dridex)", "value": "fd96c98bd017b060c7ffc400c0639630", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010934, "uuid": "d196781c-15a8-46da-97a2-eb365bb8954e", "comment": "Malware payload (Dridex)", "value": "1f6988df3ce18aee69cb53d950d387cf906957bdbabb8e9babf685c5a363d495", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010934, "uuid": "90fbbacd-500d-4cf9-a819-cfa0c35a635d", "comment": "Malware payload (Dridex)", "value": "a93d78e2761fc874c6ce02627acb911d3c3e707b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010934, "uuid": "fcd9da72-d521-40cb-b5b2-fd85c4e8a8c8", "comment": "Malware payload (Dridex)", "value": "4003f0c1f4251070a54b9e3ffdb37c1057180e53544e573f24239fe968ee7fe35d101f75424840097956df2108bdbdac", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010934, "uuid": "0848fb76-edc4-4607-88a9-a02a4584b03d", "value": "B924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010934, "uuid": "65bc0895-960b-409d-9d3d-c8e025b71d77", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010934, "uuid": "2b48a6f5-ea24-447d-9fc4-d80b2b45ef14", "value": "3072:t9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:t9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010934, "uuid": "02465714-1c1b-469e-9f3f-cecf54b3d1a2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010934, "uuid": "6b0e6fb0-66c6-4e1a-9c18-88bbb0ae3c33", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010934, "uuid": "1481c9c5-bf68-41ee-b1d3-42f0f373dc3f", "value": "1f6988df3ce18aee69cb53d950d387cf906957bdbabb8e9babf685c5a363d495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da157887-86fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615970181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970181, "uuid": "8f3a7664-d2ff-47c6-9afb-06ddc2a920c6", "comment": "Malware payload (RaccoonStealer)", "value": "299a5ba0f53d9265671ab64bb7d9a604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970181, "uuid": "07c5592b-903f-4c4e-ad84-20403628429a", "comment": "Malware payload (RaccoonStealer)", "value": "1f8a32bdd7940dbc6b452f475e11691fb8c794d7480ab7bea6b58d1bc3ba4bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970181, "uuid": "eb733e62-468f-404d-b6ea-f87aa42bcbec", "comment": "Malware payload (RaccoonStealer)", "value": "ca1a624bebdeb476eaa5fe633d78e3822f46d3d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970181, "uuid": "f7164b54-d05b-4af3-a13a-50d68081a2fd", "comment": "Malware payload (RaccoonStealer)", "value": "69e87a9ecd9e7880400cdc9c07a656a9a8b00b27292ec79fb1025705bf2a6731af40244db070fd2fd0f7676ac3c70b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970181, "uuid": "81052110-a4d5-45f9-b7d6-0d1085a17ae5", "value": "74C4D000B790D234F1B726F4857A82B8A92A7EB15F3440CF56E52AEA5B747F0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970181, "uuid": "8e156aa2-ff4c-4ef6-b805-46d4eb963d38", "value": "83ff340a453ef764a77566842c792976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970181, "uuid": "f8a30910-5be2-488c-bbab-78375abf8696", "value": "12288:qgPpsDtfhMs1MlS12lCQ/7vYOkRLcVOTU9BHnMt69l:qgxehMscnrHiLc2KHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615970181, "uuid": "f4fe4049-b274-4825-a918-c5bd39b2248c", "value": 546816, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615970181, "uuid": "098ac7f1-2944-45ea-a807-671643368d2d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970181, "uuid": "0461fa13-8c73-46d0-9e0c-8ec4494af132", "value": "299a5ba0f53d9265671ab64bb7d9a604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0198cfe-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004068, "uuid": "d32b5e95-9f79-4b71-ae5e-f13ebd66aab2", "comment": "Malware payload (Dridex)", "value": "e868a5edbff6213bc4e25fb8836768cb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004068, "uuid": "adde8001-84ff-4c1c-8a09-ca25e086b38a", "comment": "Malware payload (Dridex)", "value": "1ffc64f3cc5ce2f03d67335c13e0b000855145e0990d9b9379b44c2e68266855", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004068, "uuid": "7ddfc42c-3d82-48f3-b970-de8cf4cfd755", "comment": "Malware payload (Dridex)", "value": "ea60dec3179ec7208b3f7c48133b2a8c03931c05", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004068, "uuid": "7a3f5d62-7b77-4f9d-ba26-06b6da5f6e40", "comment": "Malware payload (Dridex)", "value": "2dc4cbe0719ee6551afefa7ec33d325d5daf46d0e0a2fa93ce33091cd6913074b79e93b1b74e831b1550e232e4f1dcdc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004068, "uuid": "ec582104-fe98-410d-92c1-b1f648f8dfaf", "value": "A924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004068, "uuid": "f3de428d-aed2-4f2d-8519-b1c93fdcc8c8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004068, "uuid": "c1b4e5fd-8a4f-4e64-aaa5-27402f568996", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004068, "uuid": "71127afc-83fa-4e32-a004-07b485f94495", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004068, "uuid": "577d8c0e-2ce3-4f96-9e87-01cf67c23ba3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004068, "uuid": "29b442c9-4c76-40b8-86f6-bbc88828d129", "value": "1ffc64f3cc5ce2f03d67335c13e0b000855145e0990d9b9379b44c2e68266855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1ffe5e-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004085, "uuid": "12bc3094-25d9-48c2-b0fc-1a2222b9dc99", "comment": "Malware payload (Dridex)", "value": "413bf1294538f229f249bc9c1cbe6ac6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004085, "uuid": "a6712023-50ee-43df-900d-18fd3dd1ee4a", "comment": "Malware payload (Dridex)", "value": "201646df0334cfcdc5c6c157bfa75ab59939abe481d51c283d12dfb707f41eaf", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004085, "uuid": "c535f362-5243-4b0f-b492-d76d1faed79e", "comment": "Malware payload (Dridex)", "value": "3c3153e4e018936d637b59b2f3b4593d47dbc79a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004085, "uuid": "fb67554c-9a72-4de4-a25f-6452b85dfd07", "comment": "Malware payload (Dridex)", "value": "5a47262998666546aca30dbd96513fb3072b2bb680199d82cd59f7b083ac3d68e9c3ad15870befa89dab4cfd9946e382", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004085, "uuid": "9c220d0e-45ac-491e-84b4-5a75158f2dd1", "value": "BC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004085, "uuid": "5dd01302-9093-48cf-98bd-1297af373f27", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004085, "uuid": "8f14d6ab-dd9d-43d5-83b3-78e159132e4e", "value": "3072:G9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:G9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004085, "uuid": "e605ab3e-b874-4122-a650-c59a206f19c2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004085, "uuid": "411ff549-e65b-4be0-b35c-9de6cdc9675a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004085, "uuid": "5ca15278-b7f4-4dd0-952a-2dc5d4c6eb90", "value": "201646df0334cfcdc5c6c157bfa75ab59939abe481d51c283d12dfb707f41eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69f9266-8721-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615986416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986416, "uuid": "cd8e068a-4323-4c93-9014-eac6b4a0b7fa", "comment": "Malware payload", "value": "78d26874043fbc858b9e6e6208ec7100", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986416, "uuid": "38742b4b-f042-43bb-b4ae-11c151f7af5f", "comment": "Malware payload", "value": "2053504ebc97addac8d6aec85e8dbf9b522078ad2544080984489fd314e4b4ca", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986416, "uuid": "de1e5417-545b-4099-9bf5-e9b53720128f", "comment": "Malware payload", "value": "716bc3681c5581490ec3e7583ae96dd85ae961a5", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986416, "uuid": "9729b179-3a57-4312-9de7-626a8ad2b360", "comment": "Malware payload", "value": "352d72d7697bbf0eab5434f7cfcd8ec7a54648fda63c9e1fc6b501f4432a5baa14974b04abffd006fa4189ca38e0d8a3", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986416, "uuid": "a17d5546-d23c-4d03-83fc-03d513f3ae36", "value": "7EF533D7E78CA1BFD8AD0B7235C7E2308D936445AE30A059389DDE00CBE5DA276B7158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986416, "uuid": "5e27ab77-3206-4676-8df8-160fe6e7b9b0", "value": "49152:/7uTZYJkh0UDA1/3RMnN8eNwCKW2/D4L3M5o3JAjZXtfXn6i+RWGu9IsOxdjk5:Du73AxefMW2kjMG3JAFXtv6i+RfuHGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615986416, "uuid": "9ffa546a-d86b-4e87-a59f-355e08ff5a85", "value": 3374749, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615986416, "uuid": "1095892a-2140-45cc-8ca1-e37f668bbde6", "value": "application/java-archive", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986416, "uuid": "916bca59-27ec-4125-b3e8-83f408c73ff5", "value": "DHL-TRACKING.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdbe288-875e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012496, "uuid": "895dd68c-831b-4fe8-aac3-b3e1c23deeb8", "comment": "Malware payload (Dridex)", "value": "34a8c41e76f0b335be737cfa11b1a763", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012496, "uuid": "10bdb334-9070-416e-9321-c3ae3a07b7c1", "comment": "Malware payload (Dridex)", "value": "2171b569229dae0a6e773cf14772c5719dbfbe6c72a27c1e6e417d7423aaa25b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012496, "uuid": "73c997e4-8d8c-4643-9197-f4263d851b20", "comment": "Malware payload (Dridex)", "value": "f2015cce00d6a4f560ceace3d78a176c11c0359c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012496, "uuid": "e557b30f-9007-4a94-8868-15d4b8846bd0", "comment": "Malware payload (Dridex)", "value": "617da9e7bdc15d337aa1342d44dc5c6ead1eee6571d3e5d4c2ed8f65091f3ab875fb1c3cefb3925e13618725b2e5e496", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012496, "uuid": "0d2206fc-ed6d-4212-b346-eba79b8c17e5", "value": "1E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012496, "uuid": "72ea87cb-4d62-4956-9fea-56a07865af1d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012496, "uuid": "58033b53-b3f1-400c-a0d4-dffd60743c04", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012496, "uuid": "954be10f-407c-4cfd-9fa2-daf7d97f8a14", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012496, "uuid": "fe2288db-815e-47c1-92d9-322404cb42e6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012496, "uuid": "3ee09a83-aeec-4b65-ae9d-19202fc9d9ce", "value": "2171b569229dae0a6e773cf14772c5719dbfbe6c72a27c1e6e417d7423aaa25b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b322776-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001778, "uuid": "8cf7c572-a5dd-48b9-bbb4-ad1b5f41fc24", "comment": "Malware payload (Dridex)", "value": "aa5f53a20d9fbbbd85d35c732e11b8cf", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001778, "uuid": "3ce48d9d-df6a-4eb1-872a-af6b66d721d4", "comment": "Malware payload (Dridex)", "value": "21a8ae49aba4438aac137741688b9684b0386cade6cb576bc6170d2197321775", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001778, "uuid": "1e35f09c-320f-4573-97c7-f1f77d6c64a1", "comment": "Malware payload (Dridex)", "value": "ac8ac760b8874609373cd308457fe0bf57faeab2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001778, "uuid": "b07d85e4-55ba-439b-96c5-24da07469512", "comment": "Malware payload (Dridex)", "value": "dd478fd6233dbe5be4492a657294f95cddfc65dda853fcbb537eddd13b6fec77fd4974d6d53aac6a3e2ac19b17e29770", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001778, "uuid": "c31a2ca1-0e05-4666-8457-4f4d247dcb99", "value": "E024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001778, "uuid": "0da7d1c5-4f25-4a86-a4ef-54b98cdb8fe8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001778, "uuid": "5259817c-1527-4e41-99fe-6a4bab8117ee", "value": "3072:H9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:H9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001778, "uuid": "ca47eb54-e8d1-44c9-b3c5-6ff33420b54b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001778, "uuid": "7ca12405-d445-42e4-911a-b7f010cc1828", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001778, "uuid": "aa03ab47-4196-46a9-9eaf-689eba5e596e", "value": "21a8ae49aba4438aac137741688b9684b0386cade6cb576bc6170d2197321775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647b9197-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004344, "uuid": "a783b3b3-4637-412c-8cb2-20d1bb77d7bc", "comment": "Malware payload (Dridex)", "value": "1f8acc4ed58012538fd91a6e38c99f3d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004344, "uuid": "7727114b-d2c4-4755-9129-d1f0ee706d36", "comment": "Malware payload (Dridex)", "value": "21c2f44ff4cd5ecbce4ecc002c582147f5bdcca0b920164ddc23576741cab1b8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004344, "uuid": "26533c2c-b295-4e3c-b32e-17d38036b319", "comment": "Malware payload (Dridex)", "value": "0965539cc50f504b96e104e542809c9c04fcd689", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004344, "uuid": "aeb26e3a-6495-41f0-a489-b0f6707cb2c6", "comment": "Malware payload (Dridex)", "value": "c8c061ddd0365337f7ed1bf0ffe9a8d255f555e9d0e2b9b877f1df795af83705e15dc1514729ec55b553bd6e5392a6b1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004344, "uuid": "e329e7cb-d4b2-4136-ae48-bd0e61a23344", "value": "CB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004344, "uuid": "4bf121be-f787-4909-b620-3f17e5af54de", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004344, "uuid": "3fec614a-64dc-4ea6-8f51-7a7d5583a46c", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004344, "uuid": "8efbefa3-f0ce-430d-b3e5-e659299597d6", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004344, "uuid": "564bcfc7-2e19-4807-a409-dde2fc56c7b7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004344, "uuid": "8b3760d8-7cb9-4820-9635-cf4d89b3fbe9", "value": "21c2f44ff4cd5ecbce4ecc002c582147f5bdcca0b920164ddc23576741cab1b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85562b1-86ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1615964085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964085, "uuid": "02fe0921-8541-43d8-bf18-93a046ff713d", "comment": "Malware payload (Mirai)", "value": "a99f97a214f39e7a3f3bec21e50654f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964085, "uuid": "ddb6cc69-2762-4437-abc5-2f0078b6f4f3", "comment": "Malware payload (Mirai)", "value": "224f2df0563584885aa637f71077ccce8bb4dab9d7e82dcb12dce92d4e0d704c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964085, "uuid": "9ad4b0ee-ea6e-4331-99ff-c880bdf72a75", "comment": "Malware payload (Mirai)", "value": "59f72ff2ec2002eeadbb5c1fd1dea7df593ce02a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964085, "uuid": "906941f7-6122-461f-88af-8a8484ffc382", "comment": "Malware payload (Mirai)", "value": "f8279fe2da9a302c727e9206f0285fd63987797a1a5e06f3160124f5c42f4ec6e3b67e62dd45c0b41167a448ebc33be0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964085, "uuid": "7fe15f9a-f54c-4457-9037-e6e7cc8c676b", "value": "EB43F886B9828B11C5D4137EFE1E118E3313676CF2DE72139E15AF2167CB96F0A2B815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964085, "uuid": "c324baaa-ef9d-424d-8264-58b5321ca86c", "value": "1536:SMnDyeX+z6YYN33Vn+/ZotVNf3+qMSiHwZIQZO:pXXYY9d+/Z5wZIQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615964085, "uuid": "5682c2cb-934d-4b57-b400-78ade627c785", "value": 58776, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615964085, "uuid": "395f2841-8325-482e-8b11-6d0ebe78867d", "value": "application/x-executable", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964085, "uuid": "94038236-13cd-4c2d-9345-05743a01c696", "value": "SecuriteInfo.com.Linux.Mirai.5508.9603.26895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad5da5e-875d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011951, "uuid": "7256e502-8e80-4ab6-b4bc-22328fdee7dc", "comment": "Malware payload (Dridex)", "value": "1159af1460f2b50b707e9f6d6ed82da2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011951, "uuid": "21a5ae77-dac1-4915-9cc2-ae23747dd06b", "comment": "Malware payload (Dridex)", "value": "22afd96c9443b74ec7428571d56867ac38d92ec121af0184c1f0ae56af5d6aec", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011951, "uuid": "251ecf0a-bc71-4f52-96cc-703dd2c41928", "comment": "Malware payload (Dridex)", "value": "1994e6d2dd8ccd62abd13611d9cf18a11f063b2a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011951, "uuid": "165267dc-e4a2-43e4-96b4-7d8e6a32fe9d", "comment": "Malware payload (Dridex)", "value": "49d98246cdb9d9b376e4ff01a5ffdd846dd538883a2482626673940c99507e25db8f6818226d329d4edb8ff937a0fbf2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011951, "uuid": "a8f3e88c-0b5f-41be-85d7-f2f55127f2b0", "value": "1924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011951, "uuid": "fa7cf34a-514c-438f-9d97-28ed9798d883", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011951, "uuid": "cbaa0268-1198-4dc2-bc45-03d685b1ab4d", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011951, "uuid": "50b3733c-4372-4fb8-8e72-db7d9634a56d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011951, "uuid": "a81721e5-0248-44ed-8298-a4b61ff2b3e5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011951, "uuid": "4c5def72-38de-469f-90f2-ad907f96d742", "value": "22afd96c9443b74ec7428571d56867ac38d92ec121af0184c1f0ae56af5d6aec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3111859-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003670, "uuid": "80db9e6d-abcb-4629-8489-bc12dd82b8a2", "comment": "Malware payload (Dridex)", "value": "48bc656689ff3e73cf5e5212d2da05b5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003670, "uuid": "9f108747-c83e-404c-9d48-f2fe8c791862", "comment": "Malware payload (Dridex)", "value": "23386226a08330b0b311c9413ff256eecb9a3dcc7f32379a9d7606a347292d1b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003670, "uuid": "5b69ef2d-cb48-4c80-bfe2-afd54b7323a7", "comment": "Malware payload (Dridex)", "value": "3288cce4313b486eb547721cb48f1b4ee8b0c9d1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003670, "uuid": "02b60acf-14b5-4666-b5fb-3e82aafb1510", "comment": "Malware payload (Dridex)", "value": "4677c3c988d40f741075d4829f7aa0a7c800ea0764d25d67d9ca6d8f8dca93abe6b6be20ac8428b1476465b2792d8876", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003670, "uuid": "a5ecbddd-5595-443d-8776-05e397a7c708", "value": "AF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003670, "uuid": "3472617c-3e9d-40a2-83c1-1e2cf7e4c2f5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003670, "uuid": "2cadf9c1-adb7-4c8d-b5b0-6e8598267fce", "value": "3072:69Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:69Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003670, "uuid": "61395b35-3a75-4690-9581-aeff8aa95545", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003670, "uuid": "0d87ad5f-9e1d-49e3-a048-85399401f645", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003670, "uuid": "67f51c64-c73d-40e5-a391-e3ea182bd23b", "value": "23386226a08330b0b311c9413ff256eecb9a3dcc7f32379a9d7606a347292d1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d80b54-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615969401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969401, "uuid": "0316d2bb-e485-4bae-a54e-8091372fc0b0", "comment": "Malware payload (RaccoonStealer)", "value": "d4827f2bb4c0446d1bba5df00c2436b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969401, "uuid": "e69b0c92-be31-41ac-8bfc-142a3045e969", "comment": "Malware payload (RaccoonStealer)", "value": "235e42b187151383ebb91cb85af8500f19e18906bf57917fcf9e0da7004c86ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969401, "uuid": "801e22ed-e145-469f-bdce-840111705c62", "comment": "Malware payload (RaccoonStealer)", "value": "69db7a9dd71235671819472bf2d55bb3eeaf11ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969401, "uuid": "c169d726-8986-4dc1-8a28-3f49657df250", "comment": "Malware payload (RaccoonStealer)", "value": "3c03a07e42abe44eb88c5377a1a26aaae2ea69a588b8feb722754999e1ea3e616a6993d20edd53bae54945d93834baeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969401, "uuid": "27127cfb-d1e2-4b21-9932-bcea8158bdc8", "value": "CFB412718E40C8AFD5A76B308F26E7630A6569161FB1203FCD13CE6491391DD9EE12BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969401, "uuid": "f30fdbfe-6c1d-4821-98f1-12c04f49e772", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969401, "uuid": "67a7279e-077f-481d-98c8-9faf5b0be3e1", "value": "12288:abmDTkUymtqTNbr2piRpjhV5gJtO+PbBJgSIg:aaDTMmtg1rBQ4+PcSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969401, "uuid": "dafb73f5-f6d2-46d9-bf87-6845ed8c35da", "value": 521216, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969401, "uuid": "d0a39b35-0aa8-4bc6-814f-c8f714fba078", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969401, "uuid": "e38aff5e-d52d-48a6-95a6-4e96189c8711", "value": "d4827f2bb4c0446d1bba5df00c2436b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771c95e7-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004375, "uuid": "53caa249-9dfe-4784-b197-799eb04bbddb", "comment": "Malware payload (Dridex)", "value": "abe898f30efb7f98fab74ee0f4b103d9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004375, "uuid": "fbf67782-ede6-48ab-9b9e-7c9684a4db94", "comment": "Malware payload (Dridex)", "value": "2371f7c3a5fb32bbe4f8c3420063a894c3143e739b2fd992efbd9db45a63d582", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004375, "uuid": "c2f13279-25bc-48e6-b726-5befba80b7a8", "comment": "Malware payload (Dridex)", "value": "5827fe93846d73034d54f022186f9425accd98bf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004375, "uuid": "19fb76e1-aa53-43a4-b88b-0c8a1886efe7", "comment": "Malware payload (Dridex)", "value": "32d12d52409df5b85f6a456672ccd49f107e93cc57768ff89488e45939e0d1bdeff55eb8a401166e7a8c6f1a0a19f445", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004375, "uuid": "0ee9a459-3045-4158-91c8-c72903348e34", "value": "B424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004375, "uuid": "3bd37361-8264-4a94-9895-2022dcea4000", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004375, "uuid": "cbff5862-7def-45c4-a1ee-9cedba55d030", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004375, "uuid": "61acd9c6-06f5-405d-873d-a6c43e845a6e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004375, "uuid": "193c4313-5ece-4b48-9b83-8ba698381e6a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004375, "uuid": "717eaaaf-fb1f-4c86-91a9-7c03af06b26b", "value": "2371f7c3a5fb32bbe4f8c3420063a894c3143e739b2fd992efbd9db45a63d582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96da901-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "353d8d9c-25be-401b-872c-7c45a3f8d069", "comment": "Malware payload (Dridex)", "value": "ec8c23b86876124e55beaa16dcd6b25b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "c9b49564-9821-4bfc-873d-a7a41e08e8d7", "comment": "Malware payload (Dridex)", "value": "23daad9313cedfcdaefb47b82d937083b3a4f07d6a8c7ed478988bd5d2fc1ed2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "56655ac4-fdd2-4e0a-82f7-d7ce4d2e4aa1", "comment": "Malware payload (Dridex)", "value": "c0293bccdc43cad7fcaa291aa29fd00bff2ba00e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "4b1249e7-be1a-4594-85c8-dc926ca5eab3", "comment": "Malware payload (Dridex)", "value": "8de7d2c49e7b56d7878e4f7036a4912b99373cf8ca4f9a2aae03ed18b25df5eb64752e40984b8f023b2830b3ec48da9a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "ddacaaca-aced-46ee-b0ed-72667ba3bebc", "value": "C124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "341942db-edc3-4d61-89b1-347478fd8693", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "a4ea8d0b-f9ba-40a7-adfb-7c9ba51fcced", "value": "3072:Z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004084, "uuid": "b07a9a88-72fe-4a33-8afc-d22e375ea85b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004084, "uuid": "644847ba-5d58-4b35-8bab-26bf60dabe47", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "0594a64c-bd0c-44a1-b97e-7bb075d057fe", "value": "23daad9313cedfcdaefb47b82d937083b3a4f07d6a8c7ed478988bd5d2fc1ed2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b992ffcf-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615968409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968409, "uuid": "3336568e-a397-4e46-b2da-a986e8b5ebb6", "comment": "Malware payload (Loki)", "value": "c991e29ab532da3dd98d0a20849b178d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968409, "uuid": "45d87dd3-fed6-4798-9579-9c4b551bfdec", "comment": "Malware payload (Loki)", "value": "2445069618da1fdf45a88f372d379387380fdf5ae5368ab6e2fe9c890f9c337c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968409, "uuid": "6af872cf-3967-4d46-9ab2-d754f92702b1", "comment": "Malware payload (Loki)", "value": "55c64943eaf9b54fb5aa6cfa3fe5f6c2375b277d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968409, "uuid": "182bfce3-393d-4def-a175-172ad2eed6c0", "comment": "Malware payload (Loki)", "value": "b752f28b5424b70fa1040d93f390fe3343e92fb8f10298615b7379740b49b0f72d16a262a6e1eec4059f94f1007a2885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968409, "uuid": "1cc59562-4234-4c18-9917-528cb0e9c099", "value": "C2E4BF027288BDD5E42316B25CBFC53011AAAD9D5175C53E3686BA2F01F335620BBB7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968409, "uuid": "d6b58c19-457f-40cf-b97c-90535aed1a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968409, "uuid": "a4b89528-9f52-48c9-8a74-019eb05bb3c3", "value": "12288:SJS7L0F1BCEgUSrqs4biYl3pkkTT7+HdMv71F91kdd:SJSf8FgZi13pZT3cw5H6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968409, "uuid": "ea844e25-0d8f-4893-852a-191e4ed56e62", "value": 716800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968409, "uuid": "9785c8f8-a980-4bab-9e75-00f5a7a8d85a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968409, "uuid": "429ec133-09e5-4b09-8d79-2112cfc64908", "value": "c991e29ab532da3dd98d0a20849b178d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20c811c-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001870, "uuid": "2267f4e8-0ba6-4ef2-b991-a7ad2f1e97db", "comment": "Malware payload (Dridex)", "value": "47515e918d1e98cb5b66fe11c6918fb5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001870, "uuid": "1a4b2e33-f936-4a8d-b53b-1204a66d0dd8", "comment": "Malware payload (Dridex)", "value": "247edf476531b083effe71d7ebc88c27d354d1c60d9f86d1b44cfee46f9c7dd7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001870, "uuid": "d36cae8b-fccf-4ad9-a429-97b560de2be1", "comment": "Malware payload (Dridex)", "value": "656b9269c20d6780029b4ff4225929df9b3a6999", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001870, "uuid": "7196d105-aa81-4ce9-8bbb-9920a8876fd5", "comment": "Malware payload (Dridex)", "value": "fe3d491b9673631a9390c804a7a970321f4c509c4928690942cb43849d8d8185f68f17d1f882cb5422e21ddc721d3bb5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001870, "uuid": "14545261-7bc9-4eb5-b027-6fd0484b9531", "value": "D624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001870, "uuid": "fbaeca63-6035-49d2-a1ce-3ce8ed5e6d53", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001870, "uuid": "38b2843a-06f5-4540-b260-bbe0381e8f57", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001870, "uuid": "aadafe8c-c633-4f49-a2f4-218d12717881", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001870, "uuid": "4b207bc5-0bb1-4556-9b17-2510b8714fd4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001870, "uuid": "d1afaffb-810e-41b1-8920-f55a4759283f", "value": "247edf476531b083effe71d7ebc88c27d354d1c60d9f86d1b44cfee46f9c7dd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f882a25-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011073, "uuid": "b00081cb-2892-4e72-bc1b-ec374d529c68", "comment": "Malware payload (Dridex)", "value": "80e522698e40c86d48f839bd8f50af08", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011073, "uuid": "ddfd56e8-1258-420a-86a4-094188726caf", "comment": "Malware payload (Dridex)", "value": "2480e42f141579d9e975c5669c3bc08e5f76e0aa1c439528c7ed15a9cf5865c3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011073, "uuid": "85cba5e6-b062-4c03-b22a-f523f64f1036", "comment": "Malware payload (Dridex)", "value": "4f87c3ff591c88c81fdb4d1c28f4cd90728fd75e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011073, "uuid": "b326c8d8-fcc8-48a2-a3bf-d1ca7dfc10bc", "comment": "Malware payload (Dridex)", "value": "1ba2ad0f6602574a286df43eeb691b64616626cf893ccb9889f5c0a751a8201c3ef545b6ec4cfb89ab321e08b6ab5196", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011073, "uuid": "968196d2-860d-4d02-be0f-fc0031a56be0", "value": "9214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011073, "uuid": "e15b00a2-a8fd-47a3-83b4-c12c271ad09d", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011073, "uuid": "43fdb605-50b0-4934-a494-18a2dcb27933", "value": "3072:11i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Xi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011073, "uuid": "81b16cc2-8d80-44be-bf09-d34355017184", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011073, "uuid": "6f210ebb-add2-4178-a13c-605d7a43e0e5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011073, "uuid": "18eeab53-d61e-48ae-a16d-874e266d8730", "value": "2480e42f141579d9e975c5669c3bc08e5f76e0aa1c439528c7ed15a9cf5865c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4081fe2-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013175, "uuid": "c23ed9bb-b601-4bf4-b0f0-f08e5d9332cf", "comment": "Malware payload (Dridex)", "value": "071feba9f29dcfdb73b28ead3ff73ace", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013175, "uuid": "53e44747-c512-4eb1-a363-e3b5d5b988a4", "comment": "Malware payload (Dridex)", "value": "248977d8b682563c934e73912a1047498fda21a76ff1f3448cc8805df090a0f6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013175, "uuid": "54b74cc3-36c0-4b6c-bce0-349753a286f3", "comment": "Malware payload (Dridex)", "value": "edd7765ebddce2036790531f0537600dedeb700a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013175, "uuid": "47d1b7a0-b9cc-45d5-b592-10d26d867aa0", "comment": "Malware payload (Dridex)", "value": "1326b8d28f691016dfa04a70fe91e0c37f86c02ab02131e26bc7d36ed763ba098f744a0cb1b080a95e893f99c438a27f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013175, "uuid": "8e293a00-76c1-4f0b-bb50-83d0e28f68fb", "value": "E224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013175, "uuid": "9522f070-e1be-4c4d-a4f8-5451719edb0f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013175, "uuid": "64afa16a-6f94-4663-83c6-ad08d91e853c", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013175, "uuid": "91e27c1b-bbb7-4532-a69f-83a5707feed1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013175, "uuid": "30e44c5f-cbd3-4a83-9c6d-91700ef9071c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013175, "uuid": "2c458d51-e133-4c07-910f-ee2a90217432", "value": "248977d8b682563c934e73912a1047498fda21a76ff1f3448cc8805df090a0f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffa022d-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008980, "uuid": "2b464618-dc3a-490f-9f0a-03d334a47815", "comment": "Malware payload (Dridex)", "value": "df98ddaec7efdca54ccabe10f6afe0cd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008980, "uuid": "eaa4a7de-508d-4764-867f-1196c269d57a", "comment": "Malware payload (Dridex)", "value": "2495910ba3b59494cdfe942d148dad87fce97f190d0c6f720f00118c83b93125", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008980, "uuid": "8d8d7764-50c3-4bdf-a41e-c534acb1a61f", "comment": "Malware payload (Dridex)", "value": "179694ff3c0f69dad2a2d63f35a928a16e67ae55", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008980, "uuid": "ab5b8849-9627-4b0a-beb2-a1bacc77b2e2", "comment": "Malware payload (Dridex)", "value": "3a9318bb5ad994a0ee8cb1319cad2ab0f668d1cf983c79181f3bc52e93238537f647d23a335caf748a8296e4b4b10852", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008980, "uuid": "5f88803a-1d4a-4046-aed9-641548c391e2", "value": "7124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008980, "uuid": "d28c2b16-4c7e-4e06-b502-a8f17103a439", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008980, "uuid": "293850d8-494a-4284-9bfc-0c83d93c44ac", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008980, "uuid": "51830749-7268-46c6-a88b-a8092e6387fa", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008980, "uuid": "ae7a60b5-41e3-4eee-a559-78985c8d922b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008980, "uuid": "f2e50ba6-6414-4390-a619-ddd139adef3b", "value": "2495910ba3b59494cdfe942d148dad87fce97f190d0c6f720f00118c83b93125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9885ccb-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "b6696c2d-377d-4f1a-947f-4ca3eaf77153", "comment": "Malware payload (Dridex)", "value": "cc8fcceef57f640797b4cf976ef11f99", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "98e1564e-b5be-4401-80cb-6e4e4a0aebbc", "comment": "Malware payload (Dridex)", "value": "24a79064e608b8d6cf9e26c1067cb20ad11786b1850748e70a4b61795f304f8c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "c26334eb-43d9-4eb1-b3e3-08e7989bbf65", "comment": "Malware payload (Dridex)", "value": "a04571f977e320365700a21ee4c11eec836f4863", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "bc303648-ef46-4b9c-977f-cd581bc3f583", "comment": "Malware payload (Dridex)", "value": "b78e232c6f2fc1623e6b39ce34d65e168e2847174d38ddd3f362d86e7d7411a0600a253a037c176a022061d38200851c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "fa497d89-6c58-4249-9c2d-b9ef97019098", "value": "1A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "81ccc72d-2f9d-425f-b67a-822d23337e3f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "cb56b241-2374-4a4c-bfb1-08bb04f773f2", "value": "3072:x9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:x9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004084, "uuid": "6d6a5b9a-16dd-4e23-a75c-1c529f65cbc1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004084, "uuid": "70b07890-03fd-4a06-b176-aff25e7a4b77", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "084d5946-4046-4bc7-82c1-0c0cb74a7c97", "value": "24a79064e608b8d6cf9e26c1067cb20ad11786b1850748e70a4b61795f304f8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc71ade-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004707, "uuid": "2885be3a-cef3-4674-9a60-af16994f3404", "comment": "Malware payload (Dridex)", "value": "72c64f0c35e9b47767af171e68fb2394", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004707, "uuid": "91f252aa-1f36-44d4-9b3c-01860d83034d", "comment": "Malware payload (Dridex)", "value": "24bd43d0cafe2ba16d275448a221debf5055c7b5f49732b96dbd3ff1d9d3fd45", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004707, "uuid": "0f6e07c0-61e5-47c9-8c2e-5775b3d2c13b", "comment": "Malware payload (Dridex)", "value": "691ed7e72dbc4a64ccc6ca83856f7c886be8ed62", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004707, "uuid": "bff372bb-f051-41b9-ab15-4085569131b6", "comment": "Malware payload (Dridex)", "value": "5e78731c3dddf9f5974c512bd20e18f8c982264b3b04d33449a955d1b20933f2e7219357a8531ae744c7bda48df1fd50", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004707, "uuid": "48650281-f39f-43a1-afd5-a4d76e25f6a0", "value": "B324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004707, "uuid": "0037eb8a-9ca1-4f00-b140-e38d67e8130b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004707, "uuid": "076e32e9-f6b7-4307-8b68-24a7502249a3", "value": "3072:z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004707, "uuid": "7b131f8a-ce8a-47b1-a5d7-82091d4a8d71", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004707, "uuid": "c2006d86-329f-401c-9945-7ad609875966", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004707, "uuid": "14333f8c-f9d7-4834-838b-d3dd5b3cec71", "value": "24bd43d0cafe2ba16d275448a221debf5055c7b5f49732b96dbd3ff1d9d3fd45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea560e7-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001730, "uuid": "28bc90d5-4494-448a-b27a-c47ed41cd888", "comment": "Malware payload (Dridex)", "value": "34c1756436dfa79e5e363057304585c6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001730, "uuid": "a4210c64-8471-4476-8896-4256c72bb730", "comment": "Malware payload (Dridex)", "value": "2505c12651e60193d69b682031d4851f9a030d4748fcf52eae590cd3e3314291", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001730, "uuid": "90b35ef2-96d2-4862-b6f3-dccc85bf0bce", "comment": "Malware payload (Dridex)", "value": "e01baa0414bb98156e5dd15cf062ba6da8dc47b7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001730, "uuid": "d41169f4-7513-4fb6-a83c-137bbadd2996", "comment": "Malware payload (Dridex)", "value": "2bd111c7965f473490803e91d8cf3ff2aa9787c47993fc74ef2a7e7bf103c94a1a71b5c238ee0ddee819c000d6ccdfa7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001730, "uuid": "ceed58df-7af8-441e-a76f-fcdf2479f0b4", "value": "5B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001730, "uuid": "d23f0bbc-569a-4589-bd7b-a173dbf8269c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001730, "uuid": "01600a9b-8320-439e-b0ee-7ab59e0d9d56", "value": "3072:w9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:w9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001730, "uuid": "10a0d985-28fc-411c-a6e6-b6b867e76e33", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001730, "uuid": "9d046a59-8f7c-4d06-ba26-2806de258bbd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001730, "uuid": "96e0bd46-9ad1-4b42-844e-86e59246b5b4", "value": "2505c12651e60193d69b682031d4851f9a030d4748fcf52eae590cd3e3314291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef849a7c-8702-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615973224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973224, "uuid": "d52b9187-80ee-4ad4-a502-d0b316867b1f", "comment": "Malware payload (Dridex)", "value": "ba4190758cf1398510fb0c6ee84a6d74", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973224, "uuid": "8b0aa958-8e02-4a2f-98ad-cb505f0c4589", "comment": "Malware payload (Dridex)", "value": "2521bcde1e117c7fcbffca0c6b7368050afcae203adf8ed90a0c8155730a6838", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973224, "uuid": "1128eb98-b8ef-4776-9c8c-fab774f64099", "comment": "Malware payload (Dridex)", "value": "6209e458a5f9b1d4dd93b77dc98022b3fee05194", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973224, "uuid": "b6ea2f9d-e621-4c5d-a519-cae11ab46972", "comment": "Malware payload (Dridex)", "value": "28bdd695c6968371cba7e5ff23123386c21894ed2155c4a062ddf7fcdcf26912113609e82f4d1b645b984bda213f3227", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973224, "uuid": "6b4629ef-0b47-46f2-b0e8-da6114880d59", "value": "CE14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973224, "uuid": "ba12bdef-b308-4707-a923-53a649f5718b", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973224, "uuid": "8e631db6-92f8-4cf3-bcad-f17625a6bb2f", "value": "3072:o1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ui78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615973224, "uuid": "55815a6c-26db-4059-b06f-e33e90fb5b85", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615973224, "uuid": "cdb65ded-b056-41b1-bf4c-4fa989725b03", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973224, "uuid": "5485e1dd-3bdb-4158-81f0-a0ef0a42b56f", "value": "2521bcde1e117c7fcbffca0c6b7368050afcae203adf8ed90a0c8155730a6838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95718f0d-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615965771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965771, "uuid": "9a251bf4-02d2-46e8-bfca-9e430c316095", "comment": "Malware payload (RedLineStealer)", "value": "de53d7c7d225c7274442a8c6cf93bbc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965771, "uuid": "ce506289-b09a-4e91-afdd-64db6029c9f8", "comment": "Malware payload (RedLineStealer)", "value": "254f8a160343897dc3e748af2f4c2164455afe3daaa75654c0a7e13483a43f0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965771, "uuid": "82eff29c-b8cf-4ffe-81a8-970120e50c75", "comment": "Malware payload (RedLineStealer)", "value": "33cd0c7fa803920e2fe35f4b03e7d07d4e2b78bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965771, "uuid": "48794d92-e438-482a-84ca-90f01a336b14", "comment": "Malware payload (RedLineStealer)", "value": "df0148c29b6c5d0f4b6b67959aae59a1169cf264579d3e61a13778649a53713756a363b0343916393f9677e9a669359a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965771, "uuid": "4a5ce1c7-c8b7-4eb3-a506-109454666198", "value": "B454E00076D1C833D0511572482AC2F14A79FCB59F259ACB7BC83E6E9F262D28B36397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965771, "uuid": "17b04c53-b93a-4ebf-a2d8-cec51dc2b006", "value": "2000cfccfe115498ef3a31eed7bda18c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965771, "uuid": "b873e80a-efea-4c93-833c-0a6db3cf3c86", "value": "6144:VfRdY/ROC5y339LR1JX7vW8gMYp4JEkOVEl4:BYJG3pxW9cwEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965771, "uuid": "1c51f688-33c2-4206-913c-4a6d5def1d10", "value": 292864, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965771, "uuid": "a3a4568b-1ec6-497a-ac27-737690cd4dc0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965771, "uuid": "f0cf23ed-96e1-498b-a227-66eca45c99e6", "value": "de53d7c7d225c7274442a8c6cf93bbc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b34cda5-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "a5e59200-4679-41ff-96c5-e12959507932", "comment": "Malware payload (Dridex)", "value": "950f617e5c1a973a8ce5e63072e5cec5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "a7fd3814-aba1-4862-a084-e8bf193d2771", "comment": "Malware payload (Dridex)", "value": "2573d0c6c23aa6fd89c6e9ec31232250e962026912768fb2e634baa3cea74588", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "1de7e29b-ea9a-4273-b874-1217857b3707", "comment": "Malware payload (Dridex)", "value": "7c0e52b822336bbfc0b29ae82ef7baac3c6ab8e1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "fc829c59-35ec-4b99-94ff-8c4935644b3d", "comment": "Malware payload (Dridex)", "value": "ac1e6d7083df5f8349dfdae5bb59d43cce068fa9dbe97ce25eab4336c4ef376d261b6857022044ca83a8572b1e196c33", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "27bf079e-3b74-457f-bd94-c16a5ee41384", "value": "8F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "aff07e76-8a01-475c-b8b1-2029983e3942", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "dd8e8ea5-4672-4a43-9b98-65b0f32cd4c1", "value": "3072:S9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:S9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003845, "uuid": "a6dc9aea-2f91-47ea-99fc-49d68cb86497", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003845, "uuid": "43df08be-97ae-4ded-bd38-14ca9d7a8c41", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "b2599baa-0dd5-447a-8439-5ffc1f4997d9", "value": "2573d0c6c23aa6fd89c6e9ec31232250e962026912768fb2e634baa3cea74588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54568ae-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615965851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965851, "uuid": "740ab6cd-366a-4b48-a067-f2b358d5cf9e", "comment": "Malware payload (Gozi)", "value": "26b4ef213b1a2c01460565cbbf062d80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965851, "uuid": "fde09e7c-3ae3-4f6d-94f7-604d081f6347", "comment": "Malware payload (Gozi)", "value": "25cbd55db64fcaf70d749d33dfd4fa9e71384e6ebd9a863a02eb76ec9aedd563", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965851, "uuid": "64554b1e-2c7d-481d-8ee2-a4836489fcc2", "comment": "Malware payload (Gozi)", "value": "097ecaebd9aca6fba80bc622cb32b6cfb7ad8f3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965851, "uuid": "939fd6c9-0dcd-4178-987a-13068de04a2d", "comment": "Malware payload (Gozi)", "value": "f6f99b348bfab1a9541611f2dbb1267b5827a8205a010c6f71da4789a196e86813d3f054c6a444e3bebda46d027e289d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965851, "uuid": "39f4882f-e644-41cd-bbeb-cc0cff9dd034", "value": "19A4D021B5C282B2C133823A4878EA65DF78BC710B3858CB379D12774F796D1563BE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965851, "uuid": "153baef3-91a5-4223-ab79-dc685582ec83", "value": "25f2108c27a9983e93c5c39e2411e7ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965851, "uuid": "c854f059-618f-41d8-a888-863fdd1e8f51", "value": "6144:qvBZP3Kj73uoS2azm/TE35zCOcNKnu6Caa9aZE0Ndasyv4KgvRw/vP983wiYA:qD3ArBKuM1CRuEvmNdbyv4u/X9awih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965851, "uuid": "37b68249-1a8a-40e9-9349-cb8126786f30", "value": 466432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965851, "uuid": "72dfcf88-7c99-4a44-855b-e5ad21a4bb85", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965851, "uuid": "5e294821-7669-4bd8-834b-31f3cf98a7f3", "value": "26b4ef213b1a2c01460565cbbf062d80.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c24683b-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1615969218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969218, "uuid": "34c75540-95b4-42e7-ab99-e5b484180716", "comment": "Malware payload (FickerStealer)", "value": "8c56ecce67e5e43e872863f41fe03eab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969218, "uuid": "88d1e7af-ff11-457e-8b3f-8bd8fc3f5162", "comment": "Malware payload (FickerStealer)", "value": "25eb1831bf580a45f9464bcf50ef2b3d35021f6eb5e42874b2dd8fd8544cf853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969218, "uuid": "4a2883d6-5754-4f7d-852b-ce57aff61886", "comment": "Malware payload (FickerStealer)", "value": "ad4785bf01141163053f421d15fe76a460836c9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969218, "uuid": "0d2b9fc6-698c-4f46-a8ba-6176c34c3589", "comment": "Malware payload (FickerStealer)", "value": "c1f28616a4b02313462744861bceaa611857c87f6d0453aaef76a1ad0d132b6e6a78d4f9f318b689e78b726b36832444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969218, "uuid": "c1471d3d-54dd-437f-9d79-da728a03f801", "value": "C3E423263374CB36CAB61BB18856907057B078344AA7E33B6F1231BE7E917C64391B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969218, "uuid": "476a992b-620c-4fc4-a2ca-dfd0340a10b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969218, "uuid": "af9adc4e-a2e0-4bf5-bbf6-3be90cc16632", "value": "12288:XNECjrWAEX1Cfy0BTutPKgUlPB8+OuIwYs84X7IY4sCjlbg4xWvVf:XNNjryCf1BTuIXlPB8+ODwYG7IY4sCjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969218, "uuid": "867022d5-dda8-4eb2-93cb-e3feaf662830", "value": 683520, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969218, "uuid": "2e66a1a4-f6c6-4651-be6d-bc9aee797a38", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969218, "uuid": "b73fde9e-15a1-46ca-b79d-35741c3b8b47", "value": "8c56ecce67e5e43e872863f41fe03eab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c964199a-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "c4ed70af-0447-48ff-a1e2-f405ed9039e1", "comment": "Malware payload (Dridex)", "value": "14144a315614760ba6c45e4641864c34", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "998bc14d-8aaa-4187-abee-8bca4e9ab74c", "comment": "Malware payload (Dridex)", "value": "260a96e305afa07f9f07da4a2dc0987ba4e06ce7ffa0dcbd9d49042a2d221e38", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "37838d06-932c-4444-bfb3-a8765027bd07", "comment": "Malware payload (Dridex)", "value": "4d247031ada3a7ef7565e06ad3446b444ca1ed60", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "c08d707e-22fa-4ccc-89f2-4c671c33fff1", "comment": "Malware payload (Dridex)", "value": "76ff5cc42b1da1210c301b5decad2e034c96e7acb6982cdb1c538cfc4f3e5cfd13c189dbe0d85ccb540f465c69b0a1bb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "d53fbe1d-5958-4321-892e-557d9a2aa726", "value": "D824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "8ada835e-456f-43e0-bc4f-251ad973d3a3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "72ee0251-16ce-4d4e-887c-4e47c1b6b5d5", "value": "3072:p9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:p9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004084, "uuid": "a6fccc26-9f6f-4d3f-ba1f-185a44809e55", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004084, "uuid": "158984a4-9a9c-4d79-bfc8-a895e3173910", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "23353b70-76f2-40da-9c4a-b05681e28b23", "value": "260a96e305afa07f9f07da4a2dc0987ba4e06ce7ffa0dcbd9d49042a2d221e38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988faf55-871b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615983815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615983815, "uuid": "03f89139-4954-4ac7-8760-90feea208ca3", "comment": "Malware payload (Dridex)", "value": "d91ef43f453962c785c2d5add16dbe49", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615983815, "uuid": "b6be4edc-8fca-4298-8617-0c4a936bb38d", "comment": "Malware payload (Dridex)", "value": "270656b59e44c758d89558917fc8af9ca8ac34f7008259c99256d33bb9f3f9ab", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615983815, "uuid": "8e4a985f-0044-4ca3-91cd-b629d5e08a1c", "comment": "Malware payload (Dridex)", "value": "61ad0fc7091bc5f7c66eca931a22203a8ca0e6fc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615983815, "uuid": "3bfc20c1-4ed3-4a12-b3c1-8fb66f389a27", "comment": "Malware payload (Dridex)", "value": "2e51df0e99525e0398980fd3ae571ba24596f5632e4db04eea42b813e365306d6c9dae1709332396e4c04f64c8a7a828", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615983815, "uuid": "bff6f7b2-5745-43d2-a458-07d1a0fada61", "value": "7914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615983815, "uuid": "44303edd-2c4c-41cf-b9fc-d05cdb51d57f", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615983815, "uuid": "bf1a818b-01ce-47ef-84d6-9d12c9ac2060", "value": "3072:V1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:3i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615983815, "uuid": "a33570f2-8a0c-44cb-b747-bd5ede3eca59", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615983815, "uuid": "d577feba-b3a2-441d-b55d-3cc1b699884c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615983815, "uuid": "eb3cf9fc-bd01-409c-ab89-6c9998f5f569", "value": "270656b59e44c758d89558917fc8af9ca8ac34f7008259c99256d33bb9f3f9ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5509953d-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615962227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962227, "uuid": "7545f54e-c1a7-49db-a317-3056cff48da1", "comment": "Malware payload (Formbook)", "value": "e8fc0f41328472f0ac61048b0beae962", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962227, "uuid": "09a648f9-9c5c-4369-8932-3b3ee538ea53", "comment": "Malware payload (Formbook)", "value": "27778e5260407e24f6d240249f7c0d349ad2d86cf53a30139240586202b30815", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962227, "uuid": "36fe4455-7842-4ff4-a3a9-0d2294c99c8b", "comment": "Malware payload (Formbook)", "value": "1ba35ebdadc2631b3e9cdfeafef6f5064f00673a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962227, "uuid": "16e6dd8f-30f9-4d3e-ab17-63ec770b900b", "comment": "Malware payload (Formbook)", "value": "1eba525dbceefc4a01a30a759a7e310e89768e9ed3d402cc91d74cd103ca6e0f99b33511a32727101a555412fa7621d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962227, "uuid": "a1718a34-6380-486e-8fba-c56938590f65", "value": "B6A53352E8D2CF63CB5D98F198A74D9B293B6C624680C813371DF788E13BE36744696C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962227, "uuid": "218bb5e6-4765-4ccd-ad3e-31ac6cba0126", "value": "49152:6Oie6YxgQnLl6G868o/IsZcfO/RojclDAHby6LKCauFxFljs:ke6Yxg568wIAcfO/RoAlD+2CaUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962227, "uuid": "c041494f-7445-4269-b583-dc95d4cf7f47", "value": 2258944, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962227, "uuid": "108b8b36-87dc-431d-a73d-de1f15ee560f", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962227, "uuid": "17b1aea8-e779-4c97-9464-a293df317502", "value": "27759 SG p1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d13fba3-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003848, "uuid": "cab80f1b-5917-440a-aa72-f59244c787b3", "comment": "Malware payload (Dridex)", "value": "526b4d7ae9e07873e5942bd5c9e7e299", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003848, "uuid": "60c0e1db-eb1a-4a2e-b708-68dece4dad7d", "comment": "Malware payload (Dridex)", "value": "279dd3a9ebb9dbb49562328ad11e9685b50092a4dcabd923e0874974a5575786", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003848, "uuid": "1414d925-6d5e-40bd-96cd-08a3be1b7bf2", "comment": "Malware payload (Dridex)", "value": "abc536bfdcc0dfb2c739b59e4c61682b9f7e3467", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003848, "uuid": "1734ea05-b9b1-40f8-8c24-82a3bb2e20b6", "comment": "Malware payload (Dridex)", "value": "10337b29b8acdc0819504d36b938d4182e1cf55f1825f17cb424a6b0a032cfdbca5dd7361c83cd82a9438041012527ed", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003848, "uuid": "1140fb4a-ec92-473e-ae41-dbe2f931ebf2", "value": "0924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003848, "uuid": "b545db70-ba8b-46c5-9890-81587b6f4d37", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003848, "uuid": "81269441-04e0-4e6a-85a5-96c261b97bb1", "value": "3072:n9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:n9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003848, "uuid": "d37624d0-d97d-44e1-9a44-da74ca0669c2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003848, "uuid": "5ee348e9-df82-45d1-8660-c922c5e8315c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003848, "uuid": "c60358e0-0253-4748-9b5e-c43ce9207f42", "value": "279dd3a9ebb9dbb49562328ad11e9685b50092a4dcabd923e0874974a5575786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407006f3-86eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615963052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963052, "uuid": "eb77b51e-61c1-4e3b-98f8-211b58431fce", "comment": "Malware payload (AgentTesla)", "value": "5007db7fe0ce7cc601ad113167aa3fc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963052, "uuid": "89ff210b-fa49-463c-97bd-1937d5ca34ad", "comment": "Malware payload (AgentTesla)", "value": "27d8ebb734268d2c5a447836a98c6991db5665b2c44c16e1aa726efd0ab98469", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963052, "uuid": "e17b6693-29d0-45f0-b06e-750287836d2d", "comment": "Malware payload (AgentTesla)", "value": "3680e6e33cc3e51c68434fa3edc1aec2be724cc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963052, "uuid": "f90ef2d7-1026-4322-adbb-6eb50137bc2b", "comment": "Malware payload (AgentTesla)", "value": "209f20ade9285c699fa8561fda615df3a0ac9f1efd1cdb653b263d47d1f7fa84016e07977ca8bad402872f28e98ccb35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963052, "uuid": "a2971ee4-8489-4cac-b4cb-422d3343200c", "value": "7BC32719B295CD3EC31906315D9EDEF362267D44BEC6621BB754B7BD2E3BF249A80200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963052, "uuid": "33658a37-e97b-4dbf-beb7-4d6b78be77cb", "value": "3072:Jy9fpkL1t7obvmwQfzefu96uCj//mvK0St+Akd:Jy9zmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615963052, "uuid": "ace40fc8-e231-4769-91a5-966edd1518e5", "value": 123392, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615963052, "uuid": "bfb6f8a8-8d9e-4593-8531-5254f8fc7be4", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963052, "uuid": "ce2b6b45-9359-4557-89c7-527d4ec92b49", "value": "7.pps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f93c6e-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001875, "uuid": "dd6e1bbf-ac93-4b94-96b7-60cd40e4c8df", "comment": "Malware payload (Dridex)", "value": "a0080e43d5bd5fe97f86e0f8e571803c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001875, "uuid": "133bd5bc-a779-4dd5-b73a-d6d30f3577f2", "comment": "Malware payload (Dridex)", "value": "283cd3127fafb6d72a11c823f87aa30c0b5349b9965d3aef696c70c0cfffef0d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001875, "uuid": "b3c225c1-67dc-4934-8014-db9e0188cb61", "comment": "Malware payload (Dridex)", "value": "f0ecfc33a7597cdef2075aac7cfb6893bd5bdcfe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001875, "uuid": "42066217-afcb-4e6b-999a-b543842557e8", "comment": "Malware payload (Dridex)", "value": "06ad2375e16e6458e9cb453dd0d512a651d3c989b22573a1c0443d1e25715a7dd5ca39c68568f100ffc419bf99b36323", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001875, "uuid": "da483cbe-2dc2-4032-9229-22d7d68b2cf4", "value": "8124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001875, "uuid": "9e2d4e0b-67ec-4b15-980a-d9b7a895aa5e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001875, "uuid": "a8c186db-3079-4399-ac8f-2c042e4247ab", "value": "3072:o9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:o9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001875, "uuid": "5b6b86bb-85f0-4d7c-b39e-8668fa18ff58", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001875, "uuid": "a4888aa9-40e1-4c74-8ba2-53f5fdae0f38", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001875, "uuid": "764f38dc-22a5-4950-aa54-d57182886f01", "value": "283cd3127fafb6d72a11c823f87aa30c0b5349b9965d3aef696c70c0cfffef0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f981f3-875a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011005, "uuid": "0780927a-ffc4-46e0-9e82-0cfde8410840", "comment": "Malware payload (Dridex)", "value": "e6441cf1e0511b364d2bed29f3994d56", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011005, "uuid": "7b50269b-4d6c-4dee-915a-50f6f700c3da", "comment": "Malware payload (Dridex)", "value": "29cdb43155023b083b1f64db482b1e2ddd67047d7de84db2dcd4bd497d8f8da4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011005, "uuid": "b7bca85d-5fc8-44d6-95ff-9285fc827375", "comment": "Malware payload (Dridex)", "value": "d3dc761ba387fe0a9420ad250428c134b95c2feb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011005, "uuid": "9a62f2ac-cb00-4069-a616-04c7f16e65c8", "comment": "Malware payload (Dridex)", "value": "06a9d915ef29bba4717fea807fdf4fc91aa7f6dfe947594a71e89389fb5e5f32feee957ea67a48b32c22d1fc5b04d965", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011005, "uuid": "1f698d86-508b-40a8-9ded-0c0802e2b3c5", "value": "9E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011005, "uuid": "a3c0d517-1c68-453a-9a0c-345f89c86f68", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011005, "uuid": "d2dadce9-b52d-45b8-8460-4be8ab47f48a", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011005, "uuid": "deae7efe-4477-4bc4-8304-ead259307bd5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011005, "uuid": "334927d8-3daa-4c2e-8987-a80acacb6e5f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011005, "uuid": "31455400-7eaf-4f7c-b8da-576f29c05beb", "value": "29cdb43155023b083b1f64db482b1e2ddd67047d7de84db2dcd4bd497d8f8da4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70ae2ad-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008401, "uuid": "6f8c9ae0-41b1-43f1-9aee-ec9fd209eccb", "comment": "Malware payload (Dridex)", "value": "8577fdbab6d68653c386072756c419c4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008401, "uuid": "0c2c67bd-2b37-44b9-a27d-86a40ee1b674", "comment": "Malware payload (Dridex)", "value": "2a1502f9057275127d0a1de561a56c103fefec499237b98403f7bc01d87c85f2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008401, "uuid": "47b51fb0-e1f6-4c69-9cb5-ccbf986ed36e", "comment": "Malware payload (Dridex)", "value": "3c0c77c8408a05a497f7bfbb3243794c5b611762", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008401, "uuid": "5901aae6-e210-4e78-8035-3d811670638c", "comment": "Malware payload (Dridex)", "value": "bf5c806c2eccc3e6f1569877a81711c89f261b640054f468422d598d5fef1fc98d5b37498aeeb439fffb5c53cf99e0fe", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008401, "uuid": "2b99bd43-e24b-45a0-a3ab-d277411482ef", "value": "C924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008401, "uuid": "db3f689d-902a-492f-b61c-e9aa1054c7ed", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008401, "uuid": "0ef15444-7a67-4481-b2b9-4a7b2109da99", "value": "3072:19Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:19Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008401, "uuid": "b83af8ba-ba5d-4b52-84f3-e7a526c2c7dc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008401, "uuid": "073e991d-23ca-4711-b10a-b7d72e7cc3ba", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008401, "uuid": "eedf297a-43d5-41c1-89b8-d94308939bea", "value": "2a1502f9057275127d0a1de561a56c103fefec499237b98403f7bc01d87c85f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adba08e-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013374, "uuid": "790d1cb9-3845-4032-af7b-41b199acdbbf", "comment": "Malware payload (Dridex)", "value": "260e2eb789610b50db1741d585cf6269", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013374, "uuid": "6c1d0fa1-794f-4ab6-a527-a038ed07d26c", "comment": "Malware payload (Dridex)", "value": "2a5c524071428ccabe6cfe79c21ed0050ac2cfa870cc29af3737b38eeac2e0aa", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013374, "uuid": "b5187af2-142e-4a36-9371-6a4dfea33303", "comment": "Malware payload (Dridex)", "value": "95aaaaebe5b19da00210f95b87f7efc3b117630a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013374, "uuid": "bac01dba-738e-4ed2-8e17-f1557ba54e55", "comment": "Malware payload (Dridex)", "value": "afccfef4ee5c0802cb7f1c827b5122905661399f0c75c52283d9822ed3e74341afaf642aaf9e0cb81b247e1f599340d2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013374, "uuid": "1c4f6379-d47b-466f-9b5d-319fdef4934a", "value": "B624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013374, "uuid": "68b0024e-53e1-4b87-8202-710f432d3fbe", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013374, "uuid": "c6080e8a-177b-4ca3-83ac-7d47715ec7c8", "value": "3072:A9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:A9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013374, "uuid": "a72d77da-9be3-4608-8a75-028d27bf2a9c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013374, "uuid": "207095ab-c0b7-48bf-824a-98810e3cc325", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013374, "uuid": "654f2ea1-8081-4b9f-aa53-b5e288cc36a0", "value": "2a5c524071428ccabe6cfe79c21ed0050ac2cfa870cc29af3737b38eeac2e0aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321c5169-876a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017574, "uuid": "675360b6-7dcb-48e3-b701-4ffaee96ffb7", "comment": "Malware payload", "value": "49362229673b6e57cc59a33961e5869a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017574, "uuid": "b859fa41-9834-4fc8-9b31-eb35ca546c9e", "comment": "Malware payload", "value": "2a7f66e82878aa276cbd4cac5ca0a8f99de673951f3cda549c5ef9efde63d454", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017574, "uuid": "f32161bf-2b51-4c44-bc58-4a690587729b", "comment": "Malware payload", "value": "ed8932c0ef51825da84224d5ed589109e8cdcfea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017574, "uuid": "156c1c58-25ff-4348-bbec-c97e5105b55f", "comment": "Malware payload", "value": "266d8b420d2f2478adecad3ff56cb3acc33138298ec358eaeefb0e4fe8068ed2a58f7dd42a4bd99ef690a2e27614c9c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017574, "uuid": "cb870ce8-c2d1-4eb5-8486-7eb56f3f0160", "value": "0FB2C7459A9CFD22DA4AB0F3994BCB3E85F248B4D0F2C0A0D784CB5E938F6789165349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017574, "uuid": "1c1973b0-eab3-49ca-80f5-f16c9675793c", "value": "192:AfUiHa01b3zv+ngYLTB4i4qqc+TfqSDSI1HyeSvKqwcl7bVaCShN5w4v7:pidzELTOqF2flDD1+LPl3VaCSN5w4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017574, "uuid": "cfe453f6-15f0-4854-9292-148835afc31f", "value": 24576, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017574, "uuid": "bfbf3526-3ced-439c-aa69-cebe9ee72f59", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017574, "uuid": "5dac837f-2603-442e-be8f-95a153c3f154", "value": "SecuriteInfo.com.Trojan.GenericKDZ.73552.1208.32498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea00604-8763-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014696, "uuid": "3b12664c-76d3-4586-a001-54ee1086db1d", "comment": "Malware payload (Dridex)", "value": "a927cf488ce733b56bccccc465b3027a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014696, "uuid": "b450da76-9a32-4982-a25b-167deebf49ca", "comment": "Malware payload (Dridex)", "value": "2a91f82ce4669393a3760f911b04a536e8b8e2c8b744a1066a9ae17fc1a536bd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014696, "uuid": "931a8d90-738e-45fe-9204-cd9642dc1cc8", "comment": "Malware payload (Dridex)", "value": "1648f7d5775e0130bfdef5db332bca58ad5768ed", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014696, "uuid": "2af6e730-4571-48fb-8487-44c9631a4387", "comment": "Malware payload (Dridex)", "value": "e48afb186a848452169eb9df1f73bd362d85bc03d680b046d85548bdada23e082c4902fc6329f51e43cdba122658ab21", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014696, "uuid": "162a844b-df19-4242-9a81-c1452278d9ca", "value": "9024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014696, "uuid": "aef33375-31bd-4922-a858-c123aa8260de", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014696, "uuid": "379b4d98-1aa7-4941-a8be-a7bcdf8aaf4c", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014696, "uuid": "9f16b3da-eb18-47f8-93d6-45a82188ba19", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014696, "uuid": "34119a48-c8b4-4849-948a-771f57b6449a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014696, "uuid": "3aa531fc-baef-4bbf-94e1-b977156b9c81", "value": "2a91f82ce4669393a3760f911b04a536e8b8e2c8b744a1066a9ae17fc1a536bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a10ac8-872e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615991803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615991803, "uuid": "6e022b8b-afb3-4490-a682-c9875ec0ff13", "comment": "Malware payload (Dridex)", "value": "11f80b53ca55567207ce2542ba64e367", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615991803, "uuid": "0ef33263-cd6a-41fa-aef6-0fe8ae5168e9", "comment": "Malware payload (Dridex)", "value": "2b064226cb2b4597d12ef90c76ee32ae0f5154b886f6711fb85056feed2adcac", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615991803, "uuid": "b7c1d7d9-5e45-4466-9f5e-dcd6eabec063", "comment": "Malware payload (Dridex)", "value": "b2051eb7439a9c1030548bc255876231995220f8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615991803, "uuid": "ec66f042-9fef-4842-9d9c-9f4977c341cc", "comment": "Malware payload (Dridex)", "value": "25f72430f08fbbf459058409914461396d38f9c2864d585d18b82dc1bd8a73cb8e2cdd40cd9b851433627fc4380768a6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615991803, "uuid": "e50cfcf4-f1c3-435e-8a63-e7e421a80fd7", "value": "3914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615991803, "uuid": "b3b904ae-031f-45d2-a49b-7535cb3787c4", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615991803, "uuid": "3bff0aa4-26c9-4303-b151-da21bb634e66", "value": "3072:T1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Bi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615991803, "uuid": "749839f3-df9c-4f82-9c5e-cede98cbc8f5", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615991803, "uuid": "6c035eda-14f5-4a13-aa20-a6e2977bfea6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615991803, "uuid": "578465b5-2302-4028-a4fd-aa2f31771ddc", "value": "2b064226cb2b4597d12ef90c76ee32ae0f5154b886f6711fb85056feed2adcac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeb4b0f-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009294, "uuid": "492a192f-5d7c-4d4d-9c9a-5281f8123d98", "comment": "Malware payload (Dridex)", "value": "0557f3997010c0bb4bb03bc07ba1f970", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009294, "uuid": "9f0b7277-daf0-48d0-9916-81a61b8aa7ea", "comment": "Malware payload (Dridex)", "value": "2b8094a984d6d9e68590706eebe7d56ffb47253530a2691fc0955ad3f79a6540", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009294, "uuid": "c10c7d1f-0bd6-43d0-9d43-8b574abb7b8a", "comment": "Malware payload (Dridex)", "value": "baeec431e7a0e0b0c583efcd8dfcee678e3eed75", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009294, "uuid": "a2354d51-3c04-485a-af42-1bdce38491e3", "comment": "Malware payload (Dridex)", "value": "1947904016e0323902effc049d934550597380dfee1082cb12aab8b7369fd4d01fbfc47add1b836207d5fa33e0229614", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009294, "uuid": "5e47c804-8bf7-4fe0-991d-fa5be46af500", "value": "9A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009294, "uuid": "a4c8ea9f-c461-4cfd-b3da-7ce47a4507ec", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009294, "uuid": "697061d5-071e-4006-b56b-07dabf9024e2", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009294, "uuid": "c955fbef-193a-4b6b-8cd6-57dd107e65e2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009294, "uuid": "72694e74-9d69-460b-94c6-b17727171dc0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009294, "uuid": "820e6532-c200-46aa-9cbd-b8452df9158f", "value": "2b8094a984d6d9e68590706eebe7d56ffb47253530a2691fc0955ad3f79a6540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82913ca1-8702-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615973041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973041, "uuid": "74b446b2-4810-48d1-82a5-6cd8819268d5", "comment": "Malware payload", "value": "0c492f125734580a0eb5d0cedab0ae69", "object_relation": "md5", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973041, "uuid": "8da12a24-7992-42a5-814b-5081830587d6", "comment": "Malware payload", "value": "2c2cff4237cd756cd86b5c17af43d8753e875124273b94027566de509407fee0", "object_relation": "sha256", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973041, "uuid": "bf5c7562-e057-44eb-8e3b-c67b4173359d", "comment": "Malware payload", "value": "605dd4e7c92978f96b95f32bb6fe46fc407ead80", "object_relation": "sha1", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973041, "uuid": "8002845c-85f1-4ece-9884-b11c56cdae36", "comment": "Malware payload", "value": "467af5d9ba781fb11314476d1e6179f8ee5003999e691f3d4156b78895800c18f27f8b2ec9a378d19ce63a1004c4bbd0", "object_relation": "sha3-384", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973041, "uuid": "2f48322e-a1ab-4027-8d56-6f38918ba2dc", "value": "CAB3020EE2151CA9C639707FA605D8F4694DB2A1A892F40B2524FF0979E59F31FAF0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973041, "uuid": "79fbe26a-7e8f-4834-ad1e-c8fd9d4ba50c", "value": "3072:+7OYPvsUtFARPULAZemMA5uAgz3xQGayRVnfdCh/XF+:+iMFAeErgzBQGnVnfd0F+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615973041, "uuid": "dc698cf8-349b-403c-98b4-d2a1d3f88fa6", "value": 116318, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615973041, "uuid": "0924f3ec-ed9b-4296-9e43-f80229a73836", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973041, "uuid": "2c45f447-461b-45eb-a0c3-974433e10823", "value": "Attachment_869999.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53060875-8740-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615999590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615999590, "uuid": "27e0ab3b-2d14-46da-a11f-7d46e24dee22", "comment": "Malware payload", "value": "ba7774dccb0ae3454b94ad22b2d6df25", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615999590, "uuid": "154361b0-d7cd-49b6-8a93-48f014af5080", "comment": "Malware payload", "value": "2c3c6f052bdf6c641930a63c9b7f37373464ceccceefbae256e9b6f58eed8cfa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615999590, "uuid": "5b1c121a-dd7e-4417-ad2e-1ee68da86c16", "comment": "Malware payload", "value": "3e7a41f2e1794fffcaca70ac0dd88c757c1d2fa5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615999590, "uuid": "079a4e24-ad0c-4fcc-bfbb-f01cd1bf55fa", "comment": "Malware payload", "value": "1d0577c53b02a8f1bc867c7bafca3cedd20928b17462ce70c4e6d17bb7acc21ccb7c7efc4b4c2a3ad118c3e848857565", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615999590, "uuid": "7a852773-f023-445a-bd9f-5190bf3ee261", "value": "24B423F5898EA74932F029B3C458509781FBDB7A0C796C5FE93359FD340744C096AA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615999590, "uuid": "7a58d57f-445e-45c4-8f76-4981c3222694", "value": "12288:C+YEVfAo+IDe5/m+P9StQcgZPZMNFv4hVxKPdbn8oUORqUMHZjx:O4fAoS5uEFRZYFArxKP18dOsdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615999590, "uuid": "91216fd1-4528-4e73-bdab-c0bc76e04f0f", "value": 513696, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615999590, "uuid": "ffb0fad9-1cc2-411f-a4a6-169607a4aaf2", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615999590, "uuid": "b5a3e74a-fc72-4a3e-8aff-f78445f0431b", "value": "confirmacion de cuenta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24f09b0-875c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616011830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011830, "uuid": "49e8819c-b914-48d6-b37e-6cb5e282097f", "comment": "Malware payload", "value": "7c3a0200aa9ae7673468a03e2583d39a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011830, "uuid": "c280984d-c6d4-47d6-933f-2ac49dc2d3d5", "comment": "Malware payload", "value": "2cd6183b20b8bd9eb307cb566b6af9dc40bbef552cbd99182c461ab412fa6542", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011830, "uuid": "7ffaa165-7146-4223-a94b-0030a52ce3c1", "comment": "Malware payload", "value": "005e87202814be9621bc8636c9c1aa3a681419ee", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011830, "uuid": "d2e236d6-8537-44f3-a1d8-b15e3920fcdb", "comment": "Malware payload", "value": "08932d7005533962f6a1e78a142daff007e5238a9c003d4299bd564c536f06273d9399d7fbf79bdec21e8ff3f3c02840", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011830, "uuid": "681ca5a7-706c-4816-b744-d5ecd69d26c3", "value": "3424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011830, "uuid": "be64fe46-7cff-4fd6-9a2f-30b0cb63c9ef", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011830, "uuid": "dfcf178e-3f10-431d-9585-540623e85b16", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011830, "uuid": "009ea277-ab85-4675-8ce5-7a3e2b776b12", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011830, "uuid": "286473e2-68cf-4a68-9ce4-2553edd367ba", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011830, "uuid": "7a737f1a-567e-4a80-a892-90a14abb343f", "value": "2cd6183b20b8bd9eb307cb566b6af9dc40bbef552cbd99182c461ab412fa6542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22bf297-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003696, "uuid": "84753eb2-b0d4-4601-b08c-8f57ace1bdd8", "comment": "Malware payload (Dridex)", "value": "38296b09e1283a42319c62e1291df5c5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003696, "uuid": "996a715e-f83a-44f1-b248-ee6bf7b71547", "comment": "Malware payload (Dridex)", "value": "2d1ad7b4b043bd154895f6683e11819d4894bf5ef9faa7b5b01e72c7cd2ab343", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003696, "uuid": "13f1cf17-c458-4801-90d2-ca4c66e202a8", "comment": "Malware payload (Dridex)", "value": "c2ab5f24bc438af5a1ac9cfb0df6cef9bfddcfa3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003696, "uuid": "f31bef4b-67a4-4973-9200-28d8b780bc97", "comment": "Malware payload (Dridex)", "value": "006b89949c0f4df0ec9a47bca824830bdd1c818ca956bdc8637f14bc1e46760e298d58a7b1d5edde8839465f4d643a3c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003696, "uuid": "c2cc9102-3ee1-44f0-bd88-df3e78d47851", "value": "9324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003696, "uuid": "bef3f111-2640-4c24-a0be-3d171ab04577", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003696, "uuid": "0f79784d-8f12-45cc-a6ff-c3927f8d4189", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003696, "uuid": "2c2c8838-c959-405a-bb69-fc324ea3125b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003696, "uuid": "89ed350d-9291-4ba7-93e9-7d1c9a8c3e50", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003696, "uuid": "e595c422-2325-4e29-a070-c8da0bc6ec15", "value": "2d1ad7b4b043bd154895f6683e11819d4894bf5ef9faa7b5b01e72c7cd2ab343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e9b431-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013426, "uuid": "d7f9d9c0-1b74-4f44-997a-a9f76d685149", "comment": "Malware payload (Dridex)", "value": "347991998c9bc9a9643ce51f0bb989d4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013426, "uuid": "1d11a202-7aeb-4ca4-9817-abd5c67474fe", "comment": "Malware payload (Dridex)", "value": "2d4175227d7dd0ed6dee8016ac845ac9db4ee3c0958ecfb566dd58dddb481098", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013426, "uuid": "097ad1a0-f4bb-4ba2-94b9-02bf496a7bb5", "comment": "Malware payload (Dridex)", "value": "32b846d755370cd005b3d9fb478ae8fbe2cd4f3a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013426, "uuid": "7816d56a-c57b-4229-9f37-6b69486c8ecd", "comment": "Malware payload (Dridex)", "value": "65e093925dd433baa8ce32da45f34c8a5e69ce502e9f896f7b706cc586b6454abf962d7b52771a7ce4b67e355eb56179", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013426, "uuid": "7e5c469d-966f-41ff-88d3-2309d525382c", "value": "E124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013426, "uuid": "108bf02e-86d1-4ff2-8554-b04763fd0275", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013426, "uuid": "993cbf4a-ba12-4301-b6b0-5a893c08213a", "value": "3072:W9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:W9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013426, "uuid": "94c639b2-3fbc-4989-8d27-02d305c1ecc4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013426, "uuid": "cf7e5f1a-bd88-42a7-ab18-61671ee51d95", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013426, "uuid": "ee018dd9-50e9-4186-bcf6-1a404fd21efe", "value": "2d4175227d7dd0ed6dee8016ac845ac9db4ee3c0958ecfb566dd58dddb481098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df72466-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004655, "uuid": "0c51b0cf-8544-4e45-beb4-17232b1ab989", "comment": "Malware payload (Dridex)", "value": "da7269ccfbe89a8fd1df0382cd947f88", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004655, "uuid": "9dc8f339-c18e-4fbb-8c09-568477616773", "comment": "Malware payload (Dridex)", "value": "2d4be90f4a64f3cfd84567da72c6cec9bb81d457a1b1dd25c0e642bac4e03e81", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004655, "uuid": "97dfd954-1915-40e0-9fe1-4aa9a415d1ce", "comment": "Malware payload (Dridex)", "value": "1c514bec25cbaaa5c8d6824c55d3d64139f9bbf5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004655, "uuid": "dbf6424a-8cbc-42b6-a69f-cd338bde109c", "comment": "Malware payload (Dridex)", "value": "455d3a1cb968e4329452be32e6d8ff3884c22828a5428a9ff73bb481c923ba0c7419eaf166c115d3dc22aeb135b9b1fb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004655, "uuid": "8369cff2-11ed-40d8-92de-04ef8f31ce6f", "value": "9524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004655, "uuid": "744f0ecd-2766-49fc-afbf-7e2c22a9a5c8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004655, "uuid": "10b576d7-9e5f-41e3-9372-b5db94ea41d2", "value": "3072:t9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:t9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004655, "uuid": "4103d7af-1c6e-4621-9ba2-c2a1510f401e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004655, "uuid": "3e479b49-add6-42f3-97b0-9ef918e65e13", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004655, "uuid": "8dc1d29e-fcc2-4ed5-86e5-ffbec40936c8", "value": "2d4be90f4a64f3cfd84567da72c6cec9bb81d457a1b1dd25c0e642bac4e03e81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627bd96c-86b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615939486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939486, "uuid": "b6510a30-7811-490a-9739-a01ffecd716d", "comment": "Malware payload (AveMariaRAT)", "value": "9f15b5ad8082df903768068cd890d240", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939486, "uuid": "e35238c8-e24d-49b8-ad6a-5da3dc212369", "comment": "Malware payload (AveMariaRAT)", "value": "2d6981b3de1f4c1020d394446989ddd796b5cd8b42f1ff6c37309674e2fc3e5c", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939486, "uuid": "6099d1cc-b77a-4668-bfe9-3b107b2bf923", "comment": "Malware payload (AveMariaRAT)", "value": "64942aee0a147bccec26bd40d4e56938ab3e82ec", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939486, "uuid": "6e6d0295-3bb1-45ed-9599-caa6605f5b75", "comment": "Malware payload (AveMariaRAT)", "value": "304b2780f2afcaa004651c0257a62562eae2d394b6f65cc3ca54f790cc594c08303914093fdb74aa1caeca6d1259cbea", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939486, "uuid": "697a8996-7347-4f52-b85d-dbfc3d4dc190", "value": "25019E37F5E7D7114429C89FEC6E9F89E87005430F6A55D1D0D084D78D4184A577C85D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939486, "uuid": "14acf560-8dd7-4458-9638-db26be6c7368", "value": "12:xbIlEcT/yEZgAi3phyc8brdvkPGoXZIKelhyc8brdvkPCEhXqZJN:1IecuEZgNpYcYrdMPGoJIKelYcYrdMPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615939486, "uuid": "07019a04-4d3b-4dbd-b80b-859693f9242f", "value": 665, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615939486, "uuid": "23d71dd1-5836-4402-a214-a06612fa6a78", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939486, "uuid": "39e8bf6b-d432-45c4-be1b-85c62410f77d", "value": "detect7.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790bb1b1-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615968730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968730, "uuid": "cfbff0e3-d03d-4b96-8bd8-4b9fd4ce3759", "comment": "Malware payload", "value": "4fa1dbfe022061e6699ae4754b45cb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968730, "uuid": "491cff38-4b6a-4da5-88ae-85c5d0049a9f", "comment": "Malware payload", "value": "2d8a94aa729c023228778bd3db76aec6ec015598c8a7e9f79d87b20e2a1c3c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968730, "uuid": "b56f0e70-47dc-46ee-a780-edcfac063b4b", "comment": "Malware payload", "value": "4a6c85337f3bb674c55e05121b0c87ead2442ed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968730, "uuid": "6b3f3faf-601f-42a5-ab86-a698ec4dc66a", "comment": "Malware payload", "value": "aa30da75db6361a31cf3d8ff954df89ac997a7f43db425b92f2cf339b1d769a1432bcfaa38fcdb996118f14c2cc388f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968730, "uuid": "b9335b58-6fe1-49ef-bb5b-73c8e9f5bd7c", "value": "39B2831036E9901BF2BFEE732BA5BAC6053FB7D91D13625D182813232E71146C999B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968730, "uuid": "67de1a28-ba41-4834-adde-5d93d8deddd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968730, "uuid": "9899215a-9cfa-480f-9226-544212ce382d", "value": "384:5SZm9Hroe51UZgDUeUKQ4rkHi4vHtMc/TnXnJ+IkPsLI8uKS/fJXLgTK:5SZm9LENvHFDXJA0gXJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968730, "uuid": "2a090701-a3e0-455d-9d3a-16b950bf7491", "value": 24064, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968730, "uuid": "56cd7255-da9a-4c98-9552-7c84d69d24c4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968730, "uuid": "878b5acd-7c7b-4112-a345-d94ce496e9e4", "value": "4fa1dbfe022061e6699ae4754b45cb4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80473b03-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001813, "uuid": "0e398c37-cb53-4338-84b0-73ee7e0446db", "comment": "Malware payload (Dridex)", "value": "0410a34f340ac783c3e47aec012ca5f9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001813, "uuid": "3c9482fe-9201-4bc8-b199-9bcb8d0abd7b", "comment": "Malware payload (Dridex)", "value": "2e3508612d9aa931864e328b8f9261d5f3ffe505e406d0e065c6b962d38ed39a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001813, "uuid": "67a9b7a1-77a7-4e59-ba81-de7b420db769", "comment": "Malware payload (Dridex)", "value": "d4b4cb16da53aaec5022f119930af457d8793840", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001813, "uuid": "284ddb43-74ce-402c-9042-836930f3e095", "comment": "Malware payload (Dridex)", "value": "615c3de69d6d40bdeae887806960931f003130dbe9caaad5fa74316d4c92c6032a6c66b500e1d6f4d93eb4f7efa6695b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001813, "uuid": "609adbf5-430c-477c-97fd-ec03d569a5d5", "value": "8124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001813, "uuid": "70340525-29b7-499e-b40b-04f01c367073", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001813, "uuid": "967eba25-c050-493c-a475-8aecef917ac6", "value": "3072:m9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:m9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001813, "uuid": "aff132d0-ff0b-4c16-a962-697e45b533fc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001813, "uuid": "f3d53132-58b4-4401-917d-4f4e24b6ef2e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001813, "uuid": "d47cf688-3924-40e9-952a-c23686b3f429", "value": "2e3508612d9aa931864e328b8f9261d5f3ffe505e406d0e065c6b962d38ed39a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5938c7d7-8752-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007331, "uuid": "bf1c2f5e-cbd5-4d92-8429-0432bee1a154", "comment": "Malware payload (Dridex)", "value": "0651d094ed3d57cf9c1ef395fd63691a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007331, "uuid": "a6355db5-de92-4803-b935-eea51ee27ee1", "comment": "Malware payload (Dridex)", "value": "2f32241fc2f6d76f04e4ce4c94cf9d07730538460e5085605f50187538c85054", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007331, "uuid": "3541e309-9532-4118-81db-d2c6b2ebbef4", "comment": "Malware payload (Dridex)", "value": "da5e14e26ba844506fd4af36f2eca27e45031b9a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007331, "uuid": "25d26793-d11c-4322-bdfb-bb14e578d8ef", "comment": "Malware payload (Dridex)", "value": "44299bc8be5b0f6ccc9dcdc513354b3d1d1588c3dbdb8dcfff6915550af74c20dec84b15619296e6c0d37f2b3fad5857", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007331, "uuid": "507e7872-eb14-4e8c-b6a8-8fe38f7cfbe8", "value": "4224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007331, "uuid": "54761b97-a7c4-45de-8a34-bd2f62ab22db", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007331, "uuid": "a90bb2f7-be23-4cea-a9a5-100b82d6ac5e", "value": "3072:69Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:69Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007331, "uuid": "011de79a-dae9-408b-aff9-e0cc2c6c8f5b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007331, "uuid": "1279bf68-f9a4-48d0-91c2-dbb046fa71be", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007331, "uuid": "64e421c6-6031-40e0-9d16-b61a10d3c9f5", "value": "2f32241fc2f6d76f04e4ce4c94cf9d07730538460e5085605f50187538c85054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa94203f-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkComet)", "timestamp": 1615969243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969243, "uuid": "8c5d4065-5d48-4d43-a3ab-2b5ee7cad0b3", "comment": "Malware payload (DarkComet)", "value": "c564e2327daeecfdcc70feea844c3cfb", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969243, "uuid": "d3b403d2-7c53-4e27-a2e3-2e97182ac43a", "comment": "Malware payload (DarkComet)", "value": "2f3b39e32b302b059b4bf652a4094d8631ce6f7ec8a95a2b1db2d7d1fe29fcde", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969243, "uuid": "1a24d351-935c-40e8-b15f-9fd52beb838e", "comment": "Malware payload (DarkComet)", "value": "09693cfa2ac81ede9208f86f32eb3b2d38db7f3f", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969243, "uuid": "5dad6af9-ee25-4fe7-88c0-ee6422c025bd", "comment": "Malware payload (DarkComet)", "value": "9c0ccbcfd9c0bf199209ed69f5995559c9538be01671e2de77e5e6337291cd05b599fefffe85038edab80f8f32456092", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969243, "uuid": "aea96dc8-88f8-4fbf-aff2-8713b7adb05f", "value": "2F24C36139E38408A6A37FA7BEF47A95DE5FBB322646909F35411307A115EC0CEB3631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969243, "uuid": "0d34f6cf-612e-4d9c-a3ee-1f295232ca12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969243, "uuid": "5ddb1488-6a29-4caf-b1ec-41040d48d1c3", "value": "1536:APDg+Z6vS6vf6vD6v+6vv6va6vQ6vB6vn6vK6v:ALg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969243, "uuid": "43dae692-7da3-4143-b7f4-601e45bff764", "value": 225280, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969243, "uuid": "869d2218-3fc1-4aad-8d74-898758d6db22", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969243, "uuid": "7c68d144-8e73-42bb-a56e-e4145c3e4703", "value": "c564e2327daeecfdcc70feea844c3cfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86d9cb7-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003706, "uuid": "0fce11ad-412a-4abd-b946-9f8d3e9983b8", "comment": "Malware payload (Dridex)", "value": "e870a8e5b2d0f174626e2dee6797944e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003706, "uuid": "1d0d6377-cb41-4feb-ba35-09f617a5e06e", "comment": "Malware payload (Dridex)", "value": "2f3da07e12d501d27dc193caa7eee8fea64873f2912e7fc4f977568103c189fc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003706, "uuid": "3f0c86e3-2248-40b9-a698-f33baaa5ae65", "comment": "Malware payload (Dridex)", "value": "d3dfbd20ba2a76eedaceb6bb6e82b57e3fc78685", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003706, "uuid": "ceb3ad7a-ac7c-4fa6-96ad-0c5ffe1c5eb2", "comment": "Malware payload (Dridex)", "value": "88a23255db814bb1f60d31481e5388374fe945f394f4b3e72a3078e74dfa9607d1e6f6adc69c76127051c40fc2997aae", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003706, "uuid": "0df921df-b27e-4540-b0c1-84a4364e23cc", "value": "0524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003706, "uuid": "b667b76a-e9dd-4c9c-8b51-3d669b51593d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003706, "uuid": "c6a67178-4b91-4f6d-9df5-1bcb85af5ed8", "value": "3072:N9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:N9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003706, "uuid": "c69eb60c-be3f-4ac7-b9fb-e52e3da7fe10", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003706, "uuid": "19efde98-e871-4076-b520-a28ff9e6990a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003706, "uuid": "2b82f670-ed24-450f-b20f-83773c92b80e", "value": "2f3da07e12d501d27dc193caa7eee8fea64873f2912e7fc4f977568103c189fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adadfa6-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004381, "uuid": "c6ec0e47-0fa9-4dff-aa17-2ee866dd65ff", "comment": "Malware payload (Dridex)", "value": "83b172450e1bc81b1b3ae91d5c35ddd9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004381, "uuid": "0a4d7f6c-f9a0-49c6-90c2-d657012e876f", "comment": "Malware payload (Dridex)", "value": "2f849b87514292a1f29b9a6754903c85b065c3cd5a1216e17fe4e84e002a0beb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004381, "uuid": "bbcc925e-803a-43a3-ae23-679cbf28dfd6", "comment": "Malware payload (Dridex)", "value": "081fe65a09079a8d59f01b520ca95111fc17aee1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004381, "uuid": "8bf23b37-35af-45cc-81cc-0eac15efc241", "comment": "Malware payload (Dridex)", "value": "884968c673a84b6c3d4fe00d4d9e4e607d9422b0c9dfc3e5e6897f17da30c18dddf43db111c2e4c02dd5a6cb7d04a6f8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004381, "uuid": "8e41090d-f7de-4e13-985f-c96d1530f882", "value": "E324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004381, "uuid": "db544bfe-4d6c-4cb2-bf9c-370cdc249c39", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004381, "uuid": "7e405aed-c90a-4a3f-83d1-4772f4a92283", "value": "3072:29Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:29Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004381, "uuid": "5e57a19d-00f7-4b0f-a81f-3412b71e5ba5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004381, "uuid": "6e2ee7fd-6e99-418d-8532-e80bc9969a20", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004381, "uuid": "06dc12a5-1d3c-49f6-8565-13a70e988d3e", "value": "2f849b87514292a1f29b9a6754903c85b065c3cd5a1216e17fe4e84e002a0beb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd38e870-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004090, "uuid": "9927d251-0ec4-44fb-93a8-72ca313dd928", "comment": "Malware payload (Dridex)", "value": "0e48d8ac008a5c6bc17763ff534d4b6b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004090, "uuid": "8842b800-13b4-472a-9a94-09716a36c602", "comment": "Malware payload (Dridex)", "value": "2fd3bff5a1df170b8afac24575bee4342050b2377eee4ab2228c8aa12f95359b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004090, "uuid": "45e285fe-91b4-48d4-9f84-3e7f7287c911", "comment": "Malware payload (Dridex)", "value": "1eae1fe9f0455bf97a8a3e9bb4c4d8b0437f5c13", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004090, "uuid": "9c028beb-b08e-40a0-8d76-2eb85498a1e4", "comment": "Malware payload (Dridex)", "value": "9c5935af8be31d4955f447748ddfc4be4f8e9b0f0f323af6540248255b28f5476f3115505240cf19e7f1fd8a16a06834", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004090, "uuid": "64c43d2b-ea45-4312-97ba-bafb28a9e75c", "value": "6124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004090, "uuid": "9aa1bd03-20c4-4a8e-9393-2a8d4cd1a193", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004090, "uuid": "1928277f-62e7-403c-99fe-032d577665c5", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004090, "uuid": "c4234579-7774-455b-bd1f-aef714fa481c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004090, "uuid": "d118e2b2-2dc9-4ffa-88d5-9f5d39e88acf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004090, "uuid": "c5a15d47-8083-44bf-bbdf-850f786aee49", "value": "2fd3bff5a1df170b8afac24575bee4342050b2377eee4ab2228c8aa12f95359b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9952c0-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615984577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984577, "uuid": "bd9a67aa-0826-4219-84aa-5253a48e785b", "comment": "Malware payload (Formbook)", "value": "b80561db8d65f7d19145a96313e75841", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984577, "uuid": "6754b8fb-5bf6-4a74-8c73-e59e4cc7e8e6", "comment": "Malware payload (Formbook)", "value": "2ffba3bdd32f30943f27a537f9dd75e34a504fb31f04039b634536499c207d4b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984577, "uuid": "d00311ff-4aba-4a7b-95d7-17d32ffa2eb4", "comment": "Malware payload (Formbook)", "value": "9183cc50d574f5a5a9608fc0a4bbac08f2349d22", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984577, "uuid": "ce40236b-cb36-4830-88b2-7b28b3bd8242", "comment": "Malware payload (Formbook)", "value": "167256271e7128ebbda77116b39e453ccaf9cfe74556e6f40b5031001e166985bacc97878657a8d81d3a9ae382a69174", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984577, "uuid": "85d69d54-f013-4738-9a1e-34c7424c6e3a", "value": "2E0533B546E90A6B8F112795C3C9BC0F947E666B6BBB543C3A05F0CBB8DD6FC4082944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984577, "uuid": "460c1117-ffcb-456e-bf27-1507736c7c12", "value": "12288:Jn79v4p8iIoybRWK+Xyesj4ldohWv7GhIfQdyb6LKkpqw6dzi:Jp4DjyAK+XyepbpvlQybaKkZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984577, "uuid": "338838cd-c010-4551-aff4-5702bb06ed60", "value": 806111, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984577, "uuid": "75e36fb8-1d96-4f31-97fb-be29a8332fc1", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984577, "uuid": "bfbe77e2-4416-4cf7-b043-2dccb3720469", "value": "New order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b193377-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012811, "uuid": "9ff99555-7462-4bec-8171-e4c44a059c82", "comment": "Malware payload (Dridex)", "value": "fc097db03a47f162ee308234dec89a37", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012811, "uuid": "acdf71b6-46c8-4cbb-8940-aaf9b9dc670c", "comment": "Malware payload (Dridex)", "value": "302327fd47e03e69c0748447f7b841509792f2a1df32447f39d49feff6cfea8d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012811, "uuid": "375742e0-8bcd-4504-84cc-832fec4142ad", "comment": "Malware payload (Dridex)", "value": "c63898761cc457b4928f066c8a0b74bdc26372f1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012811, "uuid": "2ca5a2c8-c4be-47d5-b65e-e89c30ed1e36", "comment": "Malware payload (Dridex)", "value": "d239e3d4ace10c08c609b6af9840fdfa6031eebfb1640c355df169b1f1b768717baa37b4080858d64463e48a53b10ac6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012811, "uuid": "abd0845c-d4f7-44e9-a29d-c9eb972e4734", "value": "9A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012811, "uuid": "1b31a438-dcb4-4b9f-8f22-718218ae2389", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012811, "uuid": "407c7f64-21de-4ee3-87b4-ec70bc3e2ff4", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012811, "uuid": "6c846ffc-7d52-41d1-b1e2-05a67023fc47", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012811, "uuid": "189b2bc0-0a6d-4d2d-bc19-df1c697bbc80", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012811, "uuid": "de1b93d1-4b0b-4322-8399-2ff779febdce", "value": "302327fd47e03e69c0748447f7b841509792f2a1df32447f39d49feff6cfea8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229d2906-872a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615990060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615990060, "uuid": "149d95eb-5482-4617-a57c-528a00ca8f60", "comment": "Malware payload", "value": "f41300a20b432dbee62bd087cf427d97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615990060, "uuid": "ed9bdf07-101e-401e-b43c-b888f2614e3b", "comment": "Malware payload", "value": "3054a50fdfe1e1974623dfd53a6595d637544ef8f169b388436087418fcef80c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615990060, "uuid": "29382b21-1682-439d-b8ee-3004ad49bb1c", "comment": "Malware payload", "value": "6d5f562d95c6216ec3f935b8949c418681d053d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615990060, "uuid": "b9e339ef-4f5f-441e-8d5a-a66936796658", "comment": "Malware payload", "value": "bed491ad2bc9447a443cb6408a8a39220a2c41724d030bbd5e35cfe21969cfdf086975ecfc51cce744c7b6bd579441f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615990060, "uuid": "bb46167d-74ad-4cd2-a146-fb8a35261642", "value": "DE052314CD81F6943C9AE04F8FB69176A45AD7A7E5EF342B6330A3727BEAC0D4412394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615990060, "uuid": "49e6685a-b461-4918-b9ca-fece5390422f", "value": "24576:kXEAE9INYeca+Fp+7cl+YxhtS7KRlLLA7Xe:kXHESoKcltxXS7KRlLcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615990060, "uuid": "76c0bec1-16cc-4a7c-9f2b-04835a5f4772", "value": 845175, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615990060, "uuid": "0ccd9529-a0e3-40fc-8844-6ea82e601e35", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615990060, "uuid": "f5bd0790-e1b6-4e99-a78b-b891a8c25f7e", "value": "cotizacion.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bbb960-8741-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1616000209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000209, "uuid": "7897c5e4-f8a7-498f-84db-38430a07cecf", "comment": "Malware payload (SnakeKeylogger)", "value": "d8415bfe1581ebe3247ce8fe62547eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000209, "uuid": "cea38fe7-4779-4f7b-9f65-d00cb192a38b", "comment": "Malware payload (SnakeKeylogger)", "value": "30737a757d3a340212c70669caab406b0ccde8f2d91d8efd089b402a21c2c5ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000209, "uuid": "ca6e51fe-917b-465c-ae53-e7e80ecd5833", "comment": "Malware payload (SnakeKeylogger)", "value": "f5276a84783be1f4725617a38ee54c92933ccb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000209, "uuid": "c8d16748-b8ca-43aa-a1c8-821a19d7db41", "comment": "Malware payload (SnakeKeylogger)", "value": "c809d1d459be25acdd0035b50518f28ce80d07d993015cdcdc75eb62db9253816a1fcd392c1fd6dccb9fce9d18f0c469", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000209, "uuid": "84fb21d5-1dc1-4fc8-b8f8-a42aa4289ca4", "value": "49E4F1A036F85B41E5B9B7F611639148577A7B3BE66AD30C9CCA60CE1A31F409742F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000209, "uuid": "c4d537bb-4300-4b5f-bacb-c893a922269c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000209, "uuid": "affbb671-ac1a-4aff-8fe6-4911a1ae8b53", "value": "12288:oN4r582X2eRO0XbqGdqNrie5L6BhMxpY7xRfLR+hcuqDyrTaS7falUddddd:QeRxpwxn+BhM7Y7xRdHCT77S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616000209, "uuid": "0e4d7aaf-4865-461a-92b4-f143c8a2d824", "value": 697856, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616000209, "uuid": "13a7070e-f6c6-4740-8514-38ed4a1efa8b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000209, "uuid": "28abd6bc-ea7d-41a1-ac39-b6b5c46ec31b", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729a1e6b-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009092, "uuid": "675ac15a-8a18-4ae9-a85b-c6175e41b6c7", "comment": "Malware payload (Dridex)", "value": "daf33cfbf88dc8e6fb23e49d47925488", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009092, "uuid": "eea8ff94-ea79-4093-90e7-0ed2c53ddcd0", "comment": "Malware payload (Dridex)", "value": "308427a28e6bf1d20916db852cb05f695916aee2021ff69d1b755e18aba155e8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009092, "uuid": "b0fa4d07-eafb-44ae-b832-9bd710512993", "comment": "Malware payload (Dridex)", "value": "bf408ebe966feead54c78eae0053fff660b174dd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009092, "uuid": "4c472843-8b83-4552-9430-4f057a398eae", "comment": "Malware payload (Dridex)", "value": "8a0cb6ebc40cd3ff6ecf86b154ef63187e10710161491a7b5f081374414226bf17d81cc377cf7e0df779c266430bf988", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009092, "uuid": "3af5c665-7655-43ea-b3d9-11322a3f837b", "value": "4524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009092, "uuid": "0b613ef8-d26b-49dc-bb40-645a11f59856", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009092, "uuid": "f6d0696f-7d37-4d91-afa0-c3f5c2448af3", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009092, "uuid": "cc765632-1a2c-47d7-9e00-730ba4605b84", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009092, "uuid": "3ec313db-3f63-47b8-85da-ccf688159ce5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009092, "uuid": "dbb0e6b0-043b-4593-8257-dff782ba526c", "value": "308427a28e6bf1d20916db852cb05f695916aee2021ff69d1b755e18aba155e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1638bb19-8762-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014091, "uuid": "d77f28e1-7a91-4f72-a09a-c6112840001d", "comment": "Malware payload (Dridex)", "value": "327988ae19005aa95dcf81ac678f7811", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014091, "uuid": "4b289b2d-d5d9-4f84-9dcc-06c0b297a11c", "comment": "Malware payload (Dridex)", "value": "30b2118ca89598a01f2a7e3b1b1a872d3306e8b05f57cc45d8871fb12226c317", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014091, "uuid": "f48a9939-4f81-4ea6-a22c-50ce201c0abe", "comment": "Malware payload (Dridex)", "value": "d3a88918262b6a5bb05ec1d0e4d17b482e8c7dba", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014091, "uuid": "aaac26ce-02c4-472e-9690-d52d7b2bf136", "comment": "Malware payload (Dridex)", "value": "e4004566fbfc1dad3bc75adf7e56e4ef7cba24538587ae78bcf0ec910d08d280afedef61c123713d79ecac8e566233b1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014091, "uuid": "1b7dbbc8-94c9-4555-bf2a-3d6a0a3dccb1", "value": "6024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014091, "uuid": "0a6a5fc6-4ced-47a2-8f80-5b6a37646957", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014091, "uuid": "83e1ce11-524f-4518-be7e-d2542ce24cb7", "value": "3072:D9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:D9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014091, "uuid": "77b2ae77-a9d1-41fa-9cba-710c8a2ddfce", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014091, "uuid": "22084d41-5683-4c5d-83ca-560c9669a32c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014091, "uuid": "616acce5-2ffe-4234-98f7-63c86f9d8fef", "value": "30b2118ca89598a01f2a7e3b1b1a872d3306e8b05f57cc45d8871fb12226c317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6187dea-86e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615962014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962014, "uuid": "7611b775-174a-4bf0-97f8-b15295677ba9", "comment": "Malware payload (AgentTesla)", "value": "b9b5ef1509c245123f26861dc573ed86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962014, "uuid": "f0400392-69ee-4034-81fb-cb99c606ed3b", "comment": "Malware payload (AgentTesla)", "value": "30b8ed43a23d057aeecfd42e906b012fc5af16a92f718b6049d26ef9ef3395bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962014, "uuid": "12bb7414-e103-4800-ba47-eb76518cd46f", "comment": "Malware payload (AgentTesla)", "value": "6575f5c57023d45ceceb8436d2717a1823d5f9d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962014, "uuid": "d3f37484-dfaa-4c80-8af1-48c44825c9d5", "comment": "Malware payload (AgentTesla)", "value": "4e19535e277a2e94d0e79655819751ed5f13e4daeab12855c859b98b3ad026ba9a3a964cb8d57f377f23e8d1809edeb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962014, "uuid": "d9714855-0525-4bd9-9c8c-a38af596e5a2", "value": "6BE4AFF875047DE6266F536BCA96ADDD03B626638ACBA4CD8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962014, "uuid": "12d896ac-0825-4c33-a002-7cbc8c3616f0", "value": "12288:GMkNFwRAYipp2OJthwYWc69XAK+8Udi4isfMWpZB/pdc3XEEip41unOgVawF02Al:GMWwRAYipNJoBpxAKedTLpPco41unOvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962014, "uuid": "0b681abe-aa6d-4445-9acf-e467589b3e2c", "value": 718550, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962014, "uuid": "8e684ec8-798b-405a-8eb9-eeb9ca264968", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962014, "uuid": "349e755d-7063-4634-b16f-4695d267a581", "value": "ATT00071.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562eafda-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001743, "uuid": "5373ad75-00ec-4b7b-ad2c-bc1a0e380eb0", "comment": "Malware payload (Dridex)", "value": "1af7316e0fae05f1363d093ce1fc769c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001743, "uuid": "67fa1ae2-fc1f-4c1f-bd74-e453159f76a0", "comment": "Malware payload (Dridex)", "value": "30e5bac66477ec6ecc0d0d20e84be24bea0267d74c8c4b3ffd440b7475901a2e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001743, "uuid": "f90cbb30-cc65-4cef-8658-961658454089", "comment": "Malware payload (Dridex)", "value": "f31d52f76da823d70af510a904d4c37456280885", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001743, "uuid": "fb220e4e-89d3-4002-98c9-50ab4a2099d4", "comment": "Malware payload (Dridex)", "value": "0f542fa61891ca54520040710b7e951d5353fe7b0a14ed4a5db87904d9ea120a4141acafeadfb6b9191305def6e5943d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001743, "uuid": "1d1a5833-2d84-4dfc-b894-f478816de820", "value": "F224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001743, "uuid": "1d02539f-b635-4d0b-b4a1-21aba191ed82", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001743, "uuid": "f3432ecb-2605-4df5-8884-77f9f63215c1", "value": "3072:29Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:29Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001743, "uuid": "d8e36740-a5f6-4d85-937c-93f07e2dd4c8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001743, "uuid": "7d960954-b1d7-463c-ba33-483e0730a2bb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001743, "uuid": "0cb5427e-ad98-4072-92e5-faf6719bf184", "value": "30e5bac66477ec6ecc0d0d20e84be24bea0267d74c8c4b3ffd440b7475901a2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c124207-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003444, "uuid": "25f56b1e-c851-49e6-89e9-ce4c626d4086", "comment": "Malware payload (Dridex)", "value": "326af8e9a6f44db0596209b0b609fad9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003444, "uuid": "2f3d3d73-3c63-41dd-8992-28e3c0c87eb1", "comment": "Malware payload (Dridex)", "value": "30f3efe659bc0a44abb8b0de00a27eeba967180308d7ef6ecddaa9e275f28bd1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003444, "uuid": "249e0e04-7b3a-49b1-aec7-ebde24bebf3a", "comment": "Malware payload (Dridex)", "value": "adc011dc6534b34cdc11c9550ab5b1ab1ddfd714", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003444, "uuid": "3ac8e405-3d41-40a4-ba0d-64a958c39333", "comment": "Malware payload (Dridex)", "value": "60c3b570292e4814e87e645e7052f22cc5c67cdb2d3be5a1f4dcc9811602ba4b1e636ca236fd763b72c130fb652a226f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003444, "uuid": "e39b5603-a81b-4556-ba6a-cdaf4c51e0e2", "value": "8924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003444, "uuid": "280a03cd-595b-4002-aa9e-33249a971223", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003444, "uuid": "c96e8ccb-1288-422c-9355-c69aa71b7652", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003444, "uuid": "61440820-6a94-4ec7-a829-e20455898317", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003444, "uuid": "638b3308-2ae7-4701-b73e-1d5d27d77b6c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003444, "uuid": "dd11fabb-c1c7-49e8-8ddd-91e3af6d421d", "value": "30f3efe659bc0a44abb8b0de00a27eeba967180308d7ef6ecddaa9e275f28bd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681852b0-8757-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009504, "uuid": "66bbfe40-7851-4902-a0e3-470d507c4580", "comment": "Malware payload (Dridex)", "value": "e8fb1fa190893c5a28b571cde41162fb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009504, "uuid": "96ba6217-9b1c-4d3e-98fe-99232ec417af", "comment": "Malware payload (Dridex)", "value": "313f7104dbd84b53eddf8145df5deda5f610aa56e945b91bb94716a31cedb042", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009504, "uuid": "6bff2208-d115-4521-afb1-b62512e134de", "comment": "Malware payload (Dridex)", "value": "8e94d02367537822b92246e0f2635e30d7fa14ca", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009504, "uuid": "2051f016-2528-481d-8eb7-a9d0e6161d06", "comment": "Malware payload (Dridex)", "value": "bb8b4f8138d4b6bff34d2969cc3632baabe33ff39020476bedd7148feb1568a3e8314d82e19eecf80a6f8de6a770d139", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009504, "uuid": "5e6685ec-3b21-4456-8ceb-634bdad48fd1", "value": "4124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009504, "uuid": "7e19f48c-d93d-470f-849d-63800d8ac620", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009504, "uuid": "9fb58c91-ef33-4487-a172-0085edead525", "value": "3072:Z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009504, "uuid": "e0b9a7a9-6152-4fbd-91ab-a132a070abdb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009504, "uuid": "72ca06d0-199b-4bd8-8679-2d1bcbab7974", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009504, "uuid": "f4dad260-065f-4aba-b591-6fb8be3865c3", "value": "313f7104dbd84b53eddf8145df5deda5f610aa56e945b91bb94716a31cedb042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1cda5c-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004251, "uuid": "a384e77e-71f9-4029-8000-1e9d25ccfa39", "comment": "Malware payload (Dridex)", "value": "5a38ea0aa509df7b22cb549922a1b937", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004251, "uuid": "282dcb31-9253-4fda-a9d8-6386d1c5fb1e", "comment": "Malware payload (Dridex)", "value": "3146b9cf6a3b3376c3ea52223d5fecb5fc62f2f6f0d6d2b05b2058c1e9cfc919", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004251, "uuid": "4d6faa30-e58d-43c6-8c53-15fde78c7d45", "comment": "Malware payload (Dridex)", "value": "441b9777886cc073bfd291b5842ca6ab9d90079e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004251, "uuid": "74a38680-5533-4682-9f4a-0b06b726dc22", "comment": "Malware payload (Dridex)", "value": "af401ed337890441fd912760388b0e2675c6d34dd4af80b63424b87b5a056cb7e8ab225f1b69bd758c2e98c8d1d33b5f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004251, "uuid": "31833d9c-51ee-4a95-a412-7ac660373122", "value": "DB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004251, "uuid": "ba4cbb75-1872-43fa-b6b4-2b7047973d1a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004251, "uuid": "d5e85433-c5b3-48a5-b6c4-809e9a339c5a", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004251, "uuid": "4a12659c-8061-4b32-a551-e6e262f88a3c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004251, "uuid": "bc56a06a-e5b6-4528-aff6-cdbc63ab1155", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004251, "uuid": "6f70b404-67fb-40e1-9a7d-48950cba3cbc", "value": "3146b9cf6a3b3376c3ea52223d5fecb5fc62f2f6f0d6d2b05b2058c1e9cfc919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aae9f73-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615962102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962102, "uuid": "918d98b9-f355-4c54-b00c-44b032657569", "comment": "Malware payload (Formbook)", "value": "ad76dbb0bfa18773efb98725fff8905d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962102, "uuid": "fc917d3c-d262-4688-a8de-0ef3d73ab32e", "comment": "Malware payload (Formbook)", "value": "315bc1060cce584cb3f14eea91b41a3fd8e00aa6453acff4ef1603082c0b658e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962102, "uuid": "e460140f-f3da-4d1c-8687-b436395df7db", "comment": "Malware payload (Formbook)", "value": "32d5c30ff72e1301bae09e1ff1a733b4c4797243", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962102, "uuid": "2121c90f-6c4f-4a99-92b3-61d28076b3e0", "comment": "Malware payload (Formbook)", "value": "69dc30e656849d4254a0245399a392cb8a35082d6686f5e58326239a1eea79c163d94f80bd39b5b83af9db51df4a18fb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962102, "uuid": "7cb5360e-b72a-4d36-82eb-a8a1fc6322f8", "value": "3BA5335BBDC42F3ED428217090C7A6BC6529CF41B946CC13B345BA6835367F052EE7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962102, "uuid": "d5b16566-d85e-489b-8a05-6137d64112fb", "value": "49152:zBsQjZSB2u2/q1ecXG2b6SVYDk9uM8RTa6/OpLaUyFODQf6jwz:FsQ1SBaqpXG2bdYDk4M8RTarL6ODQGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962102, "uuid": "d12d6932-7c2a-4dfc-9b0e-6eae6356bb73", "value": 2259456, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962102, "uuid": "7db916f6-0bbd-41f9-bbe6-8b0f2b065abb", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962102, "uuid": "58d777ba-371d-4a3f-943f-6322c9174c45", "value": "SHIPPING DOCUMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca68f3c-86ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615971582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971582, "uuid": "68cf0c69-bc81-45d3-8b6f-e2690093e0d8", "comment": "Malware payload (Loki)", "value": "1b492df26be7109e2845db5277124872", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971582, "uuid": "fcb8cbee-14e2-4216-b71a-d56250cf6700", "comment": "Malware payload (Loki)", "value": "3166e6f474c4801cce964fe6f935a3aea19557ba9455f023f7459b9039604d5e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971582, "uuid": "bd22bb92-8fa1-44fa-a981-219d4f0459ca", "comment": "Malware payload (Loki)", "value": "a89e357ae6fa29588987a4077143c6a27780b4d1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971582, "uuid": "642ac433-ba17-4a9b-909f-960151f29d76", "comment": "Malware payload (Loki)", "value": "162f3253b2bdeae795b0d4d35978b3e9d109de0c51aa971f87e6839d5b3861a7ae2c8e316261b3d7a7d2f4e1299460f7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971582, "uuid": "e47f64e3-e07c-45e7-a190-83c84e9cd349", "value": "70C53379A8F15F0AD6ABF8745529C0AC01779D860D91CC1B3336BA79287B270B3E527C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971582, "uuid": "973fe53d-2db6-4779-a5cb-25876cb44650", "value": "49152:eNHhbN056GRLyiEWVg/TSABiYLeKcZxMNcQMgMRtVOIJNk2RpnNF:MHhI68yz+ICppxtVOIJNkOnNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615971582, "uuid": "a2de2a01-f826-41fb-9e73-dfc809c9b17f", "value": 2652160, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615971582, "uuid": "d7bfa04b-d255-4a8c-a591-d17de8f9cb00", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971582, "uuid": "71502b29-5dab-4fb8-9c93-d53f440db325", "value": "WAWASAN RUBY-AGENCY APPOINTMENT LETTER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e189d14-8743-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616000978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000978, "uuid": "f641d28a-6708-42f3-89c5-3f5a9ddaf884", "comment": "Malware payload (AgentTesla)", "value": "b014c61dc7c23364808516884d840d4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000978, "uuid": "544aa9e5-c813-4d4e-9f66-08cd1e44d058", "comment": "Malware payload (AgentTesla)", "value": "3169de9eef0fe8f4410d84330f984610dfe7488ecc1e429f5ef9699dc9af4b6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000978, "uuid": "139b9c74-bb06-4001-93c9-e959a2e97e40", "comment": "Malware payload (AgentTesla)", "value": "445f6e1cde4a5fd2ffc2c042d680e9d6de8fe2bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000978, "uuid": "95a9f349-1970-4cf4-a538-ea8a773902ed", "comment": "Malware payload (AgentTesla)", "value": "e71b041772a97c9f16b78d56d935dbcbff35dedfdb94df3f7cb8ef1d7238658e7a208dc94eae784d4fd56d7933bff202", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000978, "uuid": "72e3403e-b4c2-4721-a1b6-a74777457cc5", "value": "99D423CF36687312F646964DCB6C3E3C9C396AB1C861883F1F685B49244D0CF954AEA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000978, "uuid": "bafe9bd6-728e-4c46-9962-b5e76e9a961d", "value": "12288:6eJTpZ0QUkVLdz4+Cqc8R/U9ZJ/Y2IZ+LbliBnprq5slxBNztdpnCDg:nJ9ZU2dUL8F2J/Y2IQ1iBnMO/NJd9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616000978, "uuid": "083f9897-51d0-42b6-a56a-6f024dedabe8", "value": 631216, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616000978, "uuid": "c365e54d-1934-4c92-af0c-00ee2172611a", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000978, "uuid": "c7415dcf-c27e-4f32-9858-ea9942d9e88a", "value": "Payment Slip.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18a2632-8755-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008849, "uuid": "dfeef8ac-a374-4a33-ae35-709038a649b2", "comment": "Malware payload (Dridex)", "value": "47e07e11d4e2ee5d318898bb4e35b33b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008849, "uuid": "0279b589-c39f-41b2-9da0-feb21851ece5", "comment": "Malware payload (Dridex)", "value": "318b15abd74386dd6a5dd5423b3d2f09596f9e81eb8e410def6e10cef79ac477", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008849, "uuid": "bc8295e2-99f4-47a8-91cb-16416dfbd1d0", "comment": "Malware payload (Dridex)", "value": "d4f7b4dbe531241e7da1483e2a17b95bd6f07b9a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008849, "uuid": "2b7d6c36-9418-4965-8903-9702a08788ae", "comment": "Malware payload (Dridex)", "value": "bedb009e7c72b3e49e7130c2f0331f30f94297adbfa4ff3ae22c4ada97ffdd96735e6bcdcb9a548956751a569d58f366", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008849, "uuid": "94f08131-e46e-4d3f-9a6e-6e6ef24eba67", "value": "0624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008849, "uuid": "f471c73e-735d-4687-9a96-386a018dab92", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008849, "uuid": "8bf6877e-aded-42be-b28f-112e4fc36e79", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008849, "uuid": "699cb114-40b9-406a-b01b-46961416f8bd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008849, "uuid": "59f771aa-fe3d-4f62-9e00-10ba2d44f94e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008849, "uuid": "b76d1bbe-deb7-459e-8984-07e426f8235d", "value": "318b15abd74386dd6a5dd5423b3d2f09596f9e81eb8e410def6e10cef79ac477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d77ea55-8730-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615992789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615992789, "uuid": "411d4d14-223c-4b3b-8fc4-7e9b80f8956e", "comment": "Malware payload", "value": "03d77778cd23bc5e964e711688b619df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615992789, "uuid": "19f08a1c-6101-42d6-87ae-6aba54c11e88", "comment": "Malware payload", "value": "31bae768e13b6366fa2c94cc1ef9f3e1ca69104fbd37d7640535ab2282c47f13", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615992789, "uuid": "48fb6907-0175-4c6f-b568-7ade4ef53d0c", "comment": "Malware payload", "value": "be8c02fcb2776612a0175a0f8adaff6eb4401eab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615992789, "uuid": "0bcbd707-344b-4a76-bcda-f36f321fb773", "comment": "Malware payload", "value": "3b1acad1ce3d5d01a7bde30f1eced0a4b5f8f1587066cb8f8a3d81378498f188418681678892a64467ec6fca41c7ac2f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615992789, "uuid": "8fc606e8-4ba4-4886-89c1-e9314a55ebe4", "value": "3FB4AD21B9A2C035D5A651701E79DBB6446DB9340F6249EB73D80E3E5E302E26B32F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615992789, "uuid": "f1cac8d6-e44d-4692-adfb-f727755c233a", "value": "7cfebcd69f07e7b1bb4b19cde23234f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615992789, "uuid": "80c9834e-9848-4d05-a53c-ea2bd2d10bd2", "value": "12288:T3vtuHCXNde2JVzu1kC3YIaOnsk1co+xGSytZybkcorZWEPRSfN+mOeN:TVDC1kFIhnsjStjcWufN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615992789, "uuid": "d479f8b1-4d87-4ef9-b09a-9e23f20eb400", "value": 539648, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615992789, "uuid": "38300869-d2b0-4840-b89b-2afcb0c2aec0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615992789, "uuid": "8db590b0-6e00-4f31-b510-1a8296cabe9e", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9c5b68-86f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615966778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966778, "uuid": "554d09cc-ac19-4c75-88dc-15040d8a6fed", "comment": "Malware payload (Formbook)", "value": "c18c486e80f3a71cbdb20ec5082c86b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966778, "uuid": "c125d4e2-836a-48d0-95d7-edd3d8704197", "comment": "Malware payload (Formbook)", "value": "31de85bffebf15b904ab8046680be20058efb7a2a411ec79c694194082a93e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966778, "uuid": "1adffda1-8fe9-467a-892a-3406cf52cf36", "comment": "Malware payload (Formbook)", "value": "75e936d5a1a0aa0264d9660da5beaed1009883d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966778, "uuid": "56d9ee2e-9620-4f18-9f2b-2f5b27c44f3e", "comment": "Malware payload (Formbook)", "value": "3937a641334e9716b2d81e1021d913629532855f45acd88b8a222680656ce25f77d068e1ec475383f91f4191ae68f955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966778, "uuid": "6c40d9cb-6b2c-44a2-85c9-43ee358b498c", "value": "9F2412170DE190FBCA5367F10E776AF0E6B3D70602265A4B8B60AF3938251DA9D1B163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966778, "uuid": "995a0966-4762-4adb-baf0-a9b5af519411", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966778, "uuid": "e300a98e-8a6d-4799-96a8-5933ddb49cfb", "value": "3072:M3jqjLX1DLPcy2lsHxSoZQpTfq+Jhw3Ty07csJ+wF1AsCEQi/1ja4PaUCr9uvlJZ:MTqjFd9xVZci+87cUFs3qkuHjMc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615966778, "uuid": "146b0177-1efa-4106-b74d-6a26976b4f1a", "value": 218552, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615966778, "uuid": "9e07be2c-17ab-4718-aa51-a3c7451cfdd7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966778, "uuid": "31662d02-31a0-41c4-aefe-e854e84fb0e8", "value": "c18c486e80f3a71cbdb20ec5082c86b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7584169-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003704, "uuid": "33322fd3-f9f7-44c0-8570-941604dd6f24", "comment": "Malware payload (Dridex)", "value": "10463afd9a04a71e93cdc24b884406ae", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003704, "uuid": "82c422aa-6da0-46bb-951d-ba1483a78111", "comment": "Malware payload (Dridex)", "value": "31fd07e581b3876a80a2fcfec900c441d1050f809b1b84f79cb51d1a43a829d2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003704, "uuid": "b6f6c237-3f6d-4733-bcf5-8d62fc0ddaa9", "comment": "Malware payload (Dridex)", "value": "e555e3ea07db0daa88fd8cc5e4df670d21b7baab", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003704, "uuid": "9cbbba0e-8fa4-498d-ba81-03456b522af3", "comment": "Malware payload (Dridex)", "value": "472bf87a408d06d62ad10a8d1a55c10990cc97efcc12c76a0ab5532e21f388ddb418f87b9fa7999f4a039f46d8618f0d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003704, "uuid": "f67fd14c-ac44-499c-b658-aeb8a4fd24b5", "value": "E024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003704, "uuid": "edc6b6c8-352c-42bf-8382-24cd57bd80df", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003704, "uuid": "682c428a-fa72-4548-ae9a-778ef75529ce", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003704, "uuid": "c0a60606-4697-4e02-b807-85ea73a4f758", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003704, "uuid": "52feca85-cea8-459b-bf1e-191e74e68194", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003704, "uuid": "224c599a-ef57-4e46-9114-f0292aacc032", "value": "31fd07e581b3876a80a2fcfec900c441d1050f809b1b84f79cb51d1a43a829d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec32b036-873c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615998129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615998129, "uuid": "46de1010-6c92-4fce-a8da-b02cce2f54df", "comment": "Malware payload", "value": "b3c30a575695e713e8307b7c0b429557", "object_relation": "md5", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615998129, "uuid": "a5921ecd-e4df-4744-bce0-f3240ae7a88c", "comment": "Malware payload", "value": "32863daa615afbb3e90e3dad35ad47199050333a2aaed57e5065131344206fe1", "object_relation": "sha256", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615998129, "uuid": "ad621824-fe02-4985-94af-5642cb26c27f", "comment": "Malware payload", "value": "949d36ea8e47cb9530b1bbd3af29cf7b1a01b612", "object_relation": "sha1", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615998129, "uuid": "2eb679f2-9cd6-4fe9-b181-743fc484aab2", "comment": "Malware payload", "value": "a6484506db7c56544a4b5b3afab28fc6b705e8ada706ac4c23b856421b13bec8b250b9701879944113cb6b01179da9f1", "object_relation": "sha3-384", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615998129, "uuid": "12796eab-6fe4-4969-b5a7-f17084eac1c6", "value": "60935B67E7AA13E9C566D6B1CD318A37EB71B00C1924931F6764CE615F03721FE2AB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615998129, "uuid": "b0098eb5-7a49-41e5-bc48-9821998d3aa3", "value": "764ed648263eda7b23804788a664faf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615998129, "uuid": "d5fb7aa2-1993-4404-bab6-97b76d80bee1", "value": "1536:D7OJqI4D6qp4qMdlYhUER6/WT/J6gU7fFr0kdStHWInBPuYw:POL42wPMdYVT/g7PStxnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615998129, "uuid": "6066bc10-44bc-48da-a305-4e23db676653", "value": 94208, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615998129, "uuid": "8753e6c4-76d0-4a27-b5df-7762f43a943f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615998129, "uuid": "964a95ab-1ded-4d15-8c4b-8352ffc08611", "value": "64bit_decompressed.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f25bd7-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004427, "uuid": "adb70b7b-f1df-4980-86b8-f41cda00b0b3", "comment": "Malware payload (Dridex)", "value": "170c167d9e7de7cc9c596bcf22d0a1ff", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004427, "uuid": "46364f49-0217-40d1-8076-30fe5e31f070", "comment": "Malware payload (Dridex)", "value": "328fa96bb7ee45b376a2cfe808df4420f62a400aaad2dc86f97f252d93758f75", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004427, "uuid": "fc3ed76f-de68-46aa-89df-fc524f4327a1", "comment": "Malware payload (Dridex)", "value": "e93e55d94f3f678d2f12a967f02e20991d71e821", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004427, "uuid": "9c532f08-17cb-439b-9dc3-8e8c8a577b10", "comment": "Malware payload (Dridex)", "value": "845bc8ed773326813c50afbeae15b2455243e0dc7c840dc6352d0c24df45cd40334f229188e51fd83e3146139500cf7f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004427, "uuid": "cba9d81e-3cc6-490f-9017-6ec3f689649c", "value": "8924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004427, "uuid": "2297c05a-c7f3-420f-82e7-d5842380b64c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004427, "uuid": "184211c9-b9b6-4da0-b655-0ff0e21d349b", "value": "3072:19Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:19Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004427, "uuid": "8d935cd2-7e3d-4ac7-a356-0e19ab42e448", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004427, "uuid": "8028941b-93d1-429e-9274-67ab89dee54c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004427, "uuid": "d0873721-894a-45c6-b91d-61090bb6bc8d", "value": "328fa96bb7ee45b376a2cfe808df4420f62a400aaad2dc86f97f252d93758f75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c61c1cc-876a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017698, "uuid": "7bf7055b-09d8-4ee6-b869-729d4500b833", "comment": "Malware payload", "value": "5877a1b80fffb6310deea5b93da961e9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017698, "uuid": "939ac3f1-ddbf-4297-846b-49cd29bb61d9", "comment": "Malware payload", "value": "32aa200eef716fa72f7fb5ac227c3cc4cee195a5871aa1a1709e0f2ead24c64b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017698, "uuid": "f8a90d28-c1f5-4941-8fc3-c8e6120e488f", "comment": "Malware payload", "value": "b4be1dcc5a5add52e7b3268e07ff89ea84136bd6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017698, "uuid": "8c955bed-06e5-40d4-a3e8-323bd5a564ae", "comment": "Malware payload", "value": "61db6fbfa39c1c6170c815c776fa103099080f92573851c7b8a7d22e0ade144b01bd5a7f4b16bd281ad7d3d02e7d252e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017698, "uuid": "a1b12765-3000-448b-9b7d-485e192c8190", "value": "6A14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017698, "uuid": "99be1be6-3b64-48d2-ae6b-2278511fdb11", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017698, "uuid": "42aaf7f6-7bba-4801-8b20-d187eb91f9f7", "value": "3072:b1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Zi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017698, "uuid": "692edde8-5b6c-4501-bb97-a3ee7ec6e48e", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017698, "uuid": "3b2ad1fb-7fd0-4558-9964-b50f7d1924e7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017698, "uuid": "d74e9fa8-7125-4511-9acd-1a979655a734", "value": "32aa200eef716fa72f7fb5ac227c3cc4cee195a5871aa1a1709e0f2ead24c64b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7261922-8768-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017045, "uuid": "90158820-34ac-4c0a-a8a0-5c5f2a102c68", "comment": "Malware payload", "value": "46072875c200780f76f4e67cec751001", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017045, "uuid": "794fcbff-1129-4d49-9cfc-12e6b14e22d6", "comment": "Malware payload", "value": "32b19e279a41a8c8ca69606e2a2e2d297249bc3f8f6a26b2a6391b965fe00baf", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017045, "uuid": "f45070a7-7aae-4244-9ace-17bfc6de47bb", "comment": "Malware payload", "value": "a8c1cb9afa9cfb7e22b723d3bdcf354718ab381a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017045, "uuid": "48602aa5-2b0a-4799-b54e-48a28c1fa97f", "comment": "Malware payload", "value": "f25b40565a0a9d881608fb401345bd0b7b5e676b672824ee30c4f1eb50bae95fc347c2d92e0c9770f28fb5f4f49f62fe", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017045, "uuid": "2e7d22e3-2c41-412b-91ac-524117d9f17d", "value": "3F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017045, "uuid": "b42c2a73-5447-4d28-9118-f23d1bb3adb4", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017045, "uuid": "f80c7f24-9861-40fb-b221-3516de035330", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017045, "uuid": "7b1597d9-c4a8-4468-87e5-2836ddf6edb9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017045, "uuid": "d3165d98-ece7-4257-84f2-ef093a11c946", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017045, "uuid": "fd0e5a41-b84b-433b-90cc-d37132661b99", "value": "32b19e279a41a8c8ca69606e2a2e2d297249bc3f8f6a26b2a6391b965fe00baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d29ce75-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "ef54ddd9-32ee-4994-9b7e-35f53a40bdbd", "comment": "Malware payload (Dridex)", "value": "6da60536aa6a896f00445873a1ac25e2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "e64b7a46-351e-4724-80dd-47c92340819d", "comment": "Malware payload (Dridex)", "value": "32cf7edbd4a71238a01191725dedf041961231b5926cd4578f25d8e3aa632e80", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "98fbd1f8-5428-493c-8076-079ad9910527", "comment": "Malware payload (Dridex)", "value": "c8325bfd0e4c163b19b294448ae49a224e93290d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "1cf82232-9c0e-4dcc-97bc-f9390cb75fc0", "comment": "Malware payload (Dridex)", "value": "b8b7ec97f2f012f3530d7534518e8b96ad665a5ac6b24e29e015aa0c459560d32171e267edc7b7ee786b1a3c743bfc08", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "ffa1aca5-69c4-4ee0-b3d4-36916f893ff4", "value": "E924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "67f55024-8962-4d2e-b861-9a80c00f3ebb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "0cef3908-b0d7-44b7-9ed0-cbc6f962bebd", "value": "3072:W9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:W9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003956, "uuid": "228a260e-9f00-43f7-9a90-577184c10334", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003956, "uuid": "8f65f5f8-a24e-434d-b7c0-e00bcf189f1b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "7c878a6f-08c6-464e-8052-7d972519f950", "value": "32cf7edbd4a71238a01191725dedf041961231b5926cd4578f25d8e3aa632e80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72629f04-8767-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016393, "uuid": "6d8c8a4e-5dc7-4cc9-9d42-9e0679f20021", "comment": "Malware payload", "value": "5e06c4b7cf3a47e165456978ea2ad3e4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016393, "uuid": "faa52dea-1cc5-4d7d-a31d-8b41143151e4", "comment": "Malware payload", "value": "32d5977bdc201164e7b3891826b187f11f98aeca21f00dc7224f51e5e0e83d35", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016393, "uuid": "eb1bae10-1491-4b6b-9df2-df25dc9e7d79", "comment": "Malware payload", "value": "5c454718c515eafddd898343e7e392fad7d0e640", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016393, "uuid": "6c19f17b-f809-4192-a8ea-028b981edbfe", "comment": "Malware payload", "value": "371156dd2195720b26e0f733f2ae6471388545402ec8ea925060b8e2ac30fff1e0047c0c9702d05836c785b2a550ecc0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016393, "uuid": "f14eae88-0113-452b-b820-34d8eeaa1a39", "value": "4924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016393, "uuid": "0e54e4c7-7be6-4fa9-beb9-3998bbe2ec29", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016393, "uuid": "95fa41ff-8083-423c-8b47-91fe8db886c3", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016393, "uuid": "66a44334-fc21-4170-913d-1dbbf9342fac", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016393, "uuid": "ea6b70c3-b630-4603-8a4c-629ea7b6fe9a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016393, "uuid": "824ef69d-e4ca-40ac-a3ac-5da2c49c013f", "value": "32d5977bdc201164e7b3891826b187f11f98aeca21f00dc7224f51e5e0e83d35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f15cce-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003841, "uuid": "4fdf2932-e768-463a-b23e-ebe82c0c4acf", "comment": "Malware payload (Dridex)", "value": "719a27ddebddc668d269508c5b6e7817", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003841, "uuid": "a37f6024-b747-4c86-9602-7929cb038eda", "comment": "Malware payload (Dridex)", "value": "32efcd07e458d9a5bace3e2d038a81867651231853f57b4bcbe936ed2c92df1a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003841, "uuid": "ac831ae2-a758-4f0e-85ce-7393928721a8", "comment": "Malware payload (Dridex)", "value": "17bf03f9084b98345857f85ec36ee7ca986c6923", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003841, "uuid": "25a02133-fdbe-43dd-bfee-91f4a59e6a93", "comment": "Malware payload (Dridex)", "value": "909cd57fb4b598ea1f3fca44b5010d1be6bfc626e610ef3c9692be39df243effdbc83225bec17742f1ee52efb5d12be0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003841, "uuid": "24eac4bc-f744-46be-a7ac-31fceca2b6de", "value": "8824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003841, "uuid": "fc9b94f4-7132-432b-bc88-47ef87c12de7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003841, "uuid": "8efff722-8c8e-44d6-b955-22ff7b5ed0be", "value": "3072:/9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:/9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003841, "uuid": "6d397f5e-e436-471c-9b16-d7bedace2094", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003841, "uuid": "499f58f8-42d1-4ed6-bef6-10b7a3696406", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003841, "uuid": "3bc55763-f14b-4d2b-9992-bb6a894084e8", "value": "32efcd07e458d9a5bace3e2d038a81867651231853f57b4bcbe936ed2c92df1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6491d099-8747-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616002626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002626, "uuid": "0ea26700-77e8-4687-b805-2d3fb0c90b2d", "comment": "Malware payload (AgentTesla)", "value": "378d00c247d55301be996d485b04cd9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002626, "uuid": "8bd05be1-6f3f-4420-97cf-2eebaa2171be", "comment": "Malware payload (AgentTesla)", "value": "32fe4fab9fd944b405276381d98ce4c3e5044a17a557ab4b197068a8e3b0c958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002626, "uuid": "044bd7cc-6f3b-409d-8610-f468ea665a17", "comment": "Malware payload (AgentTesla)", "value": "f3d04d8fea6d8d0f82b89dbbae196cfa61df648a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002626, "uuid": "e19e9b7f-4829-4103-8bc8-8d236b49f42a", "comment": "Malware payload (AgentTesla)", "value": "4b6e262f0d210c02c2a064d9d5fc33b2dd94b7aa4244bacfd14326749807e9adaee4b45d5835bb7159775cba61446d6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002626, "uuid": "ebc21670-18f6-4009-93df-37fcbd493ce0", "value": "FF227BB4C554FE16C127607EF07942FEF35D68539523746A324AB24D4A8128B4B6F1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002626, "uuid": "483d93ad-378e-4eaa-9ac0-dd69ba6224a7", "value": "192:ScIMmtPSkfG/bWb9AiP4gkWFuMp2hQD1DxJp3did:SPX6k6Wb94PacI1FJFdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002626, "uuid": "4bbeda72-f41e-4d95-b3dd-eac49a78b215", "value": 10318, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002626, "uuid": "54def2c1-b25c-4d0a-b3b1-f822b29402bc", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002626, "uuid": "66a68d2d-fa6e-44ab-a4aa-7ad1b758e64a", "value": "FedEx798522.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce70a8b2-875e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616012682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012682, "uuid": "5fb088ba-d962-49da-8eda-047200d2c4f0", "comment": "Malware payload", "value": "ecbafb376eaee9a12421e41ecce2e17b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012682, "uuid": "12b0931f-e535-43ff-9156-d22d442208b2", "comment": "Malware payload", "value": "33000b6cf8fae9fba76b290bf0a6899b3a061ecc4b516b55f0740080e95d4aa8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012682, "uuid": "7b013be2-e512-44a8-ac37-c00bbd612325", "comment": "Malware payload", "value": "790e075a5fb2d7857796002dcffcedb245df0c48", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012682, "uuid": "2a057525-80c0-4e45-b206-c0423f6cc3d2", "comment": "Malware payload", "value": "e47ac108b7b8bdac9518c48c38ed42be58eef75a3e84861b8281c7b0dbcb83c61dc48c247c75c108c3d036c4639e6c38", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012682, "uuid": "5873e862-d9ff-4bf7-ac6a-61802d93a1fa", "value": "7124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012682, "uuid": "bf876f6e-0128-4089-a223-c07dc9f609db", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012682, "uuid": "784dface-fe64-4604-90df-6d17302edcc9", "value": "3072:G9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:G9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012682, "uuid": "6c17480c-a654-44bd-9e7b-8e97a9747c68", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012682, "uuid": "14c6567d-46d5-4c64-a194-5513b7a39a7d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012682, "uuid": "12f52c28-cbf0-4fa9-bd02-d0e0d3beff5d", "value": "33000b6cf8fae9fba76b290bf0a6899b3a061ecc4b516b55f0740080e95d4aa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8055dacc-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001814, "uuid": "ad92b1d0-c903-41a5-a8b8-c40ca618a504", "comment": "Malware payload (Dridex)", "value": "722f90af0d9a14d67bc37835750fc48b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001814, "uuid": "2a7c8c46-36b9-4453-8c11-1d1e01b511d0", "comment": "Malware payload (Dridex)", "value": "330256289813ec2df9bbaddb08050be3dbded2a63f56cc3656d1d2147884978f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001814, "uuid": "4b6c41f6-715c-4449-a684-fa6342240ecf", "comment": "Malware payload (Dridex)", "value": "f19202abe5821fa6621be5a3be7cb0a74064e712", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001814, "uuid": "78f992ef-8c38-4445-ba61-516686c02a43", "comment": "Malware payload (Dridex)", "value": "b61a3ab18ebf1b469e5582d3eb928eb0acc0dd1beecec343e8f4a1e8c8e8f263a3771cbee1cec76cbe187bda3e102903", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001814, "uuid": "b0192c43-2627-49ac-952a-5d3007c9738e", "value": "1824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001814, "uuid": "dc1610ef-12fa-4a66-9b9c-6b90511e1ed0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001814, "uuid": "c1c86353-9a51-4579-b228-00097bee7d5d", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001814, "uuid": "268ddb1b-4868-4770-abf1-fe7b53c66611", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001814, "uuid": "7e3b241c-9766-42ea-ad69-dd975fd61f0b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001814, "uuid": "c9055598-5ce0-4d1d-8f03-f5e40743775e", "value": "330256289813ec2df9bbaddb08050be3dbded2a63f56cc3656d1d2147884978f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edde65d0-870b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615977087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977087, "uuid": "65a83c21-c623-412a-aa40-91c967ac5080", "comment": "Malware payload (SilentBuilder)", "value": "00af357f6b9edfd42e7614da4d2fd475", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977087, "uuid": "ce96b03f-d02b-4bed-b27b-0048d9eb107e", "comment": "Malware payload (SilentBuilder)", "value": "335d4f64dcfce5ffe2d8e51ea6fc7472372053f3cb9443a4cfd36cccd7e40008", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977087, "uuid": "24690846-ce82-47ed-8997-832aa63bbfd9", "comment": "Malware payload (SilentBuilder)", "value": "2b592a7dc63ebeefeb14d54684f7b5af76fea692", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977087, "uuid": "20ddfe51-917c-4b03-865e-38fc56c917d6", "comment": "Malware payload (SilentBuilder)", "value": "4ad4884958055e4bdfdde5a15e47fe94fbe15255418be73750eaabed09ef92634826add8f92b621b6d59a690d2b23c22", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977087, "uuid": "8cef0a59-e4ae-4a1e-8ad4-fc250de84027", "value": "20F3FC47DEEB472FC5845B3A41B34A1A36D28C4847DB024B5BD9FB6A5F7EB452E00AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977087, "uuid": "d346c156-a27a-41c4-9c20-d4c31bfdd720", "value": "1536:6iUd4TaBcvfYfRSVPcq3HWG0Rv3r3MQJAWOm4sYnQi:6iUd4TaBcvfY5SOq3HPUvb3ZIlVQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615977087, "uuid": "a0a9fd99-df84-4e2a-bab6-cbb029453ad1", "value": 168448, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615977087, "uuid": "1daf5fec-315c-4a50-9f92-fed16d66d65a", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977087, "uuid": "d1290100-2c78-4011-8e9a-a8ae9e26fd3d", "value": "document-395533519.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f5902f-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003242, "uuid": "ef510c70-0572-4458-a253-91e3d42f984b", "comment": "Malware payload (Dridex)", "value": "014163be385f2262c0a4df5a986df79f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003242, "uuid": "a39b3b94-81da-4658-a4b0-473743ec0349", "comment": "Malware payload (Dridex)", "value": "337b2d104c393c492427eae64b8cee95f29e747bc89972d4c81db87c1854f192", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003242, "uuid": "f32fe1e2-453c-4c15-8bca-84a10cf2b113", "comment": "Malware payload (Dridex)", "value": "fb07d8f6d36f1eb6379a631b7b5765f494ba8036", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003242, "uuid": "83dbc638-5d8c-4246-95ae-9221ed1872c1", "comment": "Malware payload (Dridex)", "value": "3367c5d39c9b19e1374b8c21fbe1a1010cb4749d4e000d327ce47e5d1e7caf44dc81203b9f723d838f97792d8ecc3295", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003242, "uuid": "0907c7e1-ea64-4818-aa69-e4dd302b85b8", "value": "7E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003242, "uuid": "8b024afe-9cbf-4b4b-b61f-2a0b86866dd3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003242, "uuid": "88c52544-0af2-4089-845f-7fbeb72747b9", "value": "3072:Z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003242, "uuid": "e31aaef6-3090-4d46-9bb4-9608bc818687", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003242, "uuid": "095c402c-7413-475b-867a-764e662eb6d2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003242, "uuid": "c06f4f99-cf22-4567-a91d-c6fca3200868", "value": "337b2d104c393c492427eae64b8cee95f29e747bc89972d4c81db87c1854f192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93017972-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003563, "uuid": "710a27ac-7812-4045-8c12-a53ef7a70d5c", "comment": "Malware payload (Dridex)", "value": "5a1ce9339048f05a086ae41cd1fffdee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003563, "uuid": "099f99d8-16d7-40df-bb89-6d61bdd9a960", "comment": "Malware payload (Dridex)", "value": "33981edda1da29e0f277d5a9f18f33270a08f569c550ba14acc5521c780fad04", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003563, "uuid": "3c6cbd99-1212-4408-a80d-9b6c339ada82", "comment": "Malware payload (Dridex)", "value": "e515b54b4265e9abe17cd98cdb07c659d05dc672", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003563, "uuid": "57abf5a4-054f-4fe9-b820-9c291df7824d", "comment": "Malware payload (Dridex)", "value": "43f7c19c393e0f3f7be5280a9d5bc08618b18ce1304047b59f5bad31ed9e6e2ef03a07ec62d239d6bc1afa8cafce8089", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003563, "uuid": "15b48bfa-9c1b-4a8f-9f75-95798a792a21", "value": "4C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003563, "uuid": "bb331e34-fb86-4f53-a14e-c4415dba821e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003563, "uuid": "308f8451-4a81-4762-b347-8be7a1939db6", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003563, "uuid": "52e6c900-fec4-45bc-bc0b-1e757dd7580d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003563, "uuid": "62b1d64d-38f7-4f56-b729-c7d36dc19bef", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003563, "uuid": "4ed3fa40-549a-44d5-9b12-c258592a0a13", "value": "33981edda1da29e0f277d5a9f18f33270a08f569c550ba14acc5521c780fad04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dabd57-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012968, "uuid": "7f59d316-60cf-4667-9c94-96269b9757f5", "comment": "Malware payload (Dridex)", "value": "a762bbc08e96777ae1d1a5a41bb59f98", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012968, "uuid": "2ae2b447-e278-4e05-85a3-7a8af8d20111", "comment": "Malware payload (Dridex)", "value": "34088785d612642cf208111b019f01548b9a4b0c38e1a71cdf87ad7c641344d2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012968, "uuid": "a4692bde-9169-4b89-b255-bb187c8a5442", "comment": "Malware payload (Dridex)", "value": "7331df7a12b73b8799d16296ed9a4d6570868509", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012968, "uuid": "c898ca04-61b1-4067-88db-4173c7349050", "comment": "Malware payload (Dridex)", "value": "c248c0996f543f73b0a2cba72a837cd8ad527176d9c3158d9cf5e90a693598a9446f6102ccd1f02acf0955e7035787ea", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012968, "uuid": "97d0473c-b439-4b7b-9472-dae441233732", "value": "7524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012968, "uuid": "a2c286cf-7898-4774-a742-5a5077e4b9e7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012968, "uuid": "fd5aad1d-b5ae-4ab0-b23d-3f24ec93899a", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012968, "uuid": "9c3c9539-5cd0-4894-b77b-b308a3e40ede", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012968, "uuid": "59fca967-3b2f-4bba-93a2-a3b1c3440508", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012968, "uuid": "81c99b42-4f31-4abf-8147-c01b5336050f", "value": "34088785d612642cf208111b019f01548b9a4b0c38e1a71cdf87ad7c641344d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d210c9b8-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615969738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969738, "uuid": "6ff62147-cd1e-4d04-9eda-9814996deb13", "comment": "Malware payload (Loki)", "value": "60d56462f5580adc3b541a59cf8717df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969738, "uuid": "f9481545-5c65-4756-b255-a71d2bdb4725", "comment": "Malware payload (Loki)", "value": "34090212e6ac7c4aeb61f2a0b1a3a7af88ae240e1ecf719bd49a145d6deb4e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969738, "uuid": "4263c286-05e4-4c1c-8316-eb39224254ae", "comment": "Malware payload (Loki)", "value": "d22a6fc021b887c8fd738620b5396b788f483a0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969738, "uuid": "a57f1092-1e55-40c3-9f5b-c584ca764da4", "comment": "Malware payload (Loki)", "value": "9718bfb538c0fef40f3a8405fa70dc703636d41a9aa5b5630c130f47f4f263dc0d96286b386dafdf0d7a6b7164250fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969738, "uuid": "d2a338b0-3e96-4f48-9fdc-f977d87d53c7", "value": "C9D49DD16740A664D8A30676883B9AA36573E50D9D68C53E2C92FF4F3DB234600778BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969738, "uuid": "0e7d4c75-4962-4d7a-800d-47c57094e1f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969738, "uuid": "9882c7a8-4780-49e5-9c8f-92649b130dd1", "value": "12288:hHpij1BsMRjyk+E0cCv+yqPmGXOIYncuTeDtbmlu1tdAA:h+K+evvfGXOIYcuTObVnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969738, "uuid": "a24d1a40-1650-4923-b9ef-2b5c783f694d", "value": 619008, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969738, "uuid": "000dc23c-d292-4e23-88b2-4ea33c77c257", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969738, "uuid": "7f9293c9-7d4c-4f93-8093-664672bb8990", "value": "60d56462f5580adc3b541a59cf8717df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd1b24b-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009082, "uuid": "b988d875-df7a-4acd-860b-8be2d2dd6cb7", "comment": "Malware payload (Dridex)", "value": "8e5fe841116888a0266a5d1abe5f71e5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009082, "uuid": "8d81c67b-d94c-4f0f-b61e-6a61ffb433ae", "comment": "Malware payload (Dridex)", "value": "34259e9b02133657700ddbda3df6fe5e264782e7a27b065c689114969fa5f18c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009082, "uuid": "fc118e92-edec-41b7-8b11-c2f77288e2d8", "comment": "Malware payload (Dridex)", "value": "78d91e5e8e3632ea1cfef78c29ca1a73bc0f220f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009082, "uuid": "6f808981-093c-42bc-8b76-032b4484a7e5", "comment": "Malware payload (Dridex)", "value": "d73a8ebaa55c55533c7707075e60040c6b95d9581e5ed133840b37cfe47af602d445927c8e35696d6ea1f9366c9ccc5d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009082, "uuid": "5b93c05d-48ec-4a28-9bb9-029a750ed250", "value": "3824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009082, "uuid": "6cf88ace-3dc2-44fb-a8b5-500f1d72110a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009082, "uuid": "6c6e2d86-876d-4689-8fe8-cf585d7c0fda", "value": "3072:s9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:s9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009082, "uuid": "755f2c24-8942-4aac-9c97-91c1cc093fc7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009082, "uuid": "de3fd4fd-e5b4-493d-8ebc-498e77f76066", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009082, "uuid": "78106781-5761-4798-95bf-5f2df476581a", "value": "34259e9b02133657700ddbda3df6fe5e264782e7a27b065c689114969fa5f18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f6e1c6-871e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615985150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985150, "uuid": "c5d16181-0464-48d3-a23a-33c96da9a253", "comment": "Malware payload (AgentTesla)", "value": "c694533ac15de4338888c4f93e643326", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985150, "uuid": "5be4ccef-8e8a-474a-b21a-9b6a26ba51f5", "comment": "Malware payload (AgentTesla)", "value": "3468cda4f6d72b10b55f969fbbc5633ffe6bbbc3615c7d529093929f05d5a3a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985150, "uuid": "c1cd11d6-f81f-4e3e-91ea-8080042a8bdf", "comment": "Malware payload (AgentTesla)", "value": "d2059223a5c9353d4af3601cfa5cc38098d300eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985150, "uuid": "5e069c62-ce33-4d59-b353-45385e8762d7", "comment": "Malware payload (AgentTesla)", "value": "b19547d4b44f28b838a52b98574e530730303b00285e471c6cade2f63512f4795cbba6a45a84e74dcfdde2f72bdfe3f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985150, "uuid": "6808393f-aa03-43a3-b82b-10583d838753", "value": "0F15335FF32E16B6FC132A6BE5EA0B50A337682447F6614331C6A24B763D5D093B185C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985150, "uuid": "546fb5b9-4ae0-4cc6-a459-db608bbf00ca", "value": "24576:AMuA/AWjGK44lhdHQQCMPUIDxCqngywvrLHYF:AMuvWjGK4cjQQESAqnSf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615985150, "uuid": "2492ff13-e990-46b1-94d5-5f7cf3b7a610", "value": 880327, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615985150, "uuid": "555bcbaa-314b-4675-bd76-a34c319293d8", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985150, "uuid": "c67a15ef-43e1-4e21-965d-4d4da37b2180", "value": "11317693065_03162021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c178d330-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004070, "uuid": "acc0e605-efab-4642-94fe-8511ed766a3c", "comment": "Malware payload (Dridex)", "value": "99cd879a090bf5dff38e4c7038a60a32", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004070, "uuid": "de6b81fa-56e7-4c80-8960-7af68929f4f8", "comment": "Malware payload (Dridex)", "value": "3492ecab20f2a865fd9374a2d5a705ca85adccba4431dd9ca5394041b49559d9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004070, "uuid": "7879bffa-6cbd-45fd-a8a3-5667ee31657b", "comment": "Malware payload (Dridex)", "value": "d3d84e0705e96ceb931130e702e9d04bb086966f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004070, "uuid": "9317ce70-e894-4a13-8182-2ec62e685388", "comment": "Malware payload (Dridex)", "value": "10ff9d4eeb995310da4fae682d9a7b69461ff0403a2a74cae493fba30043b15a3c62e84b119d1449f46a49e5aef054a1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004070, "uuid": "36d3ed4f-3607-49a6-81f6-9edb157bc528", "value": "7924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004070, "uuid": "01f4b680-25d5-4219-af59-7670dc408df2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004070, "uuid": "b3ea4650-d70e-4786-a1dc-cbc70d2f9c43", "value": "3072:I9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:I9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004070, "uuid": "00883ee8-2707-4db6-ab6d-0762ecb83b6b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004070, "uuid": "5a97d80d-6fbc-45d0-9010-d7fdddf17f0f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004070, "uuid": "cacb11e5-14d7-4bf2-bfe4-498e15b9f47f", "value": "3492ecab20f2a865fd9374a2d5a705ca85adccba4431dd9ca5394041b49559d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dd40a3-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "340c97c9-9a6f-426e-b94b-b50023502e2e", "comment": "Malware payload (Dridex)", "value": "900d4ddd679ec8bad97356a461234fd7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "f0ca5eba-e439-401e-9075-ea6963c6f260", "comment": "Malware payload (Dridex)", "value": "351f6071826cbaf6b02c619c5c9238942eb93b0ee58fadc9ca1e8e06a472137e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "3d9dc45b-9d2c-485b-83cd-76a750776867", "comment": "Malware payload (Dridex)", "value": "dd4adaee419c53d57a778c72f362ca25d145040d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "50ea85d7-99e9-4115-845f-5e28d91f89b1", "comment": "Malware payload (Dridex)", "value": "06e8ba567564a5f466f0e9f60c44d52ee66e7683e26e039332f54056e7b68f85d313378065fd6f7a818a8d62ac81d222", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "80bb14dd-90a4-41ef-bd97-697f73bcc118", "value": "D924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "5fed4df7-210f-4fb3-a8ca-be282c25179b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "0fbaa9da-0567-4322-85b0-7a0475f90e4a", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003729, "uuid": "546ba6e6-93ad-4ece-8d1d-aedc0e0b8ab9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003729, "uuid": "36296f7a-1177-47c4-a752-79e7cf9b5e77", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "102f6e46-5a95-42f1-80d3-8529b006794a", "value": "351f6071826cbaf6b02c619c5c9238942eb93b0ee58fadc9ca1e8e06a472137e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23343c2c-8720-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1615985766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985766, "uuid": "f8c453dc-160e-42e4-a398-9886ea9c424d", "comment": "Malware payload (TrickBot)", "value": "b5bfd975c401e74fc1092a17509332d6", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985766, "uuid": "0acc1b6a-6b59-4249-bc6d-c6651d7919b8", "comment": "Malware payload (TrickBot)", "value": "355532e163bce4bc8edd2efb72f27e10e6b2d867c4099ad129c6ff10d9a259a8", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985766, "uuid": "ce939aa8-c894-4170-8a36-45815082dcbe", "comment": "Malware payload (TrickBot)", "value": "bdb0cddb69e2729a0c669145dd69b388dee3da3a", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985766, "uuid": "c6e66d7f-a0cd-4f8f-a6ca-a80dc54f9db5", "comment": "Malware payload (TrickBot)", "value": "cf0885f017f4e6a5a71870306cedc6fa44bba24e578a2d572dd6a78ba2af7af8f74ffcb08c09eff46514dd677f6a3a99", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985766, "uuid": "90caa2d1-fae8-46f6-a05a-3219439135e5", "value": "2FE3011E1A11BC22C798033894A7C3E39B06717FF372E65AB94CD8362F60BD56E1D54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985766, "uuid": "f43f374f-3dc0-43f8-9165-febb09bb816e", "value": "3072:U66ApupSzxNEBBD+Os7/xxkKCtRbsYO1entseoXXy:U66IGSzx0dmxk7RbsYsKtseoXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615985766, "uuid": "3bd03be1-b9f0-4817-abe7-f0d2a03ba643", "value": 152892, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615985766, "uuid": "2993d934-c11e-4a76-8fa5-eda7d7570aa9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985766, "uuid": "21134a2b-5f08-4890-a3f9-7518c9379252", "value": "aaaaaaa.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739674a3-8775-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616022408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616022408, "uuid": "8d5e2a0f-a117-4eb5-bbc4-e8cc450c2e93", "comment": "Malware payload", "value": "0db34734b368ab2a7edf073dd245312f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616022408, "uuid": "dd3e5b14-2ec4-4e6a-9916-90a0feceb152", "comment": "Malware payload", "value": "35cfdf3187413ecc2a6e8a07af212259722feda0ea25486891aad7b456f1a9de", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616022408, "uuid": "29da4e95-95e2-4858-b7ae-a1d093ebb36a", "comment": "Malware payload", "value": "dc84fb8aa0f4a523b3b575a9703799163c8e92c6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616022408, "uuid": "800cb7c4-f07e-4848-87ed-1058ae7bfaef", "comment": "Malware payload", "value": "220a4f3043121d68986e9aff2c9a2342bd68e22526e3eb0590790c3afc0a22aa7dadbf21e14a73465844f0065e68aa6a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616022408, "uuid": "3bb3ae25-b440-4de4-a7f9-1384dc29cade", "value": "9C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616022408, "uuid": "bfea7ef6-fff8-4ef3-b633-51ebd22b0f1d", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616022408, "uuid": "81284732-199a-46e0-b15d-d4a402349560", "value": "3072:e1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:2i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616022408, "uuid": "de95c5ce-4909-49b1-871e-d793867f9c80", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616022408, "uuid": "82a2c058-b9ea-44e5-90a1-944995540074", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616022408, "uuid": "546e2db2-256c-4139-884f-8f5a3c10cd81", "value": "35cfdf3187413ecc2a6e8a07af212259722feda0ea25486891aad7b456f1a9de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5961cb-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001834, "uuid": "f54c68fb-104a-42e3-88a5-47baab1e012a", "comment": "Malware payload (Dridex)", "value": "b300a1ed44428dc2163783a4a97a67d4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001834, "uuid": "7565e137-9c73-43e2-a1e9-f45559533bd0", "comment": "Malware payload (Dridex)", "value": "35de81d5d3b8d50fc0eb87a642c24f251053b504dbbf4c276694be608736513e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001834, "uuid": "dacc1eee-894f-454c-a7eb-81a1ee01501b", "comment": "Malware payload (Dridex)", "value": "ea6990ff371ffc6ee2359d69a821734b5c4a71d0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001834, "uuid": "c447d3e7-d657-4951-be51-aa80705302dd", "comment": "Malware payload (Dridex)", "value": "e702293a4e76dcc386fa0c2a94131ae283632869195d62fd8826128de6ae2c53c1a81c0b11fdeeab4952e4a27565b9de", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001834, "uuid": "c0fa1e06-5300-4bd4-b575-db67a0d23f18", "value": "CE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001834, "uuid": "f887d74e-093b-494f-ba10-4b40aebdbd81", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001834, "uuid": "ca160da8-9379-409e-8490-818290bd1634", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001834, "uuid": "ab870db6-db00-43b2-8200-928e6bef33fc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001834, "uuid": "88aa8f03-de12-47b4-9e1f-8b67e4f5ba4b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001834, "uuid": "98c67975-b404-451f-8601-94e3fc7b4581", "value": "35de81d5d3b8d50fc0eb87a642c24f251053b504dbbf4c276694be608736513e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c100a6a7-8746-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1616002352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002352, "uuid": "5628b925-07e8-43c4-8bb0-5cbea705df6f", "comment": "Malware payload (FormBook)", "value": "9b3eb9b732ee9ca5599f9f9027e08957", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002352, "uuid": "f9ee2302-e419-4b3d-9c47-bec9a2cbcd41", "comment": "Malware payload (FormBook)", "value": "35e14194e300e1be5d62f61014836a854802365b86fe9e1a521f24ecc8dd9dfa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002352, "uuid": "eef906ac-88e9-440e-9b85-76a63fbdeb8f", "comment": "Malware payload (FormBook)", "value": "3c1ea87aac3634ff890d0f588851bb43f5589adf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002352, "uuid": "372866dc-4c88-4a28-b3f0-a2f748950270", "comment": "Malware payload (FormBook)", "value": "3a1be9619d446a182167291745af7e3c836af8c4a373fa3ec4eb4aad14505c5205233ac90596d42ee3897af14a8881a8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002352, "uuid": "f10db511-201a-4824-8e65-679ff8d25e96", "value": "430533432F0A71B5907AF5EAC6AE48F42C8211054A4D9BFC32AFB850D2DB05FFDD6616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002352, "uuid": "2e5af88d-aab4-4e03-a0cb-9efce22e1f43", "value": "12288:/UjjQ+8PmoN8KUJZpoYT8YxolYENH4iLdaZ7zTlTcoS6Tdyg2449ranrgePAkEXj:/qjQ+8OooZpoJY+lRHpdO/TWoPYKAk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002352, "uuid": "7fd9b72d-7d2b-43f7-8858-f15da6841df3", "value": 826439, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002352, "uuid": "df45013a-1de4-4327-9db2-6be556463dfe", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002352, "uuid": "37c5e033-4192-4ca8-b728-a19a7017fcdd", "value": "TT COPY.png.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4fa81f-86b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615940147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615940147, "uuid": "f553534a-ab79-42db-b752-8f65a4a133bc", "comment": "Malware payload (AveMariaRAT)", "value": "09dbc4b8a3dd0fc09fcc4357da18356c", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AMSIBypass", "colour": "#983134", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615940147, "uuid": "b0588e98-9857-4cf0-aa6c-5f11f907aa6e", "comment": "Malware payload (AveMariaRAT)", "value": "35f7add57f5349448f9db9f6d2ae22bac227d4ed398d21c9110407c6e7e7eb4d", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AMSIBypass", "colour": "#983134", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615940147, "uuid": "9237638a-374d-4fba-85e6-5bb8d3096966", "comment": "Malware payload (AveMariaRAT)", "value": "7018c64fabc73dca3a32a138c7cb0d625349d284", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AMSIBypass", "colour": "#983134", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615940147, "uuid": "64c2224d-4b0b-4d12-9c34-8dcbd2e3c3bf", "comment": "Malware payload (AveMariaRAT)", "value": "0361c8c3928425f34b1be130201db1e70e45c66d715837e6dc47eb2f190456320a746abef9ab0b73c1fc2fe772091e26", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AMSIBypass", "colour": "#983134", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615940147, "uuid": "fe1e36ec-9e06-46f4-95b5-7d39106bec6a", "value": "7505DE72034457BAF2840BD4461B325E30F2D19A3A181189DBF36EDBBD2BDDF9470A66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615940147, "uuid": "dad9cf10-967a-43b7-8c07-643a33b89cfd", "value": "1536:3wcCqLl1ZunvevJzR7y4YbJaeiUd2ySRsk+NMpLZXWVBgE+Ub5aTTu7YY3E3+jcp:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615940147, "uuid": "03b07e7a-39c0-4e68-b8a4-d602481cc55a", "value": 811103, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615940147, "uuid": "10cd6047-2427-46e6-ae89-0a4335d9d492", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615940147, "uuid": "55604641-15ff-4c08-a844-9d124d79f324", "value": "amsi1.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbcda75-8768-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016652, "uuid": "0d4b9d9f-f318-4a71-9ca0-ce6c1f863084", "comment": "Malware payload", "value": "5b8017e2ee338e734c900c0553707d0b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016652, "uuid": "f816edb1-d92f-4726-acba-6e488f8a15ea", "comment": "Malware payload", "value": "35f9e0cdb3453f13eac62e1a99c7e9597b7eafe72342608bf16c557e66722cab", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016652, "uuid": "4a56762a-4a06-4d53-9677-bce3ecfc5076", "comment": "Malware payload", "value": "620aeb372038d6498bfc4ab0572502701ef756a7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016652, "uuid": "5508a16d-1adf-4c4f-a93c-39ca3de44024", "comment": "Malware payload", "value": "8e7e5bd3b549c97633a8867b0cfb809b2b7ef2f7ffe7b4d64ea68a255298a378fdcc4a9cc0db9068e7e9f5816c1b408e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016652, "uuid": "f2fbdbe9-0afc-4796-b137-ae23e1dd4c1e", "value": "2A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016652, "uuid": "5b5ac212-1715-42c9-8fa9-0989d1d84ada", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016652, "uuid": "e91c293f-7660-4bc9-9032-dcaada193805", "value": "3072:69Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:69Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016652, "uuid": "c723f5ea-5583-4f22-b004-82eae062aab9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016652, "uuid": "7b5695c4-2d1b-445a-bdb6-ce8a99284d82", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016652, "uuid": "ee010c75-dde8-485a-98e2-f5ffe745442a", "value": "35f9e0cdb3453f13eac62e1a99c7e9597b7eafe72342608bf16c557e66722cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5459e904-8757-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009471, "uuid": "30d64aa1-8dc6-4a36-b819-acf3eb6f587f", "comment": "Malware payload (Dridex)", "value": "640aee952885ec42ef94fea5a98e6521", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009471, "uuid": "16a6b19c-214d-452f-bc61-d2c3332d4282", "comment": "Malware payload (Dridex)", "value": "3612179da48f78e905a5b47d22b9a7ce6b89241747627c03d9c2675de2b268c5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009471, "uuid": "6a9b5464-2c99-4945-8b35-8fcbb8ff2073", "comment": "Malware payload (Dridex)", "value": "f920b844214b1f58261d9e1cf04ee3bed2fedb1c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009471, "uuid": "f3bd40af-2090-479c-8028-7bb814a42fce", "comment": "Malware payload (Dridex)", "value": "b67f20810ca11ba277d0d01f3a64b070212b1eb76231dd24990e4164ea842435af6b61fa7366ac6eda3ecc6ae060f7e2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009471, "uuid": "b7975f29-c20e-409a-bd19-ca08f8e028cd", "value": "E124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009471, "uuid": "1d60deba-0885-481d-afae-3cdf54600e45", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009471, "uuid": "64e8a445-e81a-4060-87c7-bc6398c8da88", "value": "3072:U9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:U9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009471, "uuid": "606d45d5-3195-478b-ab3e-555e4651bc7f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009471, "uuid": "7320ec3a-d559-4026-af5e-592a8f0a127a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009471, "uuid": "c7391150-8000-4f7c-af96-df9f84ea8c7d", "value": "3612179da48f78e905a5b47d22b9a7ce6b89241747627c03d9c2675de2b268c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0dc65f-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004088, "uuid": "bfdfed07-9fd3-4cca-bd82-424719916236", "comment": "Malware payload (Dridex)", "value": "5d4b3ed50140bcd443fa83e82199ff58", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004088, "uuid": "218ed598-b746-4dad-876d-b6457f262524", "comment": "Malware payload (Dridex)", "value": "36ee9582fcb89cadb643c3775ab836c28965d5bdcc1e1648ea6e77699d926a55", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004088, "uuid": "e32e5282-98c8-4bf8-992b-247fba30ea88", "comment": "Malware payload (Dridex)", "value": "5259fc65fcf3952ef43de88d44665996191fe715", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004088, "uuid": "c5d99fe0-d439-43a4-9c92-a3a03897ad8a", "comment": "Malware payload (Dridex)", "value": "a58471d0dcf487daba873d6d277dadaa8dfe8afb6d9c318d97d717cffb5fd807e727d0302cdd1df95bdf9378e1e32a6a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004088, "uuid": "c4624997-b31f-4f1f-a644-ff0c8aee6efc", "value": "CB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004088, "uuid": "714a56f0-3b07-4eb8-b396-29c066b64872", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004088, "uuid": "946e5188-7afc-4f82-9a30-6927e035e37a", "value": "3072:G9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:G9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004088, "uuid": "aee3639f-2983-460c-a593-0cbc41253b51", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004088, "uuid": "8d449215-8eee-45d1-bd6f-c551690b1f21", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004088, "uuid": "a4fe07a9-8a80-4147-b26a-368145cbadcf", "value": "36ee9582fcb89cadb643c3775ab836c28965d5bdcc1e1648ea6e77699d926a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1c3e95-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004088, "uuid": "e44c3477-98fd-4551-ac61-4e2338227b13", "comment": "Malware payload (Dridex)", "value": "f9a7f6d24e01286ec07343b74b1c8b0a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004088, "uuid": "6504dc6f-2808-4399-b40b-a9c2c9d5834a", "comment": "Malware payload (Dridex)", "value": "37139d4b7dacec9466210172bef4525498667cb3f6e9019422acbd31a163e705", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004088, "uuid": "11a39e9a-96cb-4119-8355-580056cdb283", "comment": "Malware payload (Dridex)", "value": "9614def0e62b149fddf5ccb8ee9ec3614ee97780", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004088, "uuid": "4ddb4ddc-11a9-40f7-a11b-b65026c8aa49", "comment": "Malware payload (Dridex)", "value": "e95d2f3194f5b6df4c81ba74e2d6a2295af90163806f37143fe08717f875e64f7de38547f6a80d9261f47f4a532d7a9f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004088, "uuid": "89cc6cdb-e7f3-44df-ba4d-a872d83d83ae", "value": "E624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004088, "uuid": "a4b28cc0-b110-4ade-80b8-5f8f2339924d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004088, "uuid": "1c7d8119-0814-46c1-8a53-66d908e7c2ad", "value": "3072:F9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:F9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004088, "uuid": "edae049f-2712-442b-8e5e-9e20ac32cdb7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004088, "uuid": "0eabcade-884a-4e4a-a048-415bceb3d1d7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004088, "uuid": "8fbf2653-9a49-4edb-88ff-617e8701969b", "value": "37139d4b7dacec9466210172bef4525498667cb3f6e9019422acbd31a163e705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7b436e-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615962241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962241, "uuid": "9678db72-4745-462c-8746-57245a88d954", "comment": "Malware payload (AgentTesla)", "value": "4f9d47b57509950b7c2af4675fb19711", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962241, "uuid": "d32bdf31-c424-45e2-ba6c-062527b91d3e", "comment": "Malware payload (AgentTesla)", "value": "3723cd500bfacb05c6cb333387c8487036cacf86f1b08469fa1dec9ee3d63c4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962241, "uuid": "e2b96be6-4f88-4915-a349-62b2146c0575", "comment": "Malware payload (AgentTesla)", "value": "6cc96d52ca1b6cefc8f76f4b73f619ad0ec09d7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962241, "uuid": "9cf7dec2-72f9-414c-a0a8-abe877eed7a8", "comment": "Malware payload (AgentTesla)", "value": "29fa91c512e4ed4522c208cfc7c9f89595c403b5429f3644c4903d963796e501aba086612edf6488354e3a216d7c2859", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962241, "uuid": "ade62170-6090-49c7-a62e-d87cc5a392e3", "value": "8705236CBF6E474EF4334139411E925A2325EC886BAAE17B5236F32D4C75771F280A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962241, "uuid": "af075d04-b134-4fec-b722-d7f9374487d0", "value": "24576:vuJ+y4R9s53UoAWI2XdxZaAICIaBC+bHf4E/qFF:vuJjt3dxXlBC+bHf4E/qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962241, "uuid": "57dc1a21-fc3c-4bcd-a254-5e30709a0c5d", "value": 832000, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962241, "uuid": "f37fe801-9226-4e0d-a187-b54d2e6bab1c", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962241, "uuid": "8cd591fc-29a0-463e-9233-c3502d403b34", "value": "18KYGD001 PAYMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74eef18-86c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615946044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615946044, "uuid": "436f4802-75ec-4470-b2c9-62a3a6d762ab", "comment": "Malware payload (Formbook)", "value": "b9ae7cbbc3ef64c200156142cc8d6556", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615946044, "uuid": "580428e7-9817-4702-918d-afda6cde1333", "comment": "Malware payload (Formbook)", "value": "3742959e6d9f9cd1dafa7f205f248a9f51a7567c0a7a52e4bf0464b02062de73", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615946044, "uuid": "b25ad437-754d-4310-9617-a6d808ef3cb1", "comment": "Malware payload (Formbook)", "value": "eb9e3aee603d216caa5218e462e7df3db39b5ad5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615946044, "uuid": "25647b8c-6539-412c-b4a9-c9a67b06caad", "comment": "Malware payload (Formbook)", "value": "bd14bf1896d1323398749bd3179cfdaf5b3399c17a24f86a59fea6a3cc428aea2eba2231b3c444f4b7bf970ccc8d0f2d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615946044, "uuid": "82c631bf-79bd-4485-8d03-6ac565a3c705", "value": "20E48CAD726076DFC827C972CEA81C64EAA1746B431BC273A05311DD9A4D99BDF340F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615946044, "uuid": "18d658de-32b7-4722-a6ef-0ff9d8bcf695", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615946044, "uuid": "ba6238d2-6822-48ee-98b0-ae84fc417886", "value": "12288:AqCr1nFO1ca/q++J/buY8dKTLNDho73DoJ+1tACu0iq8cATSDmk0nL20pxxhtZ/1:cnFO1/qNS4TLN83Eoov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615946044, "uuid": "915b5162-7eaf-43df-a469-df861ac2a029", "value": 716800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615946044, "uuid": "ae55978c-4c6d-431a-9e45-400ce6210281", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615946044, "uuid": "07a7a750-12fb-4edc-8448-77c022c23716", "value": "PO_210317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828636b2-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "158329cd-d3cc-4b51-9ba6-9f019568d9c0", "comment": "Malware payload (Dridex)", "value": "55db2aac09a650859faf3e9fca2ae2c1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "7893a372-a67b-4c91-baf5-ba5058ea2bd1", "comment": "Malware payload (Dridex)", "value": "374a7c42f6e47bfda3c699b52828e912a9208790cf2e19ed3ec9763ddbad8332", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "f879331d-c8f6-4cd2-b39c-28420df5d62b", "comment": "Malware payload (Dridex)", "value": "c81abcb39ad08fc3c9707c977a04156ff4dfd867", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "5bc1f540-4045-430f-a445-d2d9686b065c", "comment": "Malware payload (Dridex)", "value": "b1caccfb3e9a761e9bc8c139ac273a76937cd3220d1f33775d3409b7868bdcd4a1f435bcbd8057ee6d0f14cc3067b9d6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "c5c6215a-7253-471c-9174-79d9d3dddcc0", "value": "D624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "8e0f8087-0061-4f08-9db3-08b2888bcf8b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "f73a2bda-5957-4bd4-92c9-20a1f21dfd93", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003965, "uuid": "fd32e2d0-cf4a-486d-9410-c421c1f99077", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003965, "uuid": "2dc6bf80-109f-4454-9964-6c4b6d4e5147", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "71ddca0d-036e-4a77-9a3c-792fd0dc3e9a", "value": "374a7c42f6e47bfda3c699b52828e912a9208790cf2e19ed3ec9763ddbad8332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783348f2-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003088, "uuid": "97655f11-d20d-4e32-8425-f2da7266a5dd", "comment": "Malware payload (Dridex)", "value": "9c5209b58b883da2f965e232c4c993a2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003088, "uuid": "6dbf24ab-83d3-42fa-947f-f3e617e4e683", "comment": "Malware payload (Dridex)", "value": "374ee73853c76733d2cd18592e82ea13349963206a9e36381d07330438ca9d88", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003088, "uuid": "30d97bd3-97bc-494c-a1f2-dc9a38aac791", "comment": "Malware payload (Dridex)", "value": "76e8c949e96374bc6ed82e890e9e17b7d77bcb70", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003088, "uuid": "84cded8c-f73d-4b1b-8680-f4f08bcb7389", "comment": "Malware payload (Dridex)", "value": "fb46155229e4759144b4a70cc5a26c25f2fe6b019299c59a2a7841bb93cc62b52640ba6357a10fa1714eafe92e7bfd4f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003088, "uuid": "6e92370e-f7cd-4c67-83a4-b0466d50e507", "value": "DD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003088, "uuid": "b7bde365-5927-47eb-9713-62273320c541", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003088, "uuid": "00241627-37be-4d69-b955-d20a346b5d2d", "value": "3072:m9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:m9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003088, "uuid": "bbaec64a-bc15-473d-a784-f640df222102", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003088, "uuid": "ddb91c06-99cc-441e-abbf-94d16aac536e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003088, "uuid": "64c87fbb-80ca-474b-9f3c-13caa0ca6508", "value": "374ee73853c76733d2cd18592e82ea13349963206a9e36381d07330438ca9d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b965586-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004651, "uuid": "935646a1-11ad-4e68-8faa-6b70f05f4786", "comment": "Malware payload (Dridex)", "value": "9fe166bc7ce01c8f84dc52ddd38aa5ee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004651, "uuid": "55a415ad-0c68-4a04-bcf7-a2e1f2ae72c4", "comment": "Malware payload (Dridex)", "value": "3758f142448107267b9efaee1840ccf8e6e3ac44473261e15d82eb614fa649ea", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004651, "uuid": "34b8e08d-cb89-40e4-9fe2-befc66db4213", "comment": "Malware payload (Dridex)", "value": "aebaf603c3ad2c22e3b88f83e136878242a69074", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004651, "uuid": "bcf84e77-f19c-4e6c-bb63-cce225f9044e", "comment": "Malware payload (Dridex)", "value": "aeba60ed844b86c5902383aef699e6bfe2278c4cb20a64719140c2c4b7f05c966fb9be6b53b2c1cd6941414339f4ecf9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004651, "uuid": "950da837-3917-46b9-a280-0b816cf101fa", "value": "2224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004651, "uuid": "f5be8da3-59e0-461a-9818-dea5a0db5516", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004651, "uuid": "f0261203-dbaa-432a-ba3e-90490645828c", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004651, "uuid": "d16f01cb-52c7-4733-ba07-2452474ee034", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004651, "uuid": "d893df01-a182-45b0-a6ff-9f1fdaaa2bb5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004651, "uuid": "a5ed7600-3309-4a3d-90a9-37675eaefb70", "value": "3758f142448107267b9efaee1840ccf8e6e3ac44473261e15d82eb614fa649ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e5f6ce-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005207, "uuid": "faaa5eed-7694-4c59-a4e4-c8cee34fb692", "comment": "Malware payload (Dridex)", "value": "462aa0ac437a52a3b45357ed944e2525", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005207, "uuid": "fccc255a-bc1c-4cb7-bef8-106c23a1db5e", "comment": "Malware payload (Dridex)", "value": "37f4d396582b593a5008625dd20037491c88114fb693d4da2d680ab89ec8a3d8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005207, "uuid": "370dcb6c-96c0-46b7-8d66-020bde86bb10", "comment": "Malware payload (Dridex)", "value": "63ba854524f1a35461887d8f65f48de51f9d3678", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005207, "uuid": "cafb2488-77e5-4f56-a043-ce9d908d7bde", "comment": "Malware payload (Dridex)", "value": "68342238b022fb7054215be61e526950ad974eb49a0e56a2d0de0edf31d13178c04c581566990e621a95f9efff0e27bb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005207, "uuid": "b6106fdd-110f-47bb-8547-efbf78e89400", "value": "0224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005207, "uuid": "44da9bb3-06e2-46aa-aec5-dde9c7d86167", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005207, "uuid": "eb090e84-a645-4349-af05-11994e6f8a28", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005207, "uuid": "5e28cf82-51d0-4b3b-9578-fd413b06d71e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005207, "uuid": "b9585cc7-1fd0-4005-b1d6-ebef121514e3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005207, "uuid": "6af15cb7-8256-4f3d-9c9c-2282df868b85", "value": "37f4d396582b593a5008625dd20037491c88114fb693d4da2d680ab89ec8a3d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8487019-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004538, "uuid": "a40a4848-53c3-48b2-a16a-0d7d319c2d9c", "comment": "Malware payload (Dridex)", "value": "ffdaf7b7b37685b7221eb1f2f310a737", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004538, "uuid": "c1c14877-3ebc-48a3-8feb-7e3ed3ae36fa", "comment": "Malware payload (Dridex)", "value": "385da654317ba1d52a9ae2cc82a456eb7588fe698cb0753ae22d7c0c04bc274c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004538, "uuid": "5b3f27a2-6a8e-4782-a2fe-6a98cbbacd7c", "comment": "Malware payload (Dridex)", "value": "afe260b2aaed54cde66ea855891dbe18fc15b54e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004538, "uuid": "e4047419-6c1b-4746-8dfb-5f417123ac7f", "comment": "Malware payload (Dridex)", "value": "f848e8372dbe28e0ab6ecce52c0ef3b301f23396574269d219b7fd5af068e19825daf094af6b9ea9d97d483eab504e4d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004538, "uuid": "19b23c7c-cc4f-4977-881f-089903c2c1ef", "value": "E024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004538, "uuid": "95f1d21f-5764-4422-9f4b-35bdcd52d478", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004538, "uuid": "8d07e304-db8a-4bc3-8a2d-3ec3031f07df", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004538, "uuid": "6bd7f568-83da-4f02-a8f3-8b3b69b1f5d4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004538, "uuid": "c8d45d16-1af2-4b9f-ade3-9103bc0aeeab", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004538, "uuid": "773160e1-7c1c-4860-9ca5-711e604acc74", "value": "385da654317ba1d52a9ae2cc82a456eb7588fe698cb0753ae22d7c0c04bc274c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810a1dd5-874f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006110, "uuid": "aa075079-928b-46d9-b8d2-d95cfb796fa8", "comment": "Malware payload (Dridex)", "value": "64a4e815608e5613073cb945d0e91be6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006110, "uuid": "6f5182ce-df61-40e8-a87c-d8496de1d41f", "comment": "Malware payload (Dridex)", "value": "386092b9bfe02bbd7bdbfc6f4d48c500407ae1feb3035337ce7b36e50b46336d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006110, "uuid": "8453e124-f823-4d85-9c7e-d01cce0870cf", "comment": "Malware payload (Dridex)", "value": "355ab99411cb626382067fd2183a8ce860f25eb9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006110, "uuid": "d87bedd3-56a0-4ac3-a9ed-f38a4068ba1b", "comment": "Malware payload (Dridex)", "value": "be7762bb61ebef5be5285f0bb229eedd9d24b9ebbb8de18041c2db85f01ef51732f3ff110bc932e3075150303f5a0d13", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006110, "uuid": "56f9d2b3-957a-4927-9fff-8f550a417ccc", "value": "7B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006110, "uuid": "88ff8a37-463e-45fe-9844-1fd48f6bf3ca", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006110, "uuid": "bc85cff5-b08f-47ee-a323-22b8768b9588", "value": "3072:r9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:r9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006110, "uuid": "2bc82171-4e5f-4e82-8f59-d145f7daad0c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006110, "uuid": "23ad757a-bf19-4c88-a39f-bbb2de388b4d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006110, "uuid": "28a0d6ab-4fdc-48d0-8e8e-46b9ecce8d85", "value": "386092b9bfe02bbd7bdbfc6f4d48c500407ae1feb3035337ce7b36e50b46336d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650cc30e-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004345, "uuid": "55c85a40-8f5e-4f32-b649-0abef464a9aa", "comment": "Malware payload (Dridex)", "value": "7c2817bc6afd1199079cc64ff7825442", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004345, "uuid": "a0635849-9bfa-4310-905e-440e7b3e0a10", "comment": "Malware payload (Dridex)", "value": "3885caf67790a23b548131bbc9251da4c1d0234cbc0ced52951a8a67d2c81b4f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004345, "uuid": "73916e4b-04cb-4dda-a739-810b85dcc4f3", "comment": "Malware payload (Dridex)", "value": "48ec240d75ee28ccaec2d285a383d747acfec743", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004345, "uuid": "2f84304a-ce32-4000-931e-2db2dcaae5da", "comment": "Malware payload (Dridex)", "value": "cb8950f8b98e8d971b7e6e8c5fbff5b0ed58d7efa33c6f9aafea22afff6ce85d879c41ce462700a319d8dd82d5f6a70a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004345, "uuid": "2a45489d-d79f-4bbe-b4a8-cb1a26924c22", "value": "1524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004345, "uuid": "bdb8ab67-0eeb-489b-90db-2d141b12a550", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004345, "uuid": "3873c23c-03eb-43ae-9bf4-de58cdad9c48", "value": "3072:J9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:J9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004345, "uuid": "aebc0df3-32c6-47a4-b2e0-f6ba731b8b68", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004345, "uuid": "9161a7c0-04df-456b-8701-e5617c9e5300", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004345, "uuid": "03d2f2dd-e807-4d14-9e12-d18353c306a9", "value": "3885caf67790a23b548131bbc9251da4c1d0234cbc0ced52951a8a67d2c81b4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7034139-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004885, "uuid": "d5f7e821-7e1d-4990-bd6a-db8f1314c15a", "comment": "Malware payload (Dridex)", "value": "738aedfe602f5987ce12ed54124f6011", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004885, "uuid": "cd9a62e7-f92e-4b72-bd25-b99adbae9b45", "comment": "Malware payload (Dridex)", "value": "38bd4ae30de1062d2d5b7ae30be93f06da410f7b21d3aa4a187023d1238fdb13", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004885, "uuid": "906bba13-0501-4cbc-93ff-f0be0143d14d", "comment": "Malware payload (Dridex)", "value": "19c86d0699d209e2f9e166516eb82021cf0c9fbe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004885, "uuid": "244b6518-b8fd-408f-808e-c03339bed97e", "comment": "Malware payload (Dridex)", "value": "60a04061c0a1d5d7ef31fa69fc15e366b43c311258fd31544b2bacf2d2b3470ce99a113487439efa9ea46d46d25cf7e1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004885, "uuid": "97becf4c-83ed-4377-9a1a-377a686910c4", "value": "5324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004885, "uuid": "afc20a46-cf53-4448-829d-2e624bdd64c8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004885, "uuid": "60fb8911-76e1-4470-99d6-6c3b49614ddb", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004885, "uuid": "e73f1c59-4f16-4e99-b535-db1ce2917d8c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004885, "uuid": "0df1e473-e02a-4061-ad21-78f691fda85a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004885, "uuid": "079b5c3a-4046-4c52-a36f-b4e8023135c4", "value": "38bd4ae30de1062d2d5b7ae30be93f06da410f7b21d3aa4a187023d1238fdb13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8b7b80-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "489b18f9-2930-4bd0-8b49-96100c728585", "comment": "Malware payload (Dridex)", "value": "4b1cb3b86268fc6ff2e1133d2a1b60a9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "5015f9ab-cf96-4985-8534-349e08f5853e", "comment": "Malware payload (Dridex)", "value": "39542bf9a9f6d3e935b1451cb1cfc7a72846737ddfc43288d5be7fb448121edc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "efda16b7-752c-4761-95ba-d73398606b14", "comment": "Malware payload (Dridex)", "value": "ed3b6582c27cb5d0056c04b250fd90e914bfc958", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "71e0a429-5a16-48b1-b7ab-4c0a3c2b475b", "comment": "Malware payload (Dridex)", "value": "59f334243c32cef0a66f1df699835e2c33dec3943461157d5e0ab0bdc2914f6b72258f77faaa8c75dcb90aac52dde559", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "d8ac2c74-d4cb-4554-a44b-b41235ae03b4", "value": "C724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "7385a954-9fa5-4db0-8961-da9d63e6b77e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "e9a2f6d8-d470-49de-bb14-9f331cb93938", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004336, "uuid": "226a04b9-b03f-4801-b847-c126fb86139f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004336, "uuid": "b7ab1eaa-ecb4-468b-9b87-8aee1cbf9bd0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "b890769f-e581-4d93-a9be-052b5056f1fe", "value": "39542bf9a9f6d3e935b1451cb1cfc7a72846737ddfc43288d5be7fb448121edc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3952b942-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003842, "uuid": "c883f2f4-d3d2-4bd6-9aef-846e267ad1ed", "comment": "Malware payload (Dridex)", "value": "49443cf241f1fa83c4b3aad8a37c726e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003842, "uuid": "304c3e66-8929-480c-adea-14d92d574d38", "comment": "Malware payload (Dridex)", "value": "397188f103aa8ac80b7b00b0d12dcb80c4d14f0077f75d56cb54636cb352bf5d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003842, "uuid": "8bd86482-2102-465a-ad1d-6ac25bb0100f", "comment": "Malware payload (Dridex)", "value": "19d05a10ae96b8c8f9cb619770b8f900353d7505", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003842, "uuid": "1df1a11d-c911-4961-874b-8df1c6aeb8a8", "comment": "Malware payload (Dridex)", "value": "df80ff9f01079cc7af95691e3cff773058706a68f8adfe25e0a369bcebf472af246eb1dc7655acc9deac510ae38abce2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003842, "uuid": "5f098dec-3694-4292-81b2-4f72804f5dae", "value": "C324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003842, "uuid": "c54d471e-4d5b-48b0-9870-7c43539421b3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003842, "uuid": "93b93e24-2cf5-4b31-942e-8efb49172daf", "value": "3072:C9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:C9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003842, "uuid": "442dead3-c812-4924-9a79-28339d55e5bd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003842, "uuid": "e34b76fa-619d-4d6a-9cc0-617206f6a3d2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003842, "uuid": "314144fe-5cca-4bd6-b037-282aaf98a8ee", "value": "397188f103aa8ac80b7b00b0d12dcb80c4d14f0077f75d56cb54636cb352bf5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8701cc91-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004831, "uuid": "e6a6c6bb-4040-4045-bb35-2438a35894b6", "comment": "Malware payload (Dridex)", "value": "42a0460830df118242ebd3fe993f8f8c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004831, "uuid": "98ef529e-f6aa-408b-ba3a-e3dbe07b8ac0", "comment": "Malware payload (Dridex)", "value": "397aa8c3651a461b58e7850a6d15cef3667609e13ef9202d831da627aaf6a423", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004831, "uuid": "2a72e029-59ad-42ff-b342-c5ea45ff2154", "comment": "Malware payload (Dridex)", "value": "1a0113611ea6832a1c1563123c5f83cd3f85e135", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004831, "uuid": "a466e26b-0628-4bb3-b9a2-7bc39a0fbe4a", "comment": "Malware payload (Dridex)", "value": "6f21dec0f868c8488b0a66247b01bb183b9940b5ce9959ea84305dfc869754a16e3b76b479b5cd7ec2bc57adc1822d79", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004831, "uuid": "733e630a-2988-4960-a013-d0c1a92ceb64", "value": "2F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004831, "uuid": "c95b3767-5ed6-43a1-9d96-75f7a4ee8300", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004831, "uuid": "1da3a8db-a1ec-4958-a7a4-97df60dcfd24", "value": "3072:g+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004831, "uuid": "94bb50b7-2328-4efd-b4a3-e45469cdd97f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004831, "uuid": "1501b329-547f-4592-936e-47989d33e18f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004831, "uuid": "5c043ec9-49a0-4b0d-8152-0dd84bd1274a", "value": "397aa8c3651a461b58e7850a6d15cef3667609e13ef9202d831da627aaf6a423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1421afba-86c9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615948374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948374, "uuid": "b6f79f57-1ed7-4a3c-b720-fe4983007afe", "comment": "Malware payload", "value": "0c9069306870c259d0c9fddd0d1174be", "object_relation": "md5", "Tag": [ { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948374, "uuid": "6e46aa77-7c48-46e8-8f7b-1f324349c20a", "comment": "Malware payload", "value": "39d02be6b4e38a29fcfde7d723a478fa4a0165fef3f391f94f8644bd0e87da02", "object_relation": "sha256", "Tag": [ { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948374, "uuid": "a1276438-c621-41c2-be2c-ba2d1529979b", "comment": "Malware payload", "value": "a4b7e151c686bdca4d81c112db915c4905f83a03", "object_relation": "sha1", "Tag": [ { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948374, "uuid": "a53074b3-2a1a-4737-8602-4ffe40c4e0c7", "comment": "Malware payload", "value": "0c4f6a2a82a5a976eaf31598d33497dd7ad27f9f428643ba8fc189be78db44471c3ac210f413bd88e6ef986088175810", "object_relation": "sha3-384", "Tag": [ { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948374, "uuid": "7c717593-73c7-4cb1-8089-d4882623bc1b", "value": "9B22F32229EF60DC73B29F605FE9B8FF486AF573291D71B920425B4587B1980CD22B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948374, "uuid": "10a079e9-b48a-469b-acff-43184c9d690d", "value": "192:TJQ7oTnFof4u5L0gmghKGMzKzCOgrHw6QoqrbH+:ZpofXL7I7JM6Qoci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615948374, "uuid": "ce959f81-22be-4e05-a66d-41742616cc20", "value": 10632, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615948374, "uuid": "65998897-55ac-4c3a-92ce-a2889493c1c8", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948374, "uuid": "098180df-cc4f-4cef-9073-e8a1e47494f0", "value": "l2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63ad21d-870d-11eb-abe1-42010a9c0039", "comment": "Malware payload (DCRat)", "timestamp": 1615977825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977825, "uuid": "14b32b21-383a-4f1e-8e99-0df1f5d883dc", "comment": "Malware payload (DCRat)", "value": "d488957da746ffc43cf8b843c8452aa9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977825, "uuid": "4cbe32b9-2d02-4051-bb29-6fa9854bb925", "comment": "Malware payload (DCRat)", "value": "3a3d7b3455de2e53b107987314c40e1c60e5caa76b1eb8a97b1219af2cc658c3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977825, "uuid": "96d780cf-766e-46ff-ad81-8398e4b10c6f", "comment": "Malware payload (DCRat)", "value": "3d3e1e12240cb2699b5b405351c166b5b87794f5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977825, "uuid": "545094ad-7440-4ec0-93c7-1530e60d8921", "comment": "Malware payload (DCRat)", "value": "400abfa6d372e80c82b21c32aa19140d6382192a6fb7619957207be98be88ea8ae50a8d87d7a39618f496d21f4bec090", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977825, "uuid": "d256caad-b17e-45e3-89ac-18c65310c72b", "value": "02962F605DAF376698B31F8C275128050D236D10FEA34763168AE5287E83D8AEF75E7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977825, "uuid": "2edc5176-74a4-44c1-8391-f2a2bc2736f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977825, "uuid": "9814e636-4ec8-4386-bcf8-4bba32ffcf56", "value": "6144:CdJiGOtn6ZE4hxslrUm9TI4HVqyAJm/VOZCtxj0VkagEKqGps2guLlIYMcLgmHsM:eiGOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615977825, "uuid": "c77180fe-3823-4629-9f86-afd874583730", "value": 9361712, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615977825, "uuid": "66fdb5ec-c6f0-4b1d-923b-6c55ef7347b2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977825, "uuid": "928b161c-ef31-467d-8101-e2fd56647960", "value": "SecuriteInfo.com.Trojan.PackedNET.530.8587.14872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a64bf3-875d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012244, "uuid": "d75c2568-fc67-4d8f-b6d8-7655387610bc", "comment": "Malware payload (Dridex)", "value": "92960cbff81d591ee49f61403374e98a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012244, "uuid": "8b5aa4c9-3191-49f8-a59b-251d6fdaea76", "comment": "Malware payload (Dridex)", "value": "3a5bb52b1622d944b82c972c3a968a4fd8072c18aa51c1f2f240fa3ab79014b4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012244, "uuid": "015d2bb2-721d-40c3-9e46-479755234efd", "comment": "Malware payload (Dridex)", "value": "89aa8c3e9479f396aeb6e8d1953075749e379893", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012244, "uuid": "4d1e31db-535e-459f-95f9-13a2244b5c01", "comment": "Malware payload (Dridex)", "value": "72ccc8ff2881c815724c7403b419f6cbfae37952bd2a197d71eaa1239f6847e49dd24ebadaf137ba6253f49dde6634fe", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012244, "uuid": "59af9c86-b4f8-4555-b819-e70154be0ae2", "value": "8F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012244, "uuid": "870f5445-0b91-4c67-9193-29a2b7cb1881", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012244, "uuid": "b71ddc1c-1f0e-44b8-868d-16c6e25625d9", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012244, "uuid": "148d9957-d25f-4b3b-935a-370932f20b4f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012244, "uuid": "2b6144d7-3524-444e-b10b-335c659c99a2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012244, "uuid": "2e57cdb1-be27-40c8-a69c-6ff65c83917b", "value": "3a5bb52b1622d944b82c972c3a968a4fd8072c18aa51c1f2f240fa3ab79014b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691ddef6-870b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615976864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976864, "uuid": "09d4c5b6-514b-4880-81fb-9ed4b62b781a", "comment": "Malware payload (AgentTesla)", "value": "ed302e856a4342510e9862dd77246ce1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976864, "uuid": "fb134f7f-8c43-4afd-b29e-15a1b0bc63f1", "comment": "Malware payload (AgentTesla)", "value": "3a74437c7fcfec4eb72bb7d6968e6ee17b30c5d31b7c7c28f1cd85106eefaaae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976864, "uuid": "1004e3da-e1db-4bfb-8a05-941351e9f3c0", "comment": "Malware payload (AgentTesla)", "value": "43dd5bd7fb2574f94a9475548c4ddb00f4e55520", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976864, "uuid": "4e4ae346-1cd3-461c-9689-adc52d2705eb", "comment": "Malware payload (AgentTesla)", "value": "cd93fbdb09a4bfeb7a7374b913494c5506019ed9c44b29c5d6c16eab50ea523793a5655007d114a1f0c04aff44b077b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976864, "uuid": "8bde73b2-e2d2-41e7-bd7f-47d574cd2d9a", "value": "8025012943381B56E13D13319CA2652403A59D1932F2E7FDAED1BCD839BB35486F21BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976864, "uuid": "8a4cbdf4-a7d2-493c-81d6-c228103fa7ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976864, "uuid": "c58a51a1-4b0b-4adb-a25e-d6ae68d158ca", "value": "24576:Jazck3c4Ry4VPa4TAb332Rj6p3sjaKg6k4U2Vo:ce4U4Ba9zoji8vxU2Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976864, "uuid": "76c0e80d-6226-468b-9839-bcb19ef832f4", "value": 1039360, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976864, "uuid": "0a77cbf3-e128-4d3e-92ba-516df3f89d88", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976864, "uuid": "79ed22ef-1131-4378-b87d-99f066cbbe5f", "value": "ed302e856a4342510e9862dd77246ce1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666d1153-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004347, "uuid": "befa6da8-3473-41ed-8ec8-d7796f5d50df", "comment": "Malware payload (Dridex)", "value": "1b248ac8f228410fd7631b231758252d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004347, "uuid": "27b6ce47-2bb5-4678-8b6d-8ec55e53dce4", "comment": "Malware payload (Dridex)", "value": "3a921bceb55a4dbf92f8eb50cd7425bb2c9437fd70ba0a58b5b123bf0d279067", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004347, "uuid": "0088268b-679f-4a67-badb-18bad307edaa", "comment": "Malware payload (Dridex)", "value": "36e0a5f4da63351a68771107243cb7c164b74dc3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004347, "uuid": "f1e6fe33-11de-43a1-bff1-2a18ae5fafa4", "comment": "Malware payload (Dridex)", "value": "1e83f1ab9fb8688983f8e583f5ab003ffbf664a12cdd5be4fc6d00874c94ec02055ae35afcd4e00e1e273c3e788ea406", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004347, "uuid": "de7fad4d-ee6b-4077-90aa-4c03a37fee79", "value": "4B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004347, "uuid": "a5d4c760-d187-46cd-8780-f331e5b304ac", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004347, "uuid": "1e9a7ac7-3d3d-4115-b046-3eb156af7741", "value": "3072:m9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:m9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004347, "uuid": "974994a1-44ea-4f74-92ed-7d300e174546", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004347, "uuid": "f68baf71-ad6e-4caa-ab2a-75a557ca7503", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004347, "uuid": "1e8dfc7d-970c-4993-8ffb-619b016e5967", "value": "3a921bceb55a4dbf92f8eb50cd7425bb2c9437fd70ba0a58b5b123bf0d279067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f32015-8751-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007109, "uuid": "f144ac7b-ade0-4cb4-9ab7-6bc550c57520", "comment": "Malware payload (Dridex)", "value": "40bdaaa548d52ed8079332afe887e722", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007109, "uuid": "786cad80-6dc7-4332-8e45-14d333d06632", "comment": "Malware payload (Dridex)", "value": "3b2bf893f27ad5be54fafed866f0edb146fa929dcbe2cd3334d9d296239e7db5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007109, "uuid": "3870041e-e7c5-4b08-b7d9-39288de09612", "comment": "Malware payload (Dridex)", "value": "c9a68bd32b5680ea3082b9ad52aacb96f338c33f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007109, "uuid": "f7c773a4-204d-4c15-aff0-ddfead6e00bd", "comment": "Malware payload (Dridex)", "value": "14fddb95783c700e825e700cea9f8682d073e791936f3b2e078bab35007c94ccec35eab1886e6c9f853afecf2c0c3458", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007109, "uuid": "1cd05753-938b-4d0d-97a9-abdbdf01d25d", "value": "D524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007109, "uuid": "bf33f197-1edd-4daf-83da-f78f69dc63e4", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007109, "uuid": "3c44c9aa-5cc3-4ceb-9466-f451256f1e5d", "value": "3072:z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007109, "uuid": "c4b72a02-1190-4f29-859e-54c96400259e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007109, "uuid": "80fff971-631f-4cdb-a49b-09050eb2c779", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007109, "uuid": "8990d7fc-8ff3-4d03-92ea-d8ee42de0e53", "value": "3b2bf893f27ad5be54fafed866f0edb146fa929dcbe2cd3334d9d296239e7db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8410c8f-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "9338bc0d-296f-40be-8765-608ae9394875", "comment": "Malware payload (Dridex)", "value": "7415ecb8be74634f9f09b94f1c1f5078", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "5ec000c6-4d3a-465c-89dc-be6e3d7b2d81", "comment": "Malware payload (Dridex)", "value": "3b5b91646cfa1d44b41b6697781a0ba4f45c7558ae340f9d1806fc8d97edae6f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "4a305377-34b5-4095-90d6-1f1d110433bd", "comment": "Malware payload (Dridex)", "value": "d8ad9103cd8acc52f83d33774bbeeee3cf4af88c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "2712204f-e209-4f79-a61b-adb6f0007c6c", "comment": "Malware payload (Dridex)", "value": "ce3e9312c59c125175410c3334232d85190183712407815e0fdd4d4fa823dddbd8f2914ab4778682cb1749adafaa2dab", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "facbba45-a8c2-472c-8fcc-255c7a343ccb", "value": "F324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "4a5720ac-7682-4ef4-8825-877e53e86447", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "edacfb10-7390-4e7a-ac45-26d2657bb40d", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003733, "uuid": "96d0554b-dab2-4dab-80b4-3a63c420c1be", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003733, "uuid": "bfb5e11d-a3bf-42a9-8f4a-d34ee853706b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "bf23d9a9-e7f2-45a6-a2d4-c6818983ed74", "value": "3b5b91646cfa1d44b41b6697781a0ba4f45c7558ae340f9d1806fc8d97edae6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25305c21-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969448, "uuid": "89987ea0-f325-49a4-8b9a-51089ca237ea", "comment": "Malware payload", "value": "8fc65757011f067d0f35d6d4655e75d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969448, "uuid": "98eb5c1c-1c5b-4d70-a126-f823254a0ac6", "comment": "Malware payload", "value": "3b63323d965a34d9a828593150e9c765b085eb844c8c1596a86def9b623e099e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969448, "uuid": "65cec59c-8b5c-4fd9-9d8c-d06b2538c09c", "comment": "Malware payload", "value": "edc26e8f7c2d10b15a476a34eccc52dcfef61577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969448, "uuid": "ed95d1ae-da45-4438-973b-654795d20607", "comment": "Malware payload", "value": "3616a9d32d431976c5f6a9c6682168a9414291ee8fb9d91c2489196f094b7ef728f1fdef302a80c5b0b762bf58bddcad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969448, "uuid": "e3a2c108-419b-4843-91f5-4e9cf0ffccc2", "value": "A876FF442F7309CCBBBA21760CABE1C8A2BA5514B6EF792459ADD2479873405930FF73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969448, "uuid": "c62a3316-3f26-49bd-b59c-05d20c6a4148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969448, "uuid": "dda8419b-d9a7-4f1c-896a-46f6ad4ecf51", "value": "24576:2E74gY2/72/H/B7/qBonrQnOBbjuD5Ofwm8F/BraAMpVKWiQTbXl3RDpgSK7Cf/W:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969448, "uuid": "c295d9da-483c-402f-a7d5-a9d6dcbfbdca", "value": 7124272, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969448, "uuid": "fa468cbe-a10c-4d5d-882d-86d90f656918", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969448, "uuid": "f8ee6718-9e15-4513-8b67-61a0e64a1476", "value": "8fc65757011f067d0f35d6d4655e75d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8adc275-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004566, "uuid": "a2b63b3a-2ddf-4ec7-8db9-67399c2f1e11", "comment": "Malware payload (Dridex)", "value": "6a931ca560783ceeb52d82e492cc26ae", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004566, "uuid": "3a461605-e758-436b-b2a6-8a8fedc60575", "comment": "Malware payload (Dridex)", "value": "3ba9b1e85f1687bae52bda20906635d1ca1afac9f77f097b3a2e03f58087f602", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004566, "uuid": "447cbb84-6fcb-4821-bf50-feb1ea0b611e", "comment": "Malware payload (Dridex)", "value": "f93d8f94173855b25c9616f3ec38b9ad7963ad5c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004566, "uuid": "3c5db121-527d-4f44-baa8-8cf704b6c886", "comment": "Malware payload (Dridex)", "value": "25a773ceaf3784253d34336ca2d4112aeb55eb17d457587bdfeb52f6495fcffafa4937ebac396b821a28538891a9e785", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004566, "uuid": "f9620c1b-a838-4f03-a291-dd385d6637dc", "value": "9C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004566, "uuid": "4e384188-2074-4507-90d1-cddba6ed54f1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004566, "uuid": "d77f8f83-5394-46da-bfee-cc1f29a5ae61", "value": "3072:59Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:59Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004566, "uuid": "a7c3a3bd-4661-4c49-89f8-8523c5703da1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004566, "uuid": "20914c20-ecd6-4718-ac46-afa19bf03a9a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004566, "uuid": "1afce5e1-dce8-44ce-aaab-92c99cc8efd4", "value": "3ba9b1e85f1687bae52bda20906635d1ca1afac9f77f097b3a2e03f58087f602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17055367-8752-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007220, "uuid": "b01b8cde-ef7d-4d04-bdb4-099b89d928f6", "comment": "Malware payload (Dridex)", "value": "3b6591d8fc637e4872e47966e5721a0a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007220, "uuid": "b4eaec37-f19c-4ec5-be4a-89a3bf08ebe9", "comment": "Malware payload (Dridex)", "value": "3c4a0b1970733d5bab068aea1e495269b2ccea56dd065b9501b8e9336b59b365", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007220, "uuid": "5513a1e9-c7e2-4e96-81b8-b3ff8be4adc4", "comment": "Malware payload (Dridex)", "value": "d072260671ce73a46c7fd8458a505efc81714ece", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007220, "uuid": "c40a25f3-1794-4bea-819d-1973db6ec5f9", "comment": "Malware payload (Dridex)", "value": "51240183b43972869f4828172715e3ee19aacc4eecd2abeda3cc318ba3a1b92459062bd30482f9478a31238ce5a68004", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007220, "uuid": "ba276d73-02f5-48e9-98a6-c1a95589b1dd", "value": "8F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007220, "uuid": "8a95b7da-ce37-4e04-b0e3-b13a56673480", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007220, "uuid": "c8ab39bb-40b1-4d65-97e5-733c90e2cb4d", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007220, "uuid": "63bb7e1a-6de9-403d-a225-dee1127695b2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007220, "uuid": "1dcba5bb-ad8c-4cd4-9f20-6bcc5f809cf4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007220, "uuid": "de1f3afd-b4a2-426f-bfb4-b31360576bd6", "value": "3c4a0b1970733d5bab068aea1e495269b2ccea56dd065b9501b8e9336b59b365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbd0740-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003579, "uuid": "8a4ba501-61b5-41d2-967e-83abac13d4cb", "comment": "Malware payload (Dridex)", "value": "6fb51b0731b9036ba2cd1e53d54f4769", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003579, "uuid": "7505c9ff-f4bd-48e8-a539-c57fe182c4f1", "comment": "Malware payload (Dridex)", "value": "3c4c136eb08528949630725be62f3625ec16f94fbe7559c75967b9dd9971cbea", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003579, "uuid": "ad20f546-a755-4bfd-b55e-c5bbc3284b33", "comment": "Malware payload (Dridex)", "value": "6ac2253dc86fc92ee4cf8f089ea4500abcfe74d8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003579, "uuid": "5ed77656-e72c-4509-a906-c16ac436c279", "comment": "Malware payload (Dridex)", "value": "5cf1d2b3c48920be15b73b13b6093d77d8e826c3d9c9a945b7d1d74b6db5a46b983ed825038b391e5d4e8ae80f4ba46e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003579, "uuid": "bccaeb83-d12d-4f9c-95aa-1920c58be2ea", "value": "EF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003579, "uuid": "99d7ec8b-058a-4cbb-8fba-fb393227f9e9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003579, "uuid": "656361b8-fbb5-4a45-9778-8dde17061b30", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003579, "uuid": "aff879e4-63f0-4121-8dd2-7393e8a1ece7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003579, "uuid": "17f20d5f-fc3e-4157-a17e-9414be495d69", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003579, "uuid": "370ee073-d1c9-484e-a3a6-0817e54e6b26", "value": "3c4c136eb08528949630725be62f3625ec16f94fbe7559c75967b9dd9971cbea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4be5b14-86fb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615970172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970172, "uuid": "d2bf2613-8666-49d2-a972-9c30102708d6", "comment": "Malware payload", "value": "4ba632cc278fee9d907b8ca98d411ad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970172, "uuid": "39922808-f2c1-4cc4-b2cf-69bd862e9910", "comment": "Malware payload", "value": "3c67253b6fed619591245e8d3521a2b8f47d0af79d44f4399fa7686ec2a6144e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970172, "uuid": "4a3010db-79cd-4d6d-b678-e0cb96d90def", "comment": "Malware payload", "value": "9456485934736e8de69b8383431e3c3d34944f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970172, "uuid": "4045863b-6856-426d-8892-a428d9c1401c", "comment": "Malware payload", "value": "7e396d37d8af75ad5482541c3202d7c78f56a96066d5b016c001a0cc2e1042e3b616c953ae6b1d2eb61bf608d96af073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970172, "uuid": "06efeb2f-3874-47cd-acca-40bed1b9903c", "value": "4BE2E03635D7AD02D23BBE7589D175169AFE7272AD2881BF58C00783C953A409F8B93C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970172, "uuid": "1e83dc7b-b557-4f97-9914-de498cb8affa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970172, "uuid": "e22a5104-0d5f-458d-83b9-1d1e68c4a0df", "value": "768:RI64M9G0o2TPhSW2WKWKWeWQWXWXWDWXWoWXWiWXWYWXWGWXWoWXWQWXWoWsWDWm:RIpMJ7Td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615970172, "uuid": "5f13e45c-a1f4-47a7-9d4b-c42ab33449d4", "value": 31232, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615970172, "uuid": "bf283ccc-c05d-442c-961f-5fd0f53a1f3a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970172, "uuid": "f114455c-bcf7-4932-9a1b-e646752cf2f7", "value": "4ba632cc278fee9d907b8ca98d411ad9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c503e7e5-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017391, "uuid": "a9235c1e-561a-4d15-9acf-fc871920caba", "comment": "Malware payload", "value": "abe892c37ddc7087618b22990526f8a9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017391, "uuid": "5145deba-00f8-47d4-b00f-5f04957148d0", "comment": "Malware payload", "value": "3c7694b3d12df771ca531ab67c3e39cacf24969b008997372e42518d20ca96e2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017391, "uuid": "00b6a923-a84d-4468-a51b-a78db21635fd", "comment": "Malware payload", "value": "24d1e26959097fb7663ef18c13e010ecafe609ab", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017391, "uuid": "f913af22-db4a-411e-ab09-c6d4346d164b", "comment": "Malware payload", "value": "e503dc671004c3ad8b52867d27d3d27afd4d754c1da7a0022c312b50aeaa7966bdbb6f9f9d5bef4fc8af12b67d5aae32", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017391, "uuid": "e86ffd6f-02dd-4ad5-a16f-424d162a9d10", "value": "9124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017391, "uuid": "cdba2f7e-1684-4065-bda4-e48997709e33", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017391, "uuid": "55deaf41-212c-4896-a9a9-31b308b91425", "value": "3072:o9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:o9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017391, "uuid": "c7d6a13e-7892-4e02-80b7-6e4b1124cbd3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017391, "uuid": "55982f6a-6cfa-417e-8c72-9accfa6fc8f9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017391, "uuid": "7ce25b27-355f-4060-a901-44ab29609079", "value": "3c7694b3d12df771ca531ab67c3e39cacf24969b008997372e42518d20ca96e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5716f03a-876a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017636, "uuid": "b541b4b1-ccc4-4851-8475-a8f50d5b860e", "comment": "Malware payload", "value": "7e40e6cf87f466e198e793bb1a45e8d9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017636, "uuid": "39dc59ee-4063-4cdb-a541-390e5ca7dea2", "comment": "Malware payload", "value": "3ca263eee202b7710e0118208f2865057c14055cc9592a323d6f00e6afb289d0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017636, "uuid": "f6d0ccdf-1b33-4a1b-adba-8f46cb5afb87", "comment": "Malware payload", "value": "7d50b83aec5cb5fc73762235d502962a7c5e9f56", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017636, "uuid": "36503aad-f051-47c2-b546-00e3e6978c00", "comment": "Malware payload", "value": "67d67763e2c56522694cf708724626b514e9180f08b83d4d124fc5139a77e3cb323801cb1397a848ea651188cbb60a2e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017636, "uuid": "850c5260-a8fc-49a6-818e-74220a7b75ca", "value": "D324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017636, "uuid": "35b0cd43-4090-4e55-b9ad-336a48d542dc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017636, "uuid": "e38b0410-cca8-4e4e-8b1a-62cb807421a2", "value": "3072:y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017636, "uuid": "e566e52c-c134-423d-a344-e9d764a85789", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017636, "uuid": "861e6a4f-2655-4e7d-8435-fa55c53fe388", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017636, "uuid": "13c232e5-1c6b-437b-8d3d-d30d4c26fc52", "value": "3ca263eee202b7710e0118208f2865057c14055cc9592a323d6f00e6afb289d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccecaa0b-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004519, "uuid": "4203d33b-aec2-416d-95a2-76f13792cac5", "comment": "Malware payload (Dridex)", "value": "2554032907a03e15caa633aed358dfef", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004519, "uuid": "3e307a73-4e8e-496e-b15d-7ffdf235153e", "comment": "Malware payload (Dridex)", "value": "3ca33b0a48eb7083bc73d2fbd7c599eabf045ffdee9d9fae9b4a30bb5ebd7b4d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004519, "uuid": "efee40d7-2071-4a7a-966b-c1ec89a8e9e4", "comment": "Malware payload (Dridex)", "value": "0b8c442878875ac552e8516439677f2fcd58f043", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004519, "uuid": "f597e32f-e54f-4df6-a87e-b1910a5992f1", "comment": "Malware payload (Dridex)", "value": "9d8b69476e872087d414d121a883accee91247a84ec7c754a5cc00818a68104265e5c0531334dafd0563c95072b17400", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004519, "uuid": "6cec700c-689e-4137-a120-0048cced5bed", "value": "B424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004519, "uuid": "91cb107f-96a6-46d8-92e1-f90949d6fbc3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004519, "uuid": "a25b1831-557e-47c0-98aa-dce3d991c967", "value": "3072:o9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:o9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004519, "uuid": "2fcde700-21d9-470b-b3a5-3e55f16f0b3f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004519, "uuid": "42eab945-b0b6-4ec2-aeee-baf417cb33d7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004519, "uuid": "2c237981-3af8-45a7-bed8-04ace6e1b76f", "value": "3ca33b0a48eb7083bc73d2fbd7c599eabf045ffdee9d9fae9b4a30bb5ebd7b4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7fb0c2-8747-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616002777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002777, "uuid": "df885832-5f70-48ef-b0e2-282232033581", "comment": "Malware payload (Dridex)", "value": "5a4eb91a9135eb904302a8674db89ced", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002777, "uuid": "b3f90c13-0dad-431d-9f38-1ba2f6588874", "comment": "Malware payload (Dridex)", "value": "3cc12fe9190724e4f3410a9dd01a56b061136f5a30f04a00ed525895a799f4b6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002777, "uuid": "5e3b8d3e-a930-4586-891c-455e6a598063", "comment": "Malware payload (Dridex)", "value": "90001e2b352c00d88eb16f444b0e6100d1b6a0c2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002777, "uuid": "91676634-f30a-4800-8f9c-d74610ed1d74", "comment": "Malware payload (Dridex)", "value": "f47169b0bc0d5ea2270e112234522838b6afd7affd56ddbb43b8775cb6d528a81611ab0fc1cad5c190e6f1348518810f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002777, "uuid": "144a5db9-67ff-431e-bd87-6fdd10a7d3b3", "value": "9924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002777, "uuid": "2247ada1-b5df-4a52-896d-b97854445f91", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002777, "uuid": "576e7320-2f90-4ee9-86d9-46182dc982ee", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002777, "uuid": "6bebab0a-ff8e-47b2-b2c6-d1df348c2483", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002777, "uuid": "24e0abb4-2904-404b-9040-f560c55d6b70", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002777, "uuid": "b88dd099-2f12-4538-993b-d6b814a516af", "value": "3cc12fe9190724e4f3410a9dd01a56b061136f5a30f04a00ed525895a799f4b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a23597-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004082, "uuid": "1f0e251d-2c82-494b-8a32-f345d6252241", "comment": "Malware payload (Dridex)", "value": "a32a83cea7ead90150b2e99ff8ea1c91", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004082, "uuid": "098663f0-e766-4ef0-9660-e3ce9a1bbd56", "comment": "Malware payload (Dridex)", "value": "3cc25812e78c3fd63322a8ca1aab32a5c1df90b6173aef8fd9de62ec5da7ff37", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004082, "uuid": "302bdd36-dec2-499e-ae1f-a01e69b6415f", "comment": "Malware payload (Dridex)", "value": "a4672ee97432c9269f771fd5ae52dab3a89f3587", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004082, "uuid": "eea47089-b2c3-4009-a555-58668b562171", "comment": "Malware payload (Dridex)", "value": "4eec7f48049053b64c2b0af5ff87ebcf359dfe9aaef4900639e7bbcf14c1eab7683ec4312ffd77051dbebbe4397ad1a1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004082, "uuid": "9caa55c3-641d-43b0-9872-d61e60dc97a0", "value": "A224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004082, "uuid": "a81da966-2a2c-4fd3-9e0f-1b6a48798cda", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004082, "uuid": "4084261c-df74-40e7-9c8a-8c97dd48a466", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004082, "uuid": "bbe80d0d-936e-4d27-96f0-dd8bb8ed296e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004082, "uuid": "3f78522c-37b9-4e0a-b7d5-e34e5a35bcbc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004082, "uuid": "6bd4e22d-3dc4-4e77-932a-6a62db5013d1", "value": "3cc25812e78c3fd63322a8ca1aab32a5c1df90b6173aef8fd9de62ec5da7ff37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8206c2bc-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "8594ce28-fd2d-47ac-9daa-cca86560b104", "comment": "Malware payload (Dridex)", "value": "45966a01d75b26271842101bab66d7ea", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "d3d5b243-ee71-4a5c-a8e0-8eb42736a6a4", "comment": "Malware payload (Dridex)", "value": "3cd37f42a69abd9aae527dc292445a0a05f415810722ef1a4fe5115c55bce5a4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "4ab0929f-6fc3-4288-a64b-1108c5ba1354", "comment": "Malware payload (Dridex)", "value": "b0fb0a76bfa81d42bc9f6f0308ad77bb8f19a3be", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "b042abd5-07e2-4c11-b8ea-8779e24c0e2d", "comment": "Malware payload (Dridex)", "value": "304a31ffabd63fad5d84342c851316aa2e0f2fbf00252ed2302098d522cb268214fe8a666724929c18f0795cd061541d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "be9864f8-4a65-41e8-9a35-9f728b67caee", "value": "8724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "d3f211c7-226f-4009-86a4-558607d52a85", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "88f4556a-3033-4f53-8f88-01fcc3ff5de7", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001816, "uuid": "742ade8b-66ce-4573-8ca8-33aae8f4ffde", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001816, "uuid": "4032019a-a1b9-4774-96dc-eacda3d56ceb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "806e76bc-6acd-4b44-8ed4-d9b2d127d493", "value": "3cd37f42a69abd9aae527dc292445a0a05f415810722ef1a4fe5115c55bce5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6846a75-875a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010897, "uuid": "4689ee37-eba5-4d7c-93ee-f63e0c997b4d", "comment": "Malware payload (Dridex)", "value": "7379f99a73077c904e30ae58a8f87794", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010897, "uuid": "bdb79e6a-fc10-497a-bba3-cc849f76b30e", "comment": "Malware payload (Dridex)", "value": "3d82b3483dd52b0ba3c57be2ab547e49ccf24b1e9cc90d6ad74caf0a6725d23c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010897, "uuid": "fd933521-9128-4c47-b64b-0fee64b1054e", "comment": "Malware payload (Dridex)", "value": "3a77727ae4207f65ace0cedabff1d3c1b34f9817", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010897, "uuid": "288cd3e1-c7b2-48f9-887a-045253b0b078", "comment": "Malware payload (Dridex)", "value": "eeb457022c38c990979abd5f43d6260b70f858a02c4af599a1f694748ca364fe915bed936323ed7eb12a4694156ddb13", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010897, "uuid": "33f1397c-1062-431c-b02b-a5338d276608", "value": "1D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010897, "uuid": "8866d710-d91b-4f69-8549-6d705247c9eb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010897, "uuid": "15f34818-0e38-49f8-8d1e-57b2c7fb67be", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010897, "uuid": "cd8dfd55-0088-4dad-9a0a-99369873c2f8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010897, "uuid": "7b44d6d9-c3bb-4e3b-8de5-a121244a7ac8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010897, "uuid": "1744e5c3-9ea8-416a-a435-f20925d86a61", "value": "3d82b3483dd52b0ba3c57be2ab547e49ccf24b1e9cc90d6ad74caf0a6725d23c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f5ca11-86c3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615945769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615945769, "uuid": "eee908f6-4f4c-4306-966c-61bac8ca3ca4", "comment": "Malware payload", "value": "77232b9050ca66ee9a36a6bd49c7cdbb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615945769, "uuid": "c8cc73bb-af23-4d6c-9cdc-14ef059d7b39", "comment": "Malware payload", "value": "3dd6200864cab020bf6d2b5bfe7483f995d96be8caa1f6256791d2cbf84825e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615945769, "uuid": "c8282cec-a9a2-4627-9a63-4cb507996620", "comment": "Malware payload", "value": "f062dbd28418a4aa1a946d7d536d5c06cb1c7ee5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615945769, "uuid": "f60d02ed-90e4-49e4-a57a-7521a00ebaac", "comment": "Malware payload", "value": "abfd4b7797cb2864d0b31e6e671548a291bad31e76d0ae12439344caae04d6d83f5f915cf13227ea8501d7ca1b88c21e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615945769, "uuid": "d9fa9504-8d7b-4c2b-8ec7-00b8d0adacc3", "value": "FD73CF2BED458D83EA68C3FABF030FCD5709734D15557AF901B25E8B7B811860DAE05A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615945769, "uuid": "68e6e46e-034e-41a5-8ec5-bd8a44e85a3f", "value": "1536:uxGP/AQbgQywBGmkla+bsaCaWyVvXmkXwhHxXHYm:uc3hgQxFklapalm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615945769, "uuid": "381d4638-597e-429e-aa13-f63d4cfc9cfa", "value": 75606, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615945769, "uuid": "cbe1c971-9846-4cc9-925a-c0a209806ff2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615945769, "uuid": "93b57528-4f4a-4a03-b29c-0a5a0c430bee", "value": "SecuriteInfo.com.XLSX.Onephish.B.genCamelot.9847.21921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff960c7-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "d0b70b53-c698-48c1-b9d3-0e309768c188", "comment": "Malware payload (Dridex)", "value": "26bb9603920f5b4e14a26fd495471fb1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "c2a7d7b7-145f-4419-917c-0ce155293f8f", "comment": "Malware payload (Dridex)", "value": "3e17ec0d05ea3e2e977788371adc8e7cfd36658c0d69346a7aeaa85225ae26cc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "8c7b44a7-18d7-423f-aec9-7f1679eac6ef", "comment": "Malware payload (Dridex)", "value": "7b1a61e26237108c818da10ebc9a4960c95089cb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "621dacc1-f51e-4120-8686-87c441423622", "comment": "Malware payload (Dridex)", "value": "4934c2c929016734e006eb4653958af5ff164693f14000ab75d1c3dd286ca3941af61dbd5dfe6214a4603737c54b8ccc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "dc1366ca-e29e-41a3-a660-b2b4c417079f", "value": "D824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "8deb1b42-bc0d-4fe2-84d1-163dcad500e2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "2f749ae3-d2c4-4503-b366-96fce9c1ed2c", "value": "3072:I9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:I9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004336, "uuid": "a1e1e96c-94c8-4439-8757-a2cfe1c1c923", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004336, "uuid": "1d2c7537-c381-4c94-a2d1-ba31913aa270", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "3d2a3f5b-dc2d-4e25-860f-0b1262b08fe4", "value": "3e17ec0d05ea3e2e977788371adc8e7cfd36658c0d69346a7aeaa85225ae26cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93e830d-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004459, "uuid": "3f2baf64-71a3-471d-9366-6526485a5547", "comment": "Malware payload (Dridex)", "value": "a3126da321d3f0f14d18caaa55d3f954", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004459, "uuid": "cf822025-b2d3-4a3d-9d0d-af9cf0b45098", "comment": "Malware payload (Dridex)", "value": "3e94b19b35f60c6734de2803f5ba2d79f7a8d8830f23103c27d41c152b7ddfed", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004459, "uuid": "274d9e89-43c1-43ad-ab42-1fff8e05e109", "comment": "Malware payload (Dridex)", "value": "68f40b7be9b68af0c5edce29e2fdf0959df8d9f7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004459, "uuid": "c0071eb4-2af2-401c-b1dd-01d4216387bf", "comment": "Malware payload (Dridex)", "value": "be0bc6a4e6b97dc3bf4b35d55ce6ec56933bd37ba04e3c05c3b4c9ae70424a1c1a858a5311ab4e3d47c9dda71ffdb6ab", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004459, "uuid": "998c885a-23f8-4192-a78c-3c751e85c0f0", "value": "C524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004459, "uuid": "6c90a8f3-635e-499f-b42b-6bdec5d9b10d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004459, "uuid": "3338ce9d-fb9e-4db4-936e-eaa91da69897", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004459, "uuid": "4ab5166c-23ec-4f82-96c6-77251d86f663", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004459, "uuid": "0c289e1e-be4b-4f0b-9eee-03d41b84a52d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004459, "uuid": "10a64b47-d895-4080-8b02-8cbf7613ec5d", "value": "3e94b19b35f60c6734de2803f5ba2d79f7a8d8830f23103c27d41c152b7ddfed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fc01c5-8767-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016555, "uuid": "f2deae63-27d2-4468-8a6a-45c3de1192ef", "comment": "Malware payload", "value": "453ecaf7966f127accf24bf4a0230834", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016555, "uuid": "7843c908-f03a-4dc9-b5c1-cf96355a3d26", "comment": "Malware payload", "value": "3e9cf56a6209b7f92f72ed55c51fe0c479f897ab8b9cd97a73f2c4a03a12e8c0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016555, "uuid": "05b1ceac-5c9e-46ca-b472-0a256e176878", "comment": "Malware payload", "value": "e4b5cfa5c6adc2610d534a3f2c8752190bc0a6ab", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016555, "uuid": "a7b749ab-f237-4474-8672-b39102d696b1", "comment": "Malware payload", "value": "847fb33907c0995441e4bf2a92a0dbef0291dc8712269f545e2c759ca2d4bb4713bf17ee53b9d86cb85746f835db4290", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016555, "uuid": "1884d531-7891-4915-82d1-88b80ed5e2fd", "value": "EA24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016555, "uuid": "e14c09c5-8263-4e73-af4c-0bddaa885e95", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016555, "uuid": "53b968db-1d63-4962-88c6-65a0291487d8", "value": "3072:F9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:F9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016555, "uuid": "26307621-059a-4ec0-87d9-36d1338b6d0b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016555, "uuid": "0ee4471f-6a29-4780-a12a-726e5a0d0600", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016555, "uuid": "c6d6db4f-a454-45a5-84ed-2cd1034b4a1f", "value": "3e9cf56a6209b7f92f72ed55c51fe0c479f897ab8b9cd97a73f2c4a03a12e8c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2d1c0f-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615968472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968472, "uuid": "8e2fab23-27ad-4714-b718-3597f7d3ee35", "comment": "Malware payload (Loki)", "value": "bd4ca899945bfb9ad4c68c78faa3b1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968472, "uuid": "996f2938-dcfe-4b72-974f-b7225f9dcbc2", "comment": "Malware payload (Loki)", "value": "3ec3ef01bdfb658d74701fed38ee4a502f27f7bcac9584af633afe43548e36ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968472, "uuid": "7f5a468b-169d-46d5-afb3-815bab56e0b3", "comment": "Malware payload (Loki)", "value": "dbba899eeb7764522d8b87c755fd9c710f241809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968472, "uuid": "86e71798-b22f-456a-b4c1-dc28b98dad94", "comment": "Malware payload (Loki)", "value": "a312d9d497b7efb829e7c4e7ade45c61fe6888357e44a07c28e4da45dd8d8b5d61b2464ae6f7f0bbd47228db042ede3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968472, "uuid": "c028dcb2-ac95-4d63-aeec-cd0fccad6929", "value": "8CD49ED163409664D873027A883B9AA36573E90D9D79C53E2D91FE4F3DB234A00778BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968472, "uuid": "a26459a6-5d16-41b4-a30f-bf42ba991753", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968472, "uuid": "14e41fd9-1362-4f8e-a93b-4164b7e92422", "value": "12288:Riy1BtPSLdLki3Bil5doCnUWlphvb+31jdAA:Mam33BiXUWThvbUpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968472, "uuid": "d4480d0c-01ab-424f-829e-2721dbd4d7e5", "value": 622080, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968472, "uuid": "d58157d1-fc03-44c9-83b2-fc7cd0edf6af", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968472, "uuid": "30699f3f-2d9f-488c-a213-cc068f32ceca", "value": "bd4ca899945bfb9ad4c68c78faa3b1b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11855bf-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004070, "uuid": "77e39d7a-6b3f-46d2-ae9b-5c1d941b1540", "comment": "Malware payload (Dridex)", "value": "a4667eadc55439d2a34c0850ea588f5f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004070, "uuid": "9b3b04d2-818b-456e-994f-d0e69f6c823f", "comment": "Malware payload (Dridex)", "value": "3ecf1a8423d32cb83f6bad18b1771fa4d22a0949c7d6cb0defc491e127962851", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004070, "uuid": "93c83708-78ae-4ff4-8063-28ebb5acb7df", "comment": "Malware payload (Dridex)", "value": "562ca5afb8d0f7ad16c54b8910a0a8dfb295438d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004070, "uuid": "63d0accb-2ad6-46e1-b19b-f7324e6c6ac6", "comment": "Malware payload (Dridex)", "value": "62bece069a06c2c57bddc5779ba3b6b12f0d497fea5a1c309f10b04b4881d5d470b848810cee3419b2a2e71031bccc55", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004070, "uuid": "f1816dd7-799b-4ae1-ae8c-2176d7a763fe", "value": "2124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004070, "uuid": "b53bfc29-0480-4f38-ae85-cb432bdc3736", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004070, "uuid": "60c5fc67-8499-4a92-b610-53cce8ba50ea", "value": "3072:n9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:n9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004070, "uuid": "e3664dd7-a199-42fb-90be-d6d4a6564773", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004070, "uuid": "cc7f1430-2f62-4871-a905-6fca29c45f0b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004070, "uuid": "47978269-669e-4d76-874e-616945fffaa9", "value": "3ecf1a8423d32cb83f6bad18b1771fa4d22a0949c7d6cb0defc491e127962851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e81bbb6-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969410, "uuid": "f8ae4e13-735c-4a3d-83e7-01d536366925", "comment": "Malware payload", "value": "2e9820ecd1baa3220c65cfede97c119d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969410, "uuid": "7bc43785-6f53-4694-b464-a076a0cd0236", "comment": "Malware payload", "value": "3eec2f0cec06aaf7f41a67bfff612f25c821ed90f47d49afd0b6a6d799ae516c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969410, "uuid": "a5851ba9-7423-425d-a188-131e6e5f712c", "comment": "Malware payload", "value": "8e1e3fde6c4f79451ee0138a387dbf870ba53e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969410, "uuid": "16651805-a6d8-497d-b8fc-6d8c5e60cdd6", "comment": "Malware payload", "value": "b918f03dd0ad417a3f378c49863bba558ee03811e965060536e497476265669be363036e560bb3589bf9a386796038f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969410, "uuid": "2212109a-7c66-4dd6-994d-7c0a6b5a56ce", "value": "1976D98ADFD765899415276E932187E6B329073ACB6CF4406537F12E7C8730A26CBC39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969410, "uuid": "b8db5367-fcc2-4669-82f4-5b45eeae3fba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969410, "uuid": "6fbedfb0-7c37-45c7-869c-26dd969eba63", "value": "6144:qEvaYlFt2R69NYi3gn0qkBR4Sotx55fuwJiF1hn2sW8/EE4gKSvC/9lGgS1bAGqr:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969410, "uuid": "5474dbdf-6ea8-4172-9a0b-c931c45dda18", "value": 7386112, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969410, "uuid": "1523fd8c-b731-4e84-9de7-58dc7a8bd517", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969410, "uuid": "4dda3cde-6427-49c3-adea-40503800d4ff", "value": "2e9820ecd1baa3220c65cfede97c119d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7de0b1-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616013033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013033, "uuid": "fe35d4dc-ba6a-411a-bf9e-266ccf57a1c8", "comment": "Malware payload (AgentTesla)", "value": "f0898152edf87ad9046c22f3c682fb16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013033, "uuid": "425599a3-5d08-4427-8cf0-362b740d3030", "comment": "Malware payload (AgentTesla)", "value": "3f127433cc26aa8e2fb7594e51c076ef392b9143595e1a025d8cb065049fc3e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013033, "uuid": "2073390c-e7f3-4956-a32c-9a70f62aef1e", "comment": "Malware payload (AgentTesla)", "value": "6ccfc0fd7bec08e71a6760120ffd2317a07178db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013033, "uuid": "f4bf676d-61af-4907-8552-f3f64d9267e8", "comment": "Malware payload (AgentTesla)", "value": "1a98b8d1d263602e8fead55372cc7e14a40b4eaa717bf715f28d4209a38cf5ab46e23fd8214df21cfa88b8f2dce2ced3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013033, "uuid": "86693fa8-9f33-4908-966f-8d10c3d4f5e4", "value": "F7D4F16223B47B65D0BD13B92978110213F1F44AB633E37EBE65A0CD0A67B45C6B2736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013033, "uuid": "1ae697b1-c158-46ef-a42b-0ed17e3fe828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013033, "uuid": "294bfa4e-31b9-4af0-9b60-ed62e780f6c7", "value": "12288:yKmNBkq1rPWOeHC6qyYBXAAnvu2Vpy0S6NpMDH297w3x:bMBkybWxHC6VOXAAnWKNpgNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013033, "uuid": "c9e0a682-f435-499e-ae72-3ee958001835", "value": 615424, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013033, "uuid": "40dc0dfe-b601-4432-8550-7a58b69ca27c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013033, "uuid": "5550d21d-7d50-48c8-805a-17e8923eb616", "value": "c3oWuf8mb3ix7MY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e883860-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003341, "uuid": "0869cb4c-cc3e-4cb8-ac04-fadfa91b5ce9", "comment": "Malware payload (Dridex)", "value": "cc1726434bec922ba21b85baa6af1a8f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003341, "uuid": "cf5c0e0e-8573-4b8d-a967-a5e0afe6fdb3", "comment": "Malware payload (Dridex)", "value": "3f8546ec5e53c9887391677817e3d8bd3dd3cea5d7156442a1cef9037de71b06", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003341, "uuid": "ebeaf73f-18d8-4ffa-9578-6e37a7de0b8b", "comment": "Malware payload (Dridex)", "value": "a75a8ea7830b075ccfe3abefc5a6e25392d78a99", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003341, "uuid": "4022b5e4-2c9e-481e-bed3-a83cf46ef8d7", "comment": "Malware payload (Dridex)", "value": "04b9223f501d06653cf2ae564193adaf106190f0d46c029c5495d32080379129150f27a16ab77fa9dddf176bb50d39b7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003341, "uuid": "ccbffc32-6522-4031-8df1-5bd38fb775e3", "value": "1B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003341, "uuid": "28dc978d-cae2-4a6c-8684-0d93777f7b7a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003341, "uuid": "7cd70087-feb9-4662-a551-74d274c4a52f", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003341, "uuid": "ac4dcd59-00db-46e8-a062-c3fe95c759c6", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003341, "uuid": "1fa699e3-0a59-4bbd-8e56-98c3ccca03f0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003341, "uuid": "b091d264-5076-4c6e-b690-c42e1e3d975d", "value": "3f8546ec5e53c9887391677817e3d8bd3dd3cea5d7156442a1cef9037de71b06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91935f99-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005278, "uuid": "f7aa7837-9ff2-43f8-b357-b29848415f24", "comment": "Malware payload (Dridex)", "value": "42884fcbeab067bbf3e411b6a252869a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005278, "uuid": "464f2607-dc7b-446b-811a-24cddcac4009", "comment": "Malware payload (Dridex)", "value": "3fdfa52cdbaad1ef0d0f35832ecd8ad50b3eb24a67a36a5d438ef91051861973", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005278, "uuid": "4012a9b8-6d68-443c-ba87-931d03e13f64", "comment": "Malware payload (Dridex)", "value": "89e4d337c0d1d607fbed54fa600c691228ae4553", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005278, "uuid": "452d94f8-e4bb-4aad-ad6e-ba205bb58923", "comment": "Malware payload (Dridex)", "value": "0ccab71c8dbf1dbacf1d8781dcc84fc6d2526f44ed80ab6f594fd674bf4e1bc329b990e53e15caf910b33304e723d817", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005278, "uuid": "a5042a15-8b36-433b-9c12-9169eacffe13", "value": "2F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005278, "uuid": "e46d96cd-483a-4046-a4a3-1b2cf6182cbe", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005278, "uuid": "39ffdd84-813c-4402-810b-ea91119187f4", "value": "3072:Ld9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005278, "uuid": "e1246ec6-cbda-4c22-8aa9-1fa7291df08a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005278, "uuid": "a682e5c4-0fb8-478d-9939-48396f41e354", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005278, "uuid": "9fd98026-3acb-445a-a6b4-b15875d7a4fb", "value": "3fdfa52cdbaad1ef0d0f35832ecd8ad50b3eb24a67a36a5d438ef91051861973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cfd5cd-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001694, "uuid": "29c0bdf2-fe52-401a-a989-e7dfbcf840de", "comment": "Malware payload (Dridex)", "value": "8366956235c00d650c0be496baae8e95", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001694, "uuid": "955d3b8b-c194-44a1-8fd1-92f8a4dbc469", "comment": "Malware payload (Dridex)", "value": "402248568342650b6599bc65a78247c24c4e81a435c374f2f5260c524a4b8581", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001694, "uuid": "c60d4657-64ce-4d3b-963f-b3caddd1bd61", "comment": "Malware payload (Dridex)", "value": "c3ea254b12668224aee36affc9e0ed7a2a565e6b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001694, "uuid": "600cefde-e8c3-4a26-8ef2-9a4771843d71", "comment": "Malware payload (Dridex)", "value": "9c0a763cee550e27fec432d6cc7c8f20466d96e51cb87216957f1273514f3700f9aba54ad5d86a0340605709d9487768", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001694, "uuid": "070e57b8-3563-4210-b110-6fc45d340050", "value": "0524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001694, "uuid": "891b6341-ae65-4ca7-b106-69fe90c50d5c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001694, "uuid": "9ffbe36e-0a95-4b3f-a596-830982811879", "value": "3072:L9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:L9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001694, "uuid": "3ee607d6-2001-4a91-abbd-ee2439050076", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001694, "uuid": "ae9205e5-2528-4b70-8291-b4bdbd8b2bf1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001694, "uuid": "49de7bf6-1c9d-41cc-9bb5-b0814f68505e", "value": "402248568342650b6599bc65a78247c24c4e81a435c374f2f5260c524a4b8581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a05a15-870a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615976475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976475, "uuid": "4b9c8bbd-39bf-42ec-8811-da16d8123e4e", "comment": "Malware payload (Gozi)", "value": "965d3a30d188e177e83c650b61fa09ad", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "prosper-tv-2015.com", "colour": "#9EE98C", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976475, "uuid": "8c349186-85a3-4212-a5ba-02ab923c26ad", "comment": "Malware payload (Gozi)", "value": "4033369a9e56910501e44fd2e89b89c4dc2678ff01597bd732a7f92661227ba0", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "prosper-tv-2015.com", "colour": "#9EE98C", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976475, "uuid": "dda489db-5525-4397-884e-ecad5c6116de", "comment": "Malware payload (Gozi)", "value": "3731d20098ffad4fc3203b52e50cd2ebc1540e48", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "prosper-tv-2015.com", "colour": "#9EE98C", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976475, "uuid": "29648773-3e5b-4d54-a7ad-e9d59fb75a30", "comment": "Malware payload (Gozi)", "value": "f1f7144ef4cb43c0434b756dc4757e42e67b28c0106902acafbfa41f438cce93840a53bb2eef56162c0c14bbae47e787", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "prosper-tv-2015.com", "colour": "#9EE98C", "exportable": true, "hide_tag": false }, { "name": "pw6564234", "colour": "#CED4C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976475, "uuid": "6b4b3c9d-fbf0-46c4-8488-295e2f147cff", "value": "E981849D6483CB5C3B3614859A3D8690D8F059306961ED69FD8CCB8932B17B3D0F619E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976475, "uuid": "4897e8b3-7dfd-4058-a48f-97778755174c", "value": "96:zb/lfkMIT3kv24oKQdv96035z7zdhS9ralPPh:zRfwYDoXv96035z7zdhS92lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976475, "uuid": "987d88b0-1d7a-41ed-b1ab-3424eb9d16d1", "value": 3944, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976475, "uuid": "6d0b3e62-fdde-4c88-b905-3aeea184661e", "value": "text/html", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976475, "uuid": "ca046701-2bed-4614-bc4c-365945e065c9", "value": "aTPso.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c82cbf-874f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006148, "uuid": "48050ce8-dd7f-49ff-8780-61c1d21a2570", "comment": "Malware payload (Dridex)", "value": "fe4d037ecf2556472f2344033366ac00", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006148, "uuid": "db3083e7-fbfc-47ea-8852-c4f784430715", "comment": "Malware payload (Dridex)", "value": "40681925a0570f4d3bd4fdf873a0dba9a3bc0eac8a83909763421caba53722da", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006148, "uuid": "f34bb417-9fad-4e4f-bb4b-730e6f61a8f5", "comment": "Malware payload (Dridex)", "value": "3c9e69786a684616baa52d592014acafb2bc4a7f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006148, "uuid": "5268870c-82b8-42e4-9592-60d4a36a3d29", "comment": "Malware payload (Dridex)", "value": "f20e7a94e539717a06b11972401f38573a3b0a46b4b7ac63f16a1516083f2146586b2a9c0009fb2d5573d6c175aeb42f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006148, "uuid": "7b1cbab6-63ce-4cbf-8340-2fde21124d1e", "value": "C424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006148, "uuid": "d74b8da7-c6f6-4d9a-bc1c-aff2753d6b1a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006148, "uuid": "f0aae907-d1d0-486a-9b8b-a324d049914c", "value": "3072:99Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:99Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006148, "uuid": "fb0a91bf-ca87-48dd-b4f2-4ef87b5be322", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006148, "uuid": "05d485cc-1c22-4ff2-aa86-878edd4a0a60", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006148, "uuid": "365ab85d-2beb-40d8-ad37-e21d17ad19f9", "value": "40681925a0570f4d3bd4fdf873a0dba9a3bc0eac8a83909763421caba53722da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5966c208-86bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615942907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615942907, "uuid": "f0ee5eff-5610-44e2-a20a-19eb587ca642", "comment": "Malware payload (Dridex)", "value": "3688d754745886cde0284e5b791ff244", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615942907, "uuid": "ec50d7e9-2297-48bf-9ed5-f511d04017ad", "comment": "Malware payload (Dridex)", "value": "40b20bf3247ac834038d21110c55b2dda4dc1fbf3cb220216c57af73ce3064c2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615942907, "uuid": "64c46663-03be-439d-9d8b-2acb5834e3d5", "comment": "Malware payload (Dridex)", "value": "9a50c04be43f18fc6c4dd34ffabe9380c1783d09", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615942907, "uuid": "db09e84d-91fb-42c0-a93f-62b5da2fd3d3", "comment": "Malware payload (Dridex)", "value": "a6a20b8a94828d067ef8da7b1ca555e99757823537d299f72e564e66ffc86bd62dda6cb3c02dc09844368509104b24c9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615942907, "uuid": "a9378fa4-6ace-43fa-a6e0-9060972b6386", "value": "6114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615942907, "uuid": "811540d1-aff2-4f62-8f6e-0230d420b56b", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615942907, "uuid": "c48843b7-bccb-4d8e-8823-3e4c1ffbdaa8", "value": "3072:x1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ji78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615942907, "uuid": "bc326d6c-6b49-4312-af4c-db1d29f90e77", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615942907, "uuid": "ab3251d6-5e9b-4ce1-b72d-4cfb69b17e50", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615942907, "uuid": "287d2151-9210-4818-9ced-d9d6646e490d", "value": "40b20bf3247ac834038d21110c55b2dda4dc1fbf3cb220216c57af73ce3064c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aecc337-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "1ce2904e-e3db-431e-9f0c-65ac8f2665f6", "comment": "Malware payload (Dridex)", "value": "aeedf1049220672b8fbcd059477e1c9d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "1961bc42-96e1-4f51-b52d-d6ec5760a9a5", "comment": "Malware payload (Dridex)", "value": "40ba1cd11c60ea825f133da948ea496c849435f4a76b0a37650f557dbb63c385", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "798ca040-438d-49ee-a7f2-1d1d202986cc", "comment": "Malware payload (Dridex)", "value": "0445b99f2a81486373268e0e887bc58ff3548c02", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "9365c60a-2236-4646-93fe-6b1b4cb38a44", "comment": "Malware payload (Dridex)", "value": "e158eb1c280e386649a7f72cbfe7fcc085db4a64660b6efc9dfe24900d17965b8597c7c583d3c62b6f21fc36f02a9083", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "2de59312-fc2e-40cb-b2ea-f9ea5bd9ff4e", "value": "9E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "9c9613b1-5df1-4ca3-8086-75cfa74e18da", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "9578f648-a664-404e-be0d-810b7229b798", "value": "3072:y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003845, "uuid": "4d250fc6-fe69-4896-b56c-c8af65f5b627", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003845, "uuid": "a3fa965b-4380-4122-9e72-98629150b126", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "de462dd4-ab3a-4ad5-93b5-e55d642cc01d", "value": "40ba1cd11c60ea825f133da948ea496c849435f4a76b0a37650f557dbb63c385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a75b30-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615965527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965527, "uuid": "a6a98bda-47f2-4fb6-88d6-175c7025fef8", "comment": "Malware payload (AgentTesla)", "value": "ac5b2ec956f5596a61b026c1dc01a666", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965527, "uuid": "2ad40a92-758d-42a0-b686-e7262dd7e026", "comment": "Malware payload (AgentTesla)", "value": "40cb9922dd5cdeee9c61010e3914da9a363db0f2d15e3aeabfd917daaa9ccf74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965527, "uuid": "99e0e87b-1260-452d-a9e4-caabfac06856", "comment": "Malware payload (AgentTesla)", "value": "1d3903701cd12b93f1f24866f5ec63c76dd9d4f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965527, "uuid": "183976c4-3c36-46db-a556-efc897d693fd", "comment": "Malware payload (AgentTesla)", "value": "0831264416e82e923d47e850b4564a69ba66df884b3a1140c1fabd0ec85711fa81a1fbe09a1e7f3470b2b177e09d6fbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965527, "uuid": "c88bdca4-f02e-471c-b918-c7c3b16e0de0", "value": "FEB4231DE42242FB7EB026529F3518C0235AA3BD623AFC19A9CF75E40D70276B45A897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965527, "uuid": "d4e9e7fc-3304-4a66-979c-462dc1ae3c87", "value": "12288:zS258gjnEm87s0Zf/DIpHZTab5yJW8whJqlKWsjV5o0u9miK:eHj9Ii/DSHFaUI80L7jV589miK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965527, "uuid": "0f1a34d3-cb4e-40b3-a73e-516b2441bea0", "value": 525299, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965527, "uuid": "5954403c-ccdc-4196-b6df-a2c2cde31a76", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965527, "uuid": "da98894d-a5d5-41da-8e9f-e982ce3d9409", "value": "PO#20210317.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064f27eb-8761-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013635, "uuid": "d1f5dee3-561f-4654-a729-a4704252a62d", "comment": "Malware payload (Dridex)", "value": "ee6c94bb925bc6949732c8951371d129", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013635, "uuid": "d76c7bda-3084-43a7-b7eb-f76138d1b032", "comment": "Malware payload (Dridex)", "value": "40e85f1dec2a2dc6652dc406a8c8c84c854f1513f814744c26bc0471c19c47ed", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013635, "uuid": "eff07601-3122-4300-83c5-9cbc756c26f9", "comment": "Malware payload (Dridex)", "value": "e4766ef448a54d2843b78f589a17715d17b6cf76", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013635, "uuid": "d9b5bb7d-b144-4a3d-b880-f6d363629fea", "comment": "Malware payload (Dridex)", "value": "73e1992d7ea973af3b2e5417f75dec941eb092649b2ab1bb79effad77518fab776f1edc54cebf227bd81f86e4e3d2363", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013635, "uuid": "661278fc-2c47-412c-90a1-7b599aede2e5", "value": "8A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013635, "uuid": "a4d3a029-2f62-47f9-9240-d5299bd9a304", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013635, "uuid": "4c9cdbee-fef7-4fbc-9cd0-100b0688bf59", "value": "3072:p9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:p9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013635, "uuid": "c6f541e7-c7f1-4200-9bb1-75e182c75e69", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013635, "uuid": "0720076b-b412-434f-989d-93a20591c652", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013635, "uuid": "6d2a3975-9997-4d68-a120-42d560dd7fad", "value": "40e85f1dec2a2dc6652dc406a8c8c84c854f1513f814744c26bc0471c19c47ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06255335-8766-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616015782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015782, "uuid": "7d904f3b-fd51-431c-91f1-f255f5f4c897", "comment": "Malware payload", "value": "0199c9bf3fe83a0f45f0920186913e7c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015782, "uuid": "55810dba-cb20-4fa9-ba35-635f3fcdff93", "comment": "Malware payload", "value": "40f8c1646fd09db8608b11b75a1a375d48503dec0e831301396fdda3d91962c4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015782, "uuid": "ee430dfc-79d0-4680-9918-603e785a4667", "comment": "Malware payload", "value": "4d9575a898715b9ef586c403aa13c821559fc7c1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015782, "uuid": "f69b3ecc-74a6-42bc-b460-cee979a8898b", "comment": "Malware payload", "value": "ddc7e1ead81cac734a3143858dc71a59448401571d41986530b56964a1b1ad729381046b9615b4c325ebd70723448e27", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015782, "uuid": "cab201ea-4ba1-4756-a0a9-f24c33e97b3c", "value": "7124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015782, "uuid": "4aabf843-cb5e-440e-8a93-2b883a8e5cb6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015782, "uuid": "50901b5a-48d3-4ced-8584-80b81e38b792", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015782, "uuid": "6e79cf51-47f0-44c7-895a-ffe73a308f1b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015782, "uuid": "db20a84e-f397-4f59-8e06-6faa4429c60b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015782, "uuid": "1736c9ae-5077-4520-b921-9bf41d77515c", "value": "40f8c1646fd09db8608b11b75a1a375d48503dec0e831301396fdda3d91962c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9604b3-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615968572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968572, "uuid": "cc10e313-e9ef-4e17-b273-8486312a1f2b", "comment": "Malware payload (AveMariaRAT)", "value": "5a9183c8fd086c93aef7690033f9614d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968572, "uuid": "0bde79fd-adf7-4aa2-afd0-23a32baeb46a", "comment": "Malware payload (AveMariaRAT)", "value": "411a7c0f381354be120c25158756008260b2ba2f3b2a83e4a514602ab09edbea", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968572, "uuid": "46106968-c86d-4772-8a8e-ad67f2cb127c", "comment": "Malware payload (AveMariaRAT)", "value": "f42a854e365a916376978342c5dacc531704638d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968572, "uuid": "a5762162-8621-473a-b339-bde9ab799675", "comment": "Malware payload (AveMariaRAT)", "value": "d0a389f69c622b18a0de58c813af81dc9442394a038ee6717a96bf56f91aadf253d82bfedf6186d122143bef5dfd7eb9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968572, "uuid": "05f48ffa-b7ec-4adc-b8a3-efc3ab186d6b", "value": "60E4AD8DAA040263D819037915E6F4F1E6262D695D25BBF828C9389B3A77770C1237FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968572, "uuid": "3ac40fd2-065d-44fc-b2bd-151f34fb88f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968572, "uuid": "11601ef9-8ec2-4c0f-9b26-a0e9338c29b9", "value": "12288:8VzZ8KVV+JYLZ/jsUXs+60xun7sn0thcUNx+hIw6qiWU99w5:KzZ8QVPLZ/jsXX+u7sn6hcOVqQ99U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968572, "uuid": "40301c25-53b8-45ea-a0c1-2915750685b9", "value": 701440, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968572, "uuid": "9b2a4cfc-d837-4cc6-b072-4fe515839e2e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968572, "uuid": "a8008151-98f8-4800-a990-ff30ef739f80", "value": "reorder17032021.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6324833-875a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011031, "uuid": "9de9f7cb-5383-4432-aeaf-1c3a235cc409", "comment": "Malware payload (Dridex)", "value": "445d24c91c019ffdd49f4de5e46229be", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011031, "uuid": "176b0663-4871-4f2d-a070-96233366c75a", "comment": "Malware payload (Dridex)", "value": "4143ee7f121444a32894f004f657fac71def9f20956bc5bd217f461a10e230d2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011031, "uuid": "4a115720-748d-4f73-ba16-42b56da26bd7", "comment": "Malware payload (Dridex)", "value": "b11fe9ed9dc48489098b006c4791d588fb76123c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011031, "uuid": "fe41c59f-7e3c-4d82-adf4-9a57b0b2c047", "comment": "Malware payload (Dridex)", "value": "a0fa5353785ac36f109f105445efb47e6e0e31c90e5789ea92e7d782b9e28b2ee78e20111f97be5c14525557e4c56809", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011031, "uuid": "2c787b9c-ad71-4a1d-be01-e37dfd60f7ff", "value": "ED24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011031, "uuid": "66c4d65b-6c01-49d1-b3bb-3e1cdf1af178", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011031, "uuid": "7eaf3384-aa56-49cd-9fe9-f44e3f1690bc", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011031, "uuid": "39ca1725-9143-4fe5-9269-a002837295e8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011031, "uuid": "4c307dad-3c62-48ba-8949-8e6e4690a003", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011031, "uuid": "10b3c0ae-8be5-4ce7-a3e9-90b7fac390ea", "value": "4143ee7f121444a32894f004f657fac71def9f20956bc5bd217f461a10e230d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4739e662-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005154, "uuid": "b00a0779-701a-4e03-b98c-6cf841f66d0e", "comment": "Malware payload (Dridex)", "value": "1a69f73eeb2aea10a79383d723191612", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005154, "uuid": "fe3e60a6-e97f-4069-a148-ff3eec5a08b9", "comment": "Malware payload (Dridex)", "value": "415cd1c0d8341555a6d9323929a582dc58d53b33ee5b56b09b0d05fd64f3cd67", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005154, "uuid": "da8fb9d7-e549-4244-b857-9099ccfb241f", "comment": "Malware payload (Dridex)", "value": "7bcf512024a706e9ad34ad350ee09adaa055e09b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005154, "uuid": "c82d50a8-813d-46d8-b3f1-f47e73364033", "comment": "Malware payload (Dridex)", "value": "f2f4bb09c0d8d000124bf2805bbba65dc184cc14a7e9e439210e3d2d3e16f51217d0740ffdc7313608ec718a58a64473", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005154, "uuid": "12dfeaa2-bbd2-4026-99a2-3ea0e71ad282", "value": "0224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005154, "uuid": "e8a8b8b5-7073-4dc2-9cc7-16755ad424d1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005154, "uuid": "8e2a30e7-75d7-4195-a5a1-9b9ca1339550", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005154, "uuid": "46c834c3-9a17-4e43-9ca3-b58383f9f0da", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005154, "uuid": "05e1075d-60da-4b5b-9561-c1531a82f1e4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005154, "uuid": "8bb97993-0b36-41ef-86e7-ff0232232366", "value": "415cd1c0d8341555a6d9323929a582dc58d53b33ee5b56b09b0d05fd64f3cd67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdba6d9-8708-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615975526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615975526, "uuid": "f7b9ebfd-18c3-42e6-815f-51e936ffaa4c", "comment": "Malware payload", "value": "4c1316effac54d20c99695f224439ec0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615975526, "uuid": "06f79440-f18a-4851-939b-6f8acb2b42e9", "comment": "Malware payload", "value": "41ba10cb0aa074f635c055a74354f1f4de128839d689808fa07eb72c4b081fdc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615975526, "uuid": "a69a60bd-c302-4b54-a716-faaecf4eb33f", "comment": "Malware payload", "value": "d85c6ba2c20b651bf783a7f4f5bee3e9b4f422bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615975526, "uuid": "7ef66ea4-fccb-4034-b2f0-843906b085e1", "comment": "Malware payload", "value": "512fa6da999f6525dd3084f6c5dcd92862265e45e8b41cb9514bdd013390271c52d1635b3122abfdf8e40440ebeeb1f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615975526, "uuid": "2856d0a9-e8bf-44a0-b115-0a96609344d6", "value": "5845F1E998C49242C91744F14C5BDB71339F7C2E99AB440676EFF6CD8E6AA838D13207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615975526, "uuid": "ad023062-c628-4f07-bf8e-810e5b22aa51", "value": "12288:d1f+xKtKPno7tFXT5gQKkk3DDVWbOlNdiBn:d1f+QtK/2X1ZiDDVD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615975526, "uuid": "67ed5f7d-d7fd-4257-b0ec-4cd66d04d7ad", "value": 1245184, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615975526, "uuid": "28382bf9-40b9-4911-a35e-40082d24fe35", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615975526, "uuid": "caaf516a-2229-406a-93e0-da166001760d", "value": "ABMT-6382353825748FT.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b6b554-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615969662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969662, "uuid": "61a1244c-88bf-4f06-8601-e7f5efd27dd4", "comment": "Malware payload (SnakeKeylogger)", "value": "256ccaaa9d1aa36e07be70c8073215cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969662, "uuid": "8ab8b073-622f-4147-acf8-c04d3611cdd0", "comment": "Malware payload (SnakeKeylogger)", "value": "41c0e30ac806cfa0e08d08a9ad0deb3729ab575237178a0c3f76d4ababde2756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969662, "uuid": "89bdd0be-e558-4c69-913b-00ef4bc380ae", "comment": "Malware payload (SnakeKeylogger)", "value": "a1728507c92c45e3fabd180d3161a9f8bac91d0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969662, "uuid": "70625925-064b-48d2-b353-f3e85d707c95", "comment": "Malware payload (SnakeKeylogger)", "value": "3b126a2be74d02776d677cab535b677102835b681fdd0447d94737d26e2d99970db5dc587b730c92fbe3e8f79dc97e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969662, "uuid": "19e5d71d-9a11-4b74-8009-7f67538922ff", "value": "2BD582C4B628F1B0E38FDAED6CF6085874C2C85DB16E56D676D4238A1811B07C6FBB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969662, "uuid": "242102db-b3f0-41d7-ac32-1f4c12c8e72a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969662, "uuid": "259757d9-2825-4fe0-bb95-56adae3709ad", "value": "24576:SZ+k28mcqWWrWWe4rEVJNawmNuWGLy20GjAM+RVJZ5X:SZ+k3mCWr6VNaKk2vQRVpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969662, "uuid": "3d0dded1-449c-4b62-ab84-cc54935b3a34", "value": 2824704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969662, "uuid": "9b4e1b27-204c-406c-a860-e2ea7e827636", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969662, "uuid": "6d4e997c-a25f-4feb-8021-b41eef15eddb", "value": "94103750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0085b33e-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003317, "uuid": "f1101dee-3c9c-40cb-8ccd-7d9f1bf4e652", "comment": "Malware payload (Dridex)", "value": "6ed88ce859276f01a936dd90cab37dc3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003317, "uuid": "a048904c-b1d7-40b6-9a49-b16c60951177", "comment": "Malware payload (Dridex)", "value": "41f8522bb72d9a842fc2d78c9956cbb364439be19b75ea93a0667e349e13bbb4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003317, "uuid": "be6d2434-4609-4320-996a-363f1dd8b536", "comment": "Malware payload (Dridex)", "value": "bff11b9a6210f83e2c78b40f4701f79aafbfa5a0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003317, "uuid": "759d91fc-6434-4575-875c-78b2c705a2ac", "comment": "Malware payload (Dridex)", "value": "4a7186c4bff279749a9cd8cefeeafac04d740a4ac146d6f7635330470486b1889d2b25ef118af3463f8246a9e3fb09e2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003317, "uuid": "2b093364-cdf8-4d6d-b1d6-f361e8eca748", "value": "6624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003317, "uuid": "b8367023-909b-465e-9276-5e709a323220", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003317, "uuid": "1667d640-ffd9-46bb-8e60-42865bf49279", "value": "3072:n9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:n9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003317, "uuid": "281550d6-5762-4208-866f-fa79910593b0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003317, "uuid": "2340f2d9-a332-4611-8238-cdd1d1170232", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003317, "uuid": "c968c18d-940c-45fa-8e0d-48553c0a178b", "value": "41f8522bb72d9a842fc2d78c9956cbb364439be19b75ea93a0667e349e13bbb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5bf1d9-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003718, "uuid": "9a5b0755-49d1-4cc0-9991-40815caa4d3c", "comment": "Malware payload (Dridex)", "value": "0a23db5fc7e948c84b589d933ac697bc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003718, "uuid": "d8b742b1-a8cd-462e-93bc-d1ae5a90f810", "comment": "Malware payload (Dridex)", "value": "41fdfba4234f6e812f92caa58ff80d91fb6efcdab2e43a646e8d6a08e9db2274", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003718, "uuid": "b473d644-b5d8-4975-8de3-e3554cb76e02", "comment": "Malware payload (Dridex)", "value": "4bf4f36e8afeba9be52231a671ded50adea48403", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003718, "uuid": "a7a4cb19-a811-4ea6-8d3f-5fefa8d9f672", "comment": "Malware payload (Dridex)", "value": "8995f1179703688cf32a8e016b330408ab2e237137337c9befb566c3576f3c643b545b19b07cd7522bf0a3fb8ef99f5b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003718, "uuid": "a8b47b64-15d8-416e-a93f-539b95a1de38", "value": "A124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003718, "uuid": "dcc10d63-eb5f-427d-b287-d2ff6e251029", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003718, "uuid": "79e0dc45-809a-4c00-8376-1177da7671bd", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003718, "uuid": "2a7e05f1-23e3-44f0-a5c5-9c33deb73dc6", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003718, "uuid": "418eb8cd-2433-40d0-9846-1c7db8794b5a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003718, "uuid": "9cabbd84-b51f-4b88-8b5c-9a8088877fb9", "value": "41fdfba4234f6e812f92caa58ff80d91fb6efcdab2e43a646e8d6a08e9db2274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f6ad85-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004351, "uuid": "b31d85ba-e272-4254-adba-fdd62bd449e7", "comment": "Malware payload (Dridex)", "value": "e75b324337ebcd9a8ab3cbbcbb216f61", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004351, "uuid": "1328259c-c946-4aa6-9ced-e17e9d1f5e19", "comment": "Malware payload (Dridex)", "value": "42710f05fd3cd909d03054819635fa56a36db8cbe6eae568361ff941af982292", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004351, "uuid": "eb21685b-25fb-43e5-bd2c-7b562abc09b0", "comment": "Malware payload (Dridex)", "value": "17c3c2033ca3648cec754587c70adc0d7d0010b9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004351, "uuid": "eba923fb-1208-4052-99ca-8334327ba348", "comment": "Malware payload (Dridex)", "value": "4dd6fe1bd8e2b77482b7d9e902f7b599e7dfc42a341fe2ed4e90dea612f3301bcda852e6e0e4b9d04f4a0a37555b22d7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004351, "uuid": "1298fea8-bc48-4e77-91f0-51c04442b9ea", "value": "AA24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004351, "uuid": "7d6c39a9-aa09-4462-9605-2e6b95aa27c5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004351, "uuid": "c9b5a224-e4bd-4014-8054-136a298554b7", "value": "3072:G9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:G9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004351, "uuid": "16f04db8-1dd6-4b8f-8113-f15a768da41c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004351, "uuid": "afbb90e3-4996-4e67-9c5d-6a8d8b6c6255", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004351, "uuid": "acfd0ba7-fefa-4324-9687-25a455c10d7f", "value": "42710f05fd3cd909d03054819635fa56a36db8cbe6eae568361ff941af982292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453e5a85-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001714, "uuid": "c0c74a59-1499-45d8-85dc-5441a12f1b63", "comment": "Malware payload (Dridex)", "value": "455342a835d48d548b8752c2255d12a0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001714, "uuid": "139bb569-ba2d-46cf-af89-50098b3555aa", "comment": "Malware payload (Dridex)", "value": "42b648e9ae800e78a3a2025a502a26b39b900f763959576b4737471a6f0778b4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001714, "uuid": "0701ad84-2d4e-4026-82bf-0da5b3025cb2", "comment": "Malware payload (Dridex)", "value": "3ec998c38db15e03af7f18045b28a54481c44448", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001714, "uuid": "a1f5dc4f-bf80-4a1c-9835-0fafc03c2e00", "comment": "Malware payload (Dridex)", "value": "15a076c21bb7dcad65614840f4438a98cb2e3f1795a4e8e097ce3359d98584364b9388e5488d5362aeeeaddfa07ba913", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001714, "uuid": "d4c91f0a-190f-4b1e-9390-ed8b3f438efb", "value": "2424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001714, "uuid": "b3ad6bb4-7868-49ec-bcda-7bf3f40c3619", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001714, "uuid": "7673f175-889b-43f4-be74-7954a4bd20b3", "value": "3072:A9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:A9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001714, "uuid": "34792c8e-0119-4634-8723-325d5ee49899", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001714, "uuid": "feed5b33-5338-40cf-a6fa-2e445b0c7c5e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001714, "uuid": "2c67d73c-3b49-47b7-9a74-8625456597f3", "value": "42b648e9ae800e78a3a2025a502a26b39b900f763959576b4737471a6f0778b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe1dd67-875d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012013, "uuid": "3cd1b0f1-9979-4c56-9865-58ee6b7c05a1", "comment": "Malware payload (Dridex)", "value": "2fdeb9451d516f709a5fc1ad21a8547f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012013, "uuid": "beabdb82-dde9-40f5-b179-2d1fc67cc655", "comment": "Malware payload (Dridex)", "value": "42fe9dd0bc193c95ab0b071767831c8024e40c9593a9b557e1445e50dbafea6b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012013, "uuid": "a11ecb56-3efa-4800-bd13-cb03e095d744", "comment": "Malware payload (Dridex)", "value": "de5e27351eb71fb7e1dd2172f82937e25da79706", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012013, "uuid": "a578c632-a098-4221-ac71-30de71f7b8a6", "comment": "Malware payload (Dridex)", "value": "588cd70dd8bbdb62ce08e2360d772855cac872a31c0616ec8ef4201c9a4ff5f2acef7adff51be55d3592210f12387b76", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012013, "uuid": "e1fa377f-10aa-4865-82ec-016208c49b91", "value": "5224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012013, "uuid": "12c67a3e-9c66-44d8-82bf-c57fb2414efe", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012013, "uuid": "fdf4e42c-85ae-4606-8a68-96357cb71e4c", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012013, "uuid": "986bd2a1-09cc-447b-9894-3c9383543751", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012013, "uuid": "10272499-5705-439b-9473-59f8d659ab78", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012013, "uuid": "2e3e7cf9-97b0-4a47-96d1-5fc5ed5e4e6a", "value": "42fe9dd0bc193c95ab0b071767831c8024e40c9593a9b557e1445e50dbafea6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea88cbdb-8755-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008864, "uuid": "5306ac33-256d-470c-b34a-c3d2cfb4a2c1", "comment": "Malware payload (Dridex)", "value": "37f52fd5afff24075ed88c0ed4bab71a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008864, "uuid": "bdf224fb-7e29-42b6-ba23-e22e6b7f2063", "comment": "Malware payload (Dridex)", "value": "433dd5c642009cfac45c85146b10c6f967bb34322c61275ed55f2a9aff2b9371", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008864, "uuid": "e7308f1c-21e3-4287-83a1-048ff0772369", "comment": "Malware payload (Dridex)", "value": "f37624f04699235b05909dc571f9378463e03949", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008864, "uuid": "b1dc48b9-fff6-491d-baf8-13a9a909ec62", "comment": "Malware payload (Dridex)", "value": "3d3f44a7c90ae5e09cac5096ba5616ed0f51566804873900afab25b83f2a3eee4c28a85326b6b759bdee6e115015fc62", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008864, "uuid": "c974e153-06d8-4cb6-9acb-77def436ce50", "value": "4124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008864, "uuid": "73e1bd9e-c1e9-48a5-889b-6bcf46a69a5c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008864, "uuid": "1b2055c2-259a-430f-b810-eaeaca21df01", "value": "3072:n9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:n9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008864, "uuid": "c00d0484-7e9d-49bd-8793-13f9586d1fe3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008864, "uuid": "05d8427c-6cf2-4151-8fd7-907b3f680e47", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008864, "uuid": "eca1bac4-7235-406b-acfc-b4ace4ba4cc8", "value": "433dd5c642009cfac45c85146b10c6f967bb34322c61275ed55f2a9aff2b9371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cc1646-8762-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014354, "uuid": "040ed581-592e-4faa-9f03-37f4cb5c7df7", "comment": "Malware payload (Dridex)", "value": "335e8b50e48f321234b48b9ed28cea8f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014354, "uuid": "e1a21c67-70e1-408b-9a4c-097885ddc25c", "comment": "Malware payload (Dridex)", "value": "433deb1570434943fa773e5c137cf06a7f11df09fb8d207edca8455461cd48c1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014354, "uuid": "84d2fd86-f1e4-4979-a1cb-89244d9956c3", "comment": "Malware payload (Dridex)", "value": "ecbb5b40d002d42c45e43610da61f88f94a796d6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014354, "uuid": "56ad9e29-e354-4d20-b3b6-51917d49ef01", "comment": "Malware payload (Dridex)", "value": "cc64476203a216598c0ea74441ab69a6b26c533a96149e2085959e3e99ba4c39d51449097671d02874590556445e0fe7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014354, "uuid": "38eaa220-4b98-41fa-ab66-212b404a75bc", "value": "A824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014354, "uuid": "784c5792-ea9c-4716-947d-0ad2fa9a1b6b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014354, "uuid": "5e93e8fd-6ba8-41d5-aae8-77493a7df632", "value": "3072:59Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:59Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014354, "uuid": "8a73284a-70fc-447c-8bb8-76879a6e8aef", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014354, "uuid": "3a38c527-084f-41e2-8551-31ff439dcffa", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014354, "uuid": "27407d93-4b07-4823-8556-90261c738b12", "value": "433deb1570434943fa773e5c137cf06a7f11df09fb8d207edca8455461cd48c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f916a9-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003841, "uuid": "f7e5f05e-63ca-463d-a198-419b90224317", "comment": "Malware payload (Dridex)", "value": "6676f8682f9eb3b0082a02d2c746f4e3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003841, "uuid": "2bdaeb2f-69d5-46a5-b3eb-457830695891", "comment": "Malware payload (Dridex)", "value": "4353f4a9e96aedec16326b6a3dfecd346b50f7f1c659de244e6f9e966536444d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003841, "uuid": "654e762a-225d-4aca-8bb6-74cc675a883a", "comment": "Malware payload (Dridex)", "value": "7112b7949266e6dd2c61fa0ca2236774d1fcb1c0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003841, "uuid": "36172c1e-8112-4d37-bc8e-aa590290cf88", "comment": "Malware payload (Dridex)", "value": "23da4a158e7397c0cab70a4f82102d303382c2aac80cb2a1bdd10570fcbe29ef500b99e64bdea08e9e219dfc676703da", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003841, "uuid": "e1a5f8fd-4ba3-4679-a537-e1e1688ca8f1", "value": "5F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003841, "uuid": "4bbf2a08-29f1-45f5-a188-52502df1f8fc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003841, "uuid": "1508aba5-6218-40b2-b907-ab5a9b79b96e", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003841, "uuid": "06a5de08-2771-4e36-9fc5-b0dd20d72073", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003841, "uuid": "c56c8a14-27c4-4166-a167-306af83bfe57", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003841, "uuid": "ea45a7ab-93f9-4e5b-a326-1fe98c959954", "value": "4353f4a9e96aedec16326b6a3dfecd346b50f7f1c659de244e6f9e966536444d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3427e4-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616002959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002959, "uuid": "4ce02984-1791-458a-9c5d-396ef27ceff4", "comment": "Malware payload (Dridex)", "value": "b47db0966021df9d8d0cb69173aa7589", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002959, "uuid": "254d3212-f962-44f6-86ca-cdcd7a9682f2", "comment": "Malware payload (Dridex)", "value": "439c2b7d42b4c7ac606949974e46ff5b21be1842ec86a190e4479906107755aa", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002959, "uuid": "538bde90-ca31-4e54-aad1-5987a0aa33d9", "comment": "Malware payload (Dridex)", "value": "5b78524624b03e1331fb52e7b4e8b040cf8778aa", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002959, "uuid": "8e9c8001-7eb4-4f24-9715-31c42dfd0db7", "comment": "Malware payload (Dridex)", "value": "b99069024bd87851f69bba22220eee3da3a326043d4bd9eec5d9078f5549a132b90d31e009d63eb7966c2996b76a0867", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002959, "uuid": "7ee7d398-8ae7-4651-992d-5a05435efefd", "value": "E324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002959, "uuid": "d9d7068c-d487-4223-b9cf-fc2e05d6334f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002959, "uuid": "c0aaa926-f2ad-4517-806b-ef6b82c29b3f", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002959, "uuid": "6bf4cc85-616e-4170-9da0-4cccbf96b80f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002959, "uuid": "2c0eec8d-5880-4ed3-a6cd-865a1e2da982", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002959, "uuid": "a3ece499-6e23-4026-b16c-e9e0a0a9025c", "value": "439c2b7d42b4c7ac606949974e46ff5b21be1842ec86a190e4479906107755aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4b4d55-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003521, "uuid": "473c6241-acfe-4531-ad43-206fc53bdf2c", "comment": "Malware payload (Dridex)", "value": "be40c9a14ef52519214423328d73f40a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003521, "uuid": "152c8481-961c-4ed5-a960-befbd5a81078", "comment": "Malware payload (Dridex)", "value": "43a2ed1511617e2906ef989e7b1d6bfd4ea0b02cd452ba651360c37b512c84a2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003521, "uuid": "618093b6-f56a-4f3b-893d-f1ea4642cc86", "comment": "Malware payload (Dridex)", "value": "257a1245c89f86a07d67ba76ec983a495c58206f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003521, "uuid": "2645561f-142b-4b60-b954-50aa05bdfe7e", "comment": "Malware payload (Dridex)", "value": "6a0414ce52addd5137ef201149304cd9faca460572f1bbaff89dfba9f1e0dbf04eed0622e3e5d5c60fcb8e9d595c19fb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003521, "uuid": "80726b63-0fbe-45c6-99f2-869483ec0ebb", "value": "3224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003521, "uuid": "1ed5f8e0-336b-4b2b-95f3-4480c537237f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003521, "uuid": "2d67dfda-16d4-4b08-a8f5-a1581745fcf6", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003521, "uuid": "3ba3d51c-176d-44c1-993e-28918a4dad97", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003521, "uuid": "a53e4243-a01f-4a05-9259-a8787a84b89d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003521, "uuid": "4a9a8079-62fd-4014-9a97-e3b9d7b1fbc8", "value": "43a2ed1511617e2906ef989e7b1d6bfd4ea0b02cd452ba651360c37b512c84a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ae39c8-86f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615967696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967696, "uuid": "376f0b81-d968-41d9-8848-40acdd10c1ac", "comment": "Malware payload", "value": "39a3b75b6f9bcf60ae6a0e5352d400e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967696, "uuid": "914354cd-d6ff-4535-a803-0b85b9f88b3a", "comment": "Malware payload", "value": "43a48cc37c36279d5696e5be1a6bcebdcccb2e5eafb5442915329817b41da013", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967696, "uuid": "5c99e841-1c70-4e0a-a813-bcd5b7427961", "comment": "Malware payload", "value": "93ff63a8572a73ae882ba65bbc83b9e15a1f6529", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967696, "uuid": "2f64b128-c8eb-4890-a7b0-8c7c0de99111", "comment": "Malware payload", "value": "b559edc6bf8cb858c5668494214f25ba9d83d531e961185caac7252d3575e7ebf614a20ee8fd51ed97931db27bb4650d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967696, "uuid": "dc3ddd16-67c1-4a55-834b-fbe7a5becdfa", "value": "2E54021CBDC58F03C6E715F11437C11681ACCC562724D8AB9BA9F20A36B87747AE32AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967696, "uuid": "767ee9fa-bac7-44fc-bd33-81866be61ca3", "value": "6144:nKy+qDbyCoewfhIU9053vocF0zYHkGwQjyWc4Nvuzu:K/ibNN0h3053vds9lzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615967696, "uuid": "9a322809-636f-426f-98a8-5215b57d3a28", "value": 286720, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615967696, "uuid": "a1398bd9-6d09-455e-b6ab-d244cfc0eaf2", "value": "application/CDFV2", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967696, "uuid": "6d04b2ed-9a23-443a-adc4-12c671faa632", "value": "SecuriteInfo.com.Trojan-Downloader.Office.Crypt.15590.14465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f5385f-8753-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007888, "uuid": "9708b1ba-5142-4e42-882d-e999f4e9fee0", "comment": "Malware payload (Dridex)", "value": "c83346dfb497587073df43175833002b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007888, "uuid": "305cb89e-715e-48bd-83de-6faf34023644", "comment": "Malware payload (Dridex)", "value": "43a899eb3eddd367428c3aee87606c182c320ee147ec8828ca5e3a6fbfd7f53c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007888, "uuid": "2aafab44-09ee-4ab9-be4f-a5ba2b520414", "comment": "Malware payload (Dridex)", "value": "3ce9d35172dae516ef04e6082b04a028e4917a1c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007888, "uuid": "d8eab65b-bcab-4b02-9be7-283f18d066e3", "comment": "Malware payload (Dridex)", "value": "334bb12c93f04107810b9cd9d868638dca86b8dff2d4a91f10e99ac1a3afd10252c01ec185f8050dba57a81e2e6cdb5c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007888, "uuid": "faa407e8-4fdb-4a9c-8d2c-d32287083cfd", "value": "4A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007888, "uuid": "bd85099c-85ef-43b5-80a3-ae4a42be8664", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007888, "uuid": "283185d3-87ff-453e-a7cf-137d5ab093e7", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007888, "uuid": "ec8f125a-8502-4e6d-a0c3-ac7aa644887f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007888, "uuid": "0d7c0e3c-1076-4b80-91ae-2eca53cadaef", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007888, "uuid": "9c88e5f0-a622-439f-b3fc-9c29c586f44e", "value": "43a899eb3eddd367428c3aee87606c182c320ee147ec8828ca5e3a6fbfd7f53c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c374f7-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001846, "uuid": "72f9663d-cd09-44a6-9698-01111a3b9134", "comment": "Malware payload (Dridex)", "value": "3a46cd3106135befb705d028c45c4020", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001846, "uuid": "8b1fa0f5-db39-4195-9f78-755c82a20eb1", "comment": "Malware payload (Dridex)", "value": "43f2a4693556d3ec2d42a3e4097b679404fc96e1bf60d893f5056328b6d21925", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001846, "uuid": "b7fc6aab-de26-486e-88a7-3c7e45656ba8", "comment": "Malware payload (Dridex)", "value": "5297664a4623127105a7c9952a3aee8028dca71b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001846, "uuid": "0ff97ff5-a6ed-47ce-a74d-2af25f41bc00", "comment": "Malware payload (Dridex)", "value": "33e4db5b40bd6fe6abcb397a7dbe3c97dd26be01e5d392c09344636f0130ad5dcae12672f0e0948091cfe7818471361e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001846, "uuid": "2e9bcfa2-7431-45ee-82e9-176b2b714b36", "value": "CC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001846, "uuid": "e0ed7c7d-05ad-4f6e-b3ec-4ac3813c7986", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001846, "uuid": "d877c839-3631-4d5b-b01f-dc41830bc177", "value": "3072:l9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:l9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001846, "uuid": "50256f42-5294-47ba-a392-dac214a3b850", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001846, "uuid": "b371f229-08e8-41f6-8ede-6e551043bfb3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001846, "uuid": "55555dd7-8c02-4665-9bb9-b710d321eb5a", "value": "43f2a4693556d3ec2d42a3e4097b679404fc96e1bf60d893f5056328b6d21925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d576dd-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004403, "uuid": "68e01ec1-d686-476b-b7d8-f225517d7178", "comment": "Malware payload (Dridex)", "value": "29d3f0544beeba3f0b3542c2014b395c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004403, "uuid": "d9a64a31-a3a6-40dc-9da4-17ede8aa7dd9", "comment": "Malware payload (Dridex)", "value": "4429d0479c4beecfd62f472398f0b3a4182d271ce58288d1b5948beaafb8a0d6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004403, "uuid": "020ef5a9-9b37-4a59-8aa4-5b181dce05a7", "comment": "Malware payload (Dridex)", "value": "44abdcb44f3c8551dabfde55ebd7801fbd5f5ed8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004403, "uuid": "1ccd2544-ab7d-4453-adcd-329f10e0e1ed", "comment": "Malware payload (Dridex)", "value": "4c5410121519777092083cdbe0e1221b6d780886b293b875fb26fc212c925b0ac2267a85fb6f125d08c47fc51697eb7a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004403, "uuid": "6b4ea919-2a4d-4cb4-81fd-a53751d18291", "value": "9C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004403, "uuid": "caca9a83-33ef-4943-b3b2-5455b3db5cc2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004403, "uuid": "c0768716-3622-4ef3-918a-6381e60b5584", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004403, "uuid": "df4fc016-95af-4d4b-bfad-4398048160df", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004403, "uuid": "7fdb4394-e7ff-4967-ac99-e4416bba2786", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004403, "uuid": "978b7911-da7f-48d2-b07b-ee15f1eb26e5", "value": "4429d0479c4beecfd62f472398f0b3a4182d271ce58288d1b5948beaafb8a0d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0042c1a-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615984821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984821, "uuid": "004008e1-cc71-4756-866f-40de3b0ae554", "comment": "Malware payload (AgentTesla)", "value": "c8b3bf425b7d49de798302ab7ddac127", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984821, "uuid": "0d160ffd-7cf4-46d8-9d50-3612a798011e", "comment": "Malware payload (AgentTesla)", "value": "44d6759b0278597158810a792e5739ccbf139baccdd5e83375e91ae0bd5474c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984821, "uuid": "9350d469-e6a8-48a0-8831-a9eaff76c724", "comment": "Malware payload (AgentTesla)", "value": "813b3cca67fce5bae939139e7fbeddb2bff57bd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984821, "uuid": "9faed14f-ae4f-41d7-a01c-f80a07a5cff0", "comment": "Malware payload (AgentTesla)", "value": "e3794aa4c1a8500343089466308ad43c8cf009308323d412808cdd8eb88f00f6ecfecdcaad018b7b7cfe3ba358f9f22d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984821, "uuid": "c3c2b2ab-5f55-451f-b319-c5d31421457c", "value": "9A053346D643196903137A2EFA3BB3F4D446D25DCEA966CFED975F042F20124AC683B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984821, "uuid": "435448ae-fb59-4506-8f05-593b67d79848", "value": "12288:wO1vhUibRWRI6ufZxt4YbECsLC79H1LQED+8EQb0Xm+fnRj2fmo/X8GtvU9aUgdf:z+ibefubtrbsG5tjAXDAumB17A/4IM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984821, "uuid": "96a546ec-1376-40cf-baaf-fd3a2249a562", "value": 836301, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984821, "uuid": "76f76b89-ef9c-4b49-a980-d88d12007196", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984821, "uuid": "f3e9807d-5030-4b6a-aaf9-f5b08286c5de", "value": "SWIFT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070d9f09-8753-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007623, "uuid": "c240204c-0e65-4a95-96f5-9acc5bc2192a", "comment": "Malware payload (Dridex)", "value": "8cd54320274bfa43cc408cce536f96ef", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007623, "uuid": "52fedc4a-cf3c-4413-bd24-49087a22c02f", "comment": "Malware payload (Dridex)", "value": "44ecd67ec9c6c132fd21743def60a99a52ff1ac2dc37f6426bd0d22c4c019c3b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007623, "uuid": "fdd92ea2-214a-466e-ae2e-da7211355a81", "comment": "Malware payload (Dridex)", "value": "7e041a0d5f5458f400e63dbc0102e12d4d234c00", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007623, "uuid": "c54e39e1-e7f9-4e9f-a718-ff7c02c816dc", "comment": "Malware payload (Dridex)", "value": "08f41f8683a7dde6a789409d77c0a0de5be9c4911e1fd252fa3d50619a8e1e32bda8f7ee18afc995bebf99466c417de1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007623, "uuid": "e1a54650-96fd-45a0-96f1-91da6348028c", "value": "3E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007623, "uuid": "c7b51003-bb30-490a-a8c1-9ae56251366b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007623, "uuid": "88605ece-875d-4d38-8d57-e1bb01b9d127", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007623, "uuid": "6e01a1b3-9716-4a68-99de-8013e6bbc969", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007623, "uuid": "c49d72a6-0587-4156-8b18-474fd19b2ce3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007623, "uuid": "447fb982-1316-4218-a8eb-38e84d183081", "value": "44ecd67ec9c6c132fd21743def60a99a52ff1ac2dc37f6426bd0d22c4c019c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18a162e-875e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616012714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012714, "uuid": "f52d8238-9e75-4b01-bff1-fa946544e4ea", "comment": "Malware payload (RemcosRAT)", "value": "5999454ed412523cea221b7ce1f852e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012714, "uuid": "250d9466-a8cf-44a9-8967-c001ed04cf80", "comment": "Malware payload (RemcosRAT)", "value": "45338e5b0b37035d61f106b25b78e39bae14c5b13f58d4225d39b564406cbc26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012714, "uuid": "37d441d5-5375-445f-8e56-dbc0fcc9f663", "comment": "Malware payload (RemcosRAT)", "value": "daaaf611ead06fdae7f6b72c8bbae016e0a4751b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012714, "uuid": "b3fa8d8c-366b-45e8-b06e-8ff44a471c2e", "comment": "Malware payload (RemcosRAT)", "value": "6f6c86dc559038823b50fb7b28e707d46ec59036184a105a80f254bb8b6be512223cf20242f5f6e05f2124d6542105db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012714, "uuid": "3c3afbac-22a5-4220-a509-52618fc46806", "value": "EBE4AD3872F0A752D874423267E2D038AAE11FACDED1D707D2B11A96B341DE93E8954F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012714, "uuid": "014229bb-5d7f-442d-99ac-9354f2c14b66", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012714, "uuid": "35e721a5-aa97-493a-9ef8-fc266ee47768", "value": "12288:oQnfzXJd3LXjwvh+L9ROes5YSj07oNY9d:7Lr3PwvQxMRQ7oW9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012714, "uuid": "548ec81d-754f-4c75-a7b0-2e8c4f5418db", "value": 704673, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012714, "uuid": "ab181aab-8e26-422f-aa53-46e002e8cfba", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012714, "uuid": "26722c3b-2cab-4ace-a5cb-ec76e2e5f700", "value": "0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d75ec95-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011150, "uuid": "175e1d05-1782-4cb9-a740-45e8ba7b3f9d", "comment": "Malware payload (Dridex)", "value": "8cba9e50b6c20bb8c656638061b08df8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011150, "uuid": "a75b2db6-42d3-46ef-aa1c-b27b2de4fbb9", "comment": "Malware payload (Dridex)", "value": "453449208a8caec8b9bc2a3b53b3185695d59f8d788c2e9505b7398fc9949e69", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011150, "uuid": "4791adcb-2840-4c6d-a441-c091fb1c63e1", "comment": "Malware payload (Dridex)", "value": "35859a87d18969a3ae190beb33886e51ced17d30", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011150, "uuid": "e8cbc7f8-f02f-4e14-9621-a0015f4bbb3c", "comment": "Malware payload (Dridex)", "value": "cb11b302ce817897163675f0e90d9a526f89cf3a2b467f444afe186b5f4e60c6ce10bb79b516e0b446a4af62d192723d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011150, "uuid": "c9509eeb-0f42-49ee-bf0b-e52d2252ed70", "value": "E924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011150, "uuid": "e82fa15a-9b4c-4a9d-bc06-85e439f812e9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011150, "uuid": "6a0752ca-1a8a-4cb1-9127-91d0f9402fa8", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011150, "uuid": "540a3e16-e203-4214-a5f9-188a97ed55d3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011150, "uuid": "51b62391-8380-477d-b6d9-a530dfda5c80", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011150, "uuid": "14760099-5586-49fa-836f-ed3b4db5c34d", "value": "453449208a8caec8b9bc2a3b53b3185695d59f8d788c2e9505b7398fc9949e69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1f2df8-8765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616015636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015636, "uuid": "ae1963c2-94af-44fb-9571-97633492f2d1", "comment": "Malware payload (Dridex)", "value": "ad59f61208c93b58ab98d8483938f82f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015636, "uuid": "0b48c67b-9b79-4851-979f-2171390b4913", "comment": "Malware payload (Dridex)", "value": "45686f40e18662c000980de46ac06ea376b2d099a95aa0dd2a62127be687adab", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015636, "uuid": "af8a086c-aacf-438e-8906-9440318e9c67", "comment": "Malware payload (Dridex)", "value": "0e9c6990765238bbd9dd8647d58fda36c3294ff6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015636, "uuid": "99a5b2d3-b494-4ff1-bb8e-ecd4b4b7dab9", "comment": "Malware payload (Dridex)", "value": "0e73cbeb1e436160ca10db399f7636afc4c267750215219c84fdc02fe55c479d1cee7adff3d30f2c70a5685f209c4d65", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015636, "uuid": "ab851403-3330-4f68-9434-5eb9ad5baf26", "value": "8124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015636, "uuid": "1feb6936-b615-468c-9d0f-83f661b07cb9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015636, "uuid": "d39b9997-1981-4cdf-8a95-9156e4ad567c", "value": "3072:p9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:p9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015636, "uuid": "aa0ea9fd-930b-4d5e-ae31-46434128a821", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015636, "uuid": "6a9773c6-b695-495c-961e-74908debb8d8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015636, "uuid": "53bdc215-8898-4cee-b98b-a11e3e93568c", "value": "45686f40e18662c000980de46ac06ea376b2d099a95aa0dd2a62127be687adab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65230357-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004345, "uuid": "2f34fbc7-ae77-4e42-a485-3acb12d12835", "comment": "Malware payload (Dridex)", "value": "5a2a6e5acecc19ea21a18d3d0fb61706", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004345, "uuid": "1fa5f6ad-695b-4fe7-b8b1-8528b31d0e2b", "comment": "Malware payload (Dridex)", "value": "459e8a66c34f32bb510e379ed31c800b0d040869e68470f267e71763c762d875", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004345, "uuid": "c1bd2445-bb1c-479b-91ab-789af4ff9d76", "comment": "Malware payload (Dridex)", "value": "a582c8ad808e28e3cf6e85d6ab5b5361a9407f9f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004345, "uuid": "4fc7d28a-93e6-489b-9383-c1241dcfc0c5", "comment": "Malware payload (Dridex)", "value": "a1dd35373f8fe70aa29a23b7e68fb6437cb9bf46be4cd04527331a5df3a5abe6f661987437902b00a51c8a7d464932f8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004345, "uuid": "3c54da59-6e9e-4e41-a0fc-3f25dfc980f9", "value": "CC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004345, "uuid": "21503361-413e-4aa5-b5ba-8ac0b6587e33", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004345, "uuid": "ba4b9276-3a56-4393-88ae-4a0f3465debd", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004345, "uuid": "e83ee7ac-956c-4983-903e-1d5a8d8567c4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004345, "uuid": "e9210179-e4cd-4d0e-977b-9f7a2fcb9018", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004345, "uuid": "65ab924b-cf7a-4de7-b9e5-8de37597fc45", "value": "459e8a66c34f32bb510e379ed31c800b0d040869e68470f267e71763c762d875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7ab6b9-8764-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616015231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015231, "uuid": "05da72ac-8dff-4b18-9b47-9d30bf773a8d", "comment": "Malware payload (Dridex)", "value": "ee527edd5e9c0e9906d454214c9aff6f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015231, "uuid": "bfe395e7-5fa9-46ce-869a-b9c978de0eeb", "comment": "Malware payload (Dridex)", "value": "4612a234290b80e8db8e27b8178adff91f586c841ae189b7653a12b62acba707", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015231, "uuid": "347bf262-08e6-4247-b4e2-4bb5cbc7e5b8", "comment": "Malware payload (Dridex)", "value": "d009e039f705e219e38dddba7f2d9cefc1c93038", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015231, "uuid": "4f91fdbd-d652-4f62-a440-39cd4ad3c77f", "comment": "Malware payload (Dridex)", "value": "5b6b94dd29605d48d115a0c2f22a2a0a63d25b105c94a515945ae77599da6d8232d9cb15a55f4cdaff59bb04603ed6e0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015231, "uuid": "d682aa4f-8be4-4e80-a3d0-f5490c6ab040", "value": "3124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015231, "uuid": "349467be-0356-4b30-a950-03eb96704081", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015231, "uuid": "58331515-cd53-4cc2-85f1-a0c3f06a976b", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015231, "uuid": "72fdc5e2-3e56-42da-a055-915ff6a94f2c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015231, "uuid": "d4ba546a-f741-42e3-9b78-89c52ec3da03", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015231, "uuid": "72c25538-8866-4176-a722-f02b8e82e4b7", "value": "4612a234290b80e8db8e27b8178adff91f586c841ae189b7653a12b62acba707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80986b56-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009115, "uuid": "8d20f6e1-d49c-4e73-8acd-3893bb284612", "comment": "Malware payload (Dridex)", "value": "71039e56d426452140d4a3e85952e913", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009115, "uuid": "0d280538-0865-4c68-a838-56776581d1fc", "comment": "Malware payload (Dridex)", "value": "46ab7a101e687bf330d0d37842d0caf3f67b4ca750fe58357ede544dd04d2a55", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009115, "uuid": "d3a60297-71b6-496e-9d71-d9b8accdb42f", "comment": "Malware payload (Dridex)", "value": "a30e5ce7a8ebd52c6d696f38a6bcd139da5c408c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009115, "uuid": "2eab5d60-4c9e-48e6-b8e0-23b7da17bb2c", "comment": "Malware payload (Dridex)", "value": "b7a5e7a453f3c0b4796f4b6c6051e951c2dc8bbc9f718e88bd51732041a41dd383ea97b49a514fa600ad13b3839155ef", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009115, "uuid": "7ab48c57-1901-4a39-83e1-1f046328550a", "value": "CC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009115, "uuid": "fc19acc5-ad09-4719-a67d-796bde8f999c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009115, "uuid": "954438c6-e596-463a-af44-2ea492d7aef2", "value": "3072:z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009115, "uuid": "b9efeeec-d579-49a4-8695-65276f072db3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009115, "uuid": "9adf88d9-ada2-4575-8d77-6297fad6b095", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009115, "uuid": "240d5b67-a215-482e-9d16-8993b31c2e9f", "value": "46ab7a101e687bf330d0d37842d0caf3f67b4ca750fe58357ede544dd04d2a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca101dd-86f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615967931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967931, "uuid": "3603638d-a470-4065-bd13-cc9f5f3c14bd", "comment": "Malware payload (Loki)", "value": "ef469a0af9b4269efbdfb74cc9f94ecf", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967931, "uuid": "15a2c286-049b-4dbe-be3f-532c93c086d2", "comment": "Malware payload (Loki)", "value": "46b006db8260be2e32171038ee3fe8cc52552d460efef4ab8cf2c549a778dc86", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967931, "uuid": "06a2cdd9-1a27-434d-bc98-37873f6987ad", "comment": "Malware payload (Loki)", "value": "41b2928f97610848f98c8f3dd3623c9cea37afa3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967931, "uuid": "37c38b51-da95-4c5a-9721-33a4d384a458", "comment": "Malware payload (Loki)", "value": "03ec7148214a51819a2df6a891720325991e1f8ea5673d073400719941fe643168e6a0008094cd6ddd465f5312c8b3d4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967931, "uuid": "7d9cdda7-bd5b-4e8d-9d86-db86de49b56a", "value": "12C4DF9D77540323C56503BD28DAB5C1E73A606A1D22FBF0689950992623BB4C2B37FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967931, "uuid": "7e03d814-7d56-49df-ad7e-e2a6050d193d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967931, "uuid": "1f799370-ac6a-4bb1-ac96-0689c11c9aab", "value": "12288:0uBM42PLilf5KKSAj34VAza0yqlXt6D7AUij5Qv:LSw2Xua0yhDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615967931, "uuid": "52722335-cfc8-4e3c-8c76-180de97ff78b", "value": 566784, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615967931, "uuid": "69664000-9c31-4f3f-bf99-e77554df8401", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967931, "uuid": "dcf124d3-6b94-4aaf-ad5b-a29d93cc094e", "value": "djdMl2KTAGv7rKv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbf1ad4-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Poullight)", "timestamp": 1615969271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969271, "uuid": "bb24b472-20df-4a3b-8ae5-889df7db377e", "comment": "Malware payload (Poullight)", "value": "6611eb9a48a19fab4eab22de21f42d19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969271, "uuid": "d005d268-8900-487d-ac84-a8ec12dc2261", "comment": "Malware payload (Poullight)", "value": "4745b5f9bfe8d186e060f51f555a6544e35a3c99314143ac87c6ff475f1f6b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969271, "uuid": "f6630489-e6d4-43f3-8137-cd65f7c94a7a", "comment": "Malware payload (Poullight)", "value": "dfbc71dc463569956c95a5a139ed632a13a94c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969271, "uuid": "8e2029ea-31d2-4bd3-87e2-b17da867ca30", "comment": "Malware payload (Poullight)", "value": "25e6091839e2bbf4fc138327e6734f1603f7b1e0d43a7689f36e9490ae5d38d7809465326db1794a94fa959d2d390a0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969271, "uuid": "20d8292a-e294-4ec8-98f6-268742e26a42", "value": "854542277EDB100DBB6FA50C3DB691394AA97205E2DB993B9CB74AD3A32710467CCD04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969271, "uuid": "c0deb836-a6c1-4ac2-894e-e7c8f9765e8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969271, "uuid": "4a4a5e61-fd14-4d76-be64-0aa7caad6b87", "value": "1536:ChuViC0dCTJaaMxr3KtfBSJV4RCZS34UfNS34Uf:ChKi70a93ySH4RCks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969271, "uuid": "99d8ce55-be35-4184-8045-a6a6e4b2c11c", "value": 1199408, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969271, "uuid": "eeb10ae0-c666-4414-8ba2-e1930463022d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969271, "uuid": "1b177b1a-96f0-4d8c-8c37-560ecadc084f", "value": "6611eb9a48a19fab4eab22de21f42d19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8d577f-8762-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014341, "uuid": "558d843f-508a-4920-b9c5-b9bf31fdfd27", "comment": "Malware payload (Dridex)", "value": "a39e5bb493a01e517868b3133f1d93ab", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014341, "uuid": "e9ac6dda-69f0-4d84-ad7c-cf541130b3f4", "comment": "Malware payload (Dridex)", "value": "477a434d05ba67f9d06cfa26f9f9e1a096600734bdc8f2b873a80a6e49de546d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014341, "uuid": "39013ff6-8d21-4d1e-89df-d66cf653527a", "comment": "Malware payload (Dridex)", "value": "95d18246807a42a038a3189c3a962f43f18f21db", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014341, "uuid": "3ce1b616-d107-495c-816d-65833e95401f", "comment": "Malware payload (Dridex)", "value": "7caf8a044387ba8b131c12458dd1bb66f52a1feb2d6a91f90cce41443a59b8a7b3b3c4f5fd3699db99b88a0f58464712", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014341, "uuid": "7b60f43b-0798-422d-bc87-a62e8bf2b263", "value": "3424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014341, "uuid": "eda43b69-80de-406f-8988-a9400503f134", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014341, "uuid": "88d3932f-5b54-4fc7-9637-468d4aa735a0", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014341, "uuid": "e02cd695-dccc-469f-9dfe-2358493670fb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014341, "uuid": "8e797104-3dab-4860-a0a8-18d54ce90aaf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014341, "uuid": "08e37b1b-c1c9-466d-997f-bc176bf3717b", "value": "477a434d05ba67f9d06cfa26f9f9e1a096600734bdc8f2b873a80a6e49de546d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455a725e-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1615968643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968643, "uuid": "d82ed2b9-be90-4e37-a865-5f89c29cdcb6", "comment": "Malware payload (BitRAT)", "value": "37b2f2b402c9fd67af523ce7a4ed160b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968643, "uuid": "b9b23ccc-0de7-4523-9b62-a93fee7eed71", "comment": "Malware payload (BitRAT)", "value": "4832d7872fbda09f9b51735611d372ff1a6004dc8d821d2f2e26fdbdfc300021", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968643, "uuid": "3e014a2b-7fef-43ed-a5db-88d1b795d9bd", "comment": "Malware payload (BitRAT)", "value": "c1293c70b3689ea72467eaa489d6abdd69c74722", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968643, "uuid": "8ee06844-cde1-4614-a176-92d895476574", "comment": "Malware payload (BitRAT)", "value": "cc559c0314ab8434f5bdd003120ca160e8012815ff23eaa67a686abe6f367ce72847d54e5b50521e41cd4ba0c8ca5691", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968643, "uuid": "01a17c35-2ba7-4fe5-bc7c-17ab3516c90f", "value": "6BC53387E7F5E073F8E16B3158B593832A7679D08B20811B257F889126B2E71B2453F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968643, "uuid": "7ad88a76-14e9-438c-8813-dab7b4ae32f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968643, "uuid": "68948ff4-3e58-4c15-b11e-5b9785806e2f", "value": "49152:Kcq8z+DB/HE21C8YwN2vVV94l8bugqEVSCwwt+t069GRwZv22h:E8QhHE2oqWal8SSVSSna22h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968643, "uuid": "ddb6b498-9d51-4eff-bac3-e733abf335ad", "value": 2713872, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968643, "uuid": "ffc7a2a2-91d7-4398-a0c9-79c570b9f453", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968643, "uuid": "a2c6d42d-5e23-4c69-b16d-c5aabb63becc", "value": "37b2f2b402c9fd67af523ce7a4ed160b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37dfe78-875d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012207, "uuid": "cbf31049-aa2a-456c-be1e-7719cf5f3188", "comment": "Malware payload (Dridex)", "value": "d2599ef567c8d01a58c7de6653ce4d5e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012207, "uuid": "297e0104-b7bd-4757-a944-c9dc93b71b6d", "comment": "Malware payload (Dridex)", "value": "48653627198eb10b763071be68d98225b465f9e5abb17152213ae7997fd6d2a6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012207, "uuid": "31652ed7-cb45-4fa1-bb6b-72df44d7fd7d", "comment": "Malware payload (Dridex)", "value": "774437d52bed525b7437ae2c6cbe05013d2cf934", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012207, "uuid": "9c688f94-1561-4042-942c-06899e061998", "comment": "Malware payload (Dridex)", "value": "1b878bcbde084b1d65ce5611bf514e5f014c146ecfcd7b92a6d0b3743d1e1303a0438be4fa01dbd410a83a6a6775da1c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012207, "uuid": "d6fe6bca-eca5-4f2d-8f1b-ee275597aff2", "value": "C714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012207, "uuid": "7d467d30-7a3e-4fe2-a9f5-98bb3218ebe6", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012207, "uuid": "b4d8649b-6fd6-4805-b01f-daad28f932e0", "value": "3072:w1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012207, "uuid": "8b99b246-43ea-4aec-be12-440f8a134c29", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012207, "uuid": "81b7a076-bbbf-4908-bf92-89d0e0609255", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012207, "uuid": "152c8f88-ec77-44b3-8e2f-5b9f90f43a23", "value": "48653627198eb10b763071be68d98225b465f9e5abb17152213ae7997fd6d2a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8e95be-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616013110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013110, "uuid": "10b55acb-224d-46ff-b990-bace872453e4", "comment": "Malware payload", "value": "896f117a21d1068277a1ca3811425156", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013110, "uuid": "29c593d1-099a-40e9-a4c4-6c10b6883293", "comment": "Malware payload", "value": "49d9f704d047018e4c47294f3b775b15910e43679901cd59be89b2aa392041bc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013110, "uuid": "516b3c3e-5d92-42db-8174-08bf1c7cec29", "comment": "Malware payload", "value": "94a4587876326492f8fa60f7f360f3d10157c68b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013110, "uuid": "c73ce0ee-e0e5-40a0-9c26-f58aabf83b63", "comment": "Malware payload", "value": "9faea1432b51c843d17f727adc43569d2a745cc77f8884e85fbcc219d004bdd4149ac8b02e2d77faa6d63b81c2395936", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013110, "uuid": "cebab820-9792-4e5e-b921-245601e59016", "value": "9C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013110, "uuid": "fe5d52e5-b18a-4ef4-912c-f45823055b75", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013110, "uuid": "aa27979a-02cb-4f93-b442-03f591e26a00", "value": "3072:S9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:S9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013110, "uuid": "4ed4c68d-bbfe-45f9-974a-a2d80c7d9929", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013110, "uuid": "63429590-db5f-456b-b66b-88aa8bb722e1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013110, "uuid": "920c077a-cc60-45a3-8274-f85b5f3c827e", "value": "49d9f704d047018e4c47294f3b775b15910e43679901cd59be89b2aa392041bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9ee242-8747-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1616002510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002510, "uuid": "762bdc0e-bbfe-4160-87a1-9256fedaa4c7", "comment": "Malware payload (Vjw0rm)", "value": "6a639120f974b6e86091f53ca5e1fed4", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002510, "uuid": "4f810911-6c1c-484d-83ff-b37961129271", "comment": "Malware payload (Vjw0rm)", "value": "4a132f97d3167962727ad1c6810f0f53a664f9bb957833f7ce29b9a194479180", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002510, "uuid": "0114f410-2724-4d2d-aebf-30bfebe1be67", "comment": "Malware payload (Vjw0rm)", "value": "001d244a5271b62fecdf9e6d56c2dfa7d582b2dd", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002510, "uuid": "1e2c7314-6340-4513-aa46-4e29c41321b5", "comment": "Malware payload (Vjw0rm)", "value": "f5a2194040781c534108738226ca179dfee2bb0d261530f3df72e0910769bb3beb41a9a7650898ff69f88397a3fdab66", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002510, "uuid": "bec774c0-63ff-42e8-9a27-fe347be5b038", "value": "6B5334982D46962CC3913B7A806DF208CDF774B06AF492A5308DDAC53B0BD7586B17BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002510, "uuid": "00724bbf-973d-41da-a725-e59cdf8cebc6", "value": "96:5kl3lbNTlDrABNo5DRk2c24ZRMHXE6/BI/+Ys+fJUDdQqR7bJyKUJOS4U:Y3lbxlgSa2c24ZRMlBImYs+fJqfRfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002510, "uuid": "238ecdd4-495f-4b4d-94e8-206ccf60c953", "value": 65536, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002510, "uuid": "62fd0926-56be-4b8a-aeab-5eb851ae19cf", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002510, "uuid": "c049870b-2601-489d-b5ab-7b6219392a25", "value": ",_Payment_Receipt.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf60ecfb-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004523, "uuid": "c35efd57-1d0a-41f7-85c4-c7ed8533e196", "comment": "Malware payload (Dridex)", "value": "a658cb8dde7af4185794979e12ccec73", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004523, "uuid": "e942fba4-a355-4b4d-8548-4291f0a90908", "comment": "Malware payload (Dridex)", "value": "4a7f385a6077d0b9ad74052d4df5f5f0d1dc29ba7b9b3cf8a1be54898b4ab7b5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004523, "uuid": "6ed98952-055c-45bb-ab7b-6f0f02ab99e2", "comment": "Malware payload (Dridex)", "value": "d6b4b801da75e3cc537cbc4f34a5340b2d8ea8c3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004523, "uuid": "6eb2a1c6-ccb1-4692-938c-c43a9f95dbb1", "comment": "Malware payload (Dridex)", "value": "e8ad3c63920f9e01af99bac7d5001ba3a4d08b6a1f5044fe3913f1951b53586d2b99e42992efece67d9aeaafcfe76142", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004523, "uuid": "314cb7de-c80e-4e77-86d3-1fdf7ec5d089", "value": "9F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004523, "uuid": "bc44798e-fce8-4fc0-9882-ceee76ee8fc1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004523, "uuid": "e0f8525d-9056-4a7c-bc83-927352ffe5b7", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004523, "uuid": "f25cc249-2749-4b48-b2db-7fdc9ec62156", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004523, "uuid": "7ba3d9ae-8793-4131-a42b-693ced0863ca", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004523, "uuid": "e5c8d88a-f259-404b-8541-04d5b83569d2", "value": "4a7f385a6077d0b9ad74052d4df5f5f0d1dc29ba7b9b3cf8a1be54898b4ab7b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b304a97-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "38394948-2479-4794-8853-9f761978c3e9", "comment": "Malware payload (Dridex)", "value": "af000f3159fab6a4b4417acefb7740b5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "8d6c9fc4-a084-4c51-800a-dd9ead8ddbbc", "comment": "Malware payload (Dridex)", "value": "4a88b44e70b825a989c279474411a00540ad4794b610b0a82597fbd570ab141d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "a8c4b679-8ed3-4f2f-bbbb-bdcfecdb50f4", "comment": "Malware payload (Dridex)", "value": "c200f052d3d1eedf75698c3dd4764ed9e65bee7d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "8e4ffd2f-7871-422c-bb05-4c443b8dce91", "comment": "Malware payload (Dridex)", "value": "184471cfdd45c47c006b4c0bc536da34fbd47ce53d3b06b593a2b387f2544285453d73d49ee3354639498aed0e44cf1e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "9dd6cff6-4298-4b22-87ef-a683235a4e90", "value": "2B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "bd53a3b4-7f9c-4239-91d3-6a4249c4c215", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "7f5c9281-06f7-4c7e-9711-a9f5acf65721", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003845, "uuid": "36c50e1a-e5a4-4960-9f83-71eb29489b5b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003845, "uuid": "e9bbedc2-0ca6-40ed-9698-26ffa358562b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "375cf778-92be-4d47-90e5-0e0a39ec985a", "value": "4a88b44e70b825a989c279474411a00540ad4794b610b0a82597fbd570ab141d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e7b341-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "091b6073-3b57-4519-be87-04696435b265", "comment": "Malware payload (Dridex)", "value": "9e9003e16b1b53019a06c9a457c86cc7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "c4b3b84a-6ef1-41d3-ab1a-723057903f2c", "comment": "Malware payload (Dridex)", "value": "4acc3c1b7c562d7cab41813491a232307b1b19fa137c95d6a6e85913900c326d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "ab1407e5-c037-409d-8f8c-ef35863b1a89", "comment": "Malware payload (Dridex)", "value": "f01159107fb8e8c2afe7e38572065920c0bb3422", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "4489d04d-813d-4e62-bb87-afdd10c11e5a", "comment": "Malware payload (Dridex)", "value": "4584d3c669cb0bf4aa33a25583dfc4614bf1f6dfd7767cde2afee2c8f4803ef715fda1174a0db58d8f84881d9bdc469e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "f64eb747-6977-4da0-8113-b7d4edb8a8ff", "value": "7D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "29399c08-7657-4498-9a98-dec48b6cd10d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "5b94a171-acc8-4555-877c-53345daed490", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004084, "uuid": "822e3f7b-eb6a-4270-9a72-044ff58ef501", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004084, "uuid": "c2529eb8-afae-4157-9892-a755db87df4e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "d0358026-e892-4f89-9e2b-e8cf10ef4ff7", "value": "4acc3c1b7c562d7cab41813491a232307b1b19fa137c95d6a6e85913900c326d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503758a0-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017195, "uuid": "c209b24b-83f2-4b8a-a1ca-be1917485e99", "comment": "Malware payload", "value": "dec72bdac073fd6d9640c3b5cd79b5e0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017195, "uuid": "fa9d7a92-e8ee-4c6c-9389-f38ed1dfd659", "comment": "Malware payload", "value": "4b5594e6f31defc88b5f41b1773c4e9bbe32e020b20eee47fee58cf240acb688", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017195, "uuid": "92b7526a-6cfa-4f9b-b21d-cdee1f5ae61d", "comment": "Malware payload", "value": "dc7a0859d19215488838520d52c9f57f95204c7e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017195, "uuid": "fbc02235-f7df-4112-9284-83a03a95d5a4", "comment": "Malware payload", "value": "fabf3b2ddbb68160cd183dc4d0160b3bdadf9a12ca541cdf73d5dfb00c6a69ae1d73787964afd3b9c63b4ce3f0ac7df9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017195, "uuid": "b6ff770b-3b31-4c93-a017-de1c227f91af", "value": "3D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017195, "uuid": "5c562f79-dc8d-4acf-b2e2-be1064d8adba", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017195, "uuid": "a9e93d71-8c39-4f57-98e5-37bded89b40b", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017195, "uuid": "5295dec7-966b-4ffc-8fa1-aab3794f1b8c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017195, "uuid": "9493397c-abe9-49ee-997f-66938b6c8b96", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017195, "uuid": "70b3a43d-c368-40ca-b985-f12c02efdfc6", "value": "4b5594e6f31defc88b5f41b1773c4e9bbe32e020b20eee47fee58cf240acb688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1786621-8766-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616016177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016177, "uuid": "2a217351-cf37-453c-b9e7-27f1bfc0e0d4", "comment": "Malware payload (Dridex)", "value": "54d13d181711b4357e4cc9531226f0c7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016177, "uuid": "4a66454b-b105-4106-a270-c4212e10d04f", "comment": "Malware payload (Dridex)", "value": "4be3b9295b6272cee784028244f91c4680861d02b6fa68694cf1a099cb7b9854", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016177, "uuid": "8f3b818d-74d3-471d-ac6d-d40d38041b95", "comment": "Malware payload (Dridex)", "value": "4175de8363429b452fb71a1d7b6d1dbe8761222d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016177, "uuid": "84eba810-4989-4e48-ad97-73b6043ea2fd", "comment": "Malware payload (Dridex)", "value": "cec34a659693cf767fd82b6a61a4a387be937a1a500b238e5d7c824523314f4cbce21174d6fa3ba4150cd3e8267a9a21", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016177, "uuid": "c0b39b02-36a6-4e48-820b-88b627411315", "value": "3D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016177, "uuid": "8c656b8d-21de-449b-92d3-0d3fa34ccb7f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016177, "uuid": "a7f6786d-bc87-4885-a4d7-8e4e7e795f41", "value": "3072:gt9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:gt9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016177, "uuid": "ed33719c-00d9-4b27-80b6-5adde3658f7b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016177, "uuid": "753f95f4-88c6-4ac9-a884-09aaed326bd8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016177, "uuid": "d6e91fc7-8eea-40c0-962f-4e33dc5a27cb", "value": "4be3b9295b6272cee784028244f91c4680861d02b6fa68694cf1a099cb7b9854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff44d61-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005088, "uuid": "cf1d6e56-b2a3-4dd4-a1fb-b7d3211f10cb", "comment": "Malware payload (Dridex)", "value": "0ee3992eb9d4295739aeca5466f3e895", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005088, "uuid": "7e193c75-597b-4de4-815b-f7befbec2217", "comment": "Malware payload (Dridex)", "value": "4c103e3570cabd5b6432bd50fddc489307cc52cb2484c16d2a424e3be3976c56", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005088, "uuid": "3a50639d-c5e6-46f9-a4ec-284beddb2382", "comment": "Malware payload (Dridex)", "value": "b0a9d80fab45ddba78057884181ae483d8450aea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005088, "uuid": "ce6d7141-2337-4d31-9fb8-4d186947dff7", "comment": "Malware payload (Dridex)", "value": "b51760c0d3cd7210e7c0b924095d51b7670172950340fe5e536e064f6d8ea852b1933e3870f90876e4f91e5fc21f5204", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005088, "uuid": "80702f28-29ab-475f-8e3b-0d8947f438bb", "value": "2824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005088, "uuid": "265279d9-2f5c-495e-8c52-905b9d0068f3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005088, "uuid": "4029d846-5196-4d2c-9eb0-a9ef4d1d0425", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005088, "uuid": "8eeb9bc7-ce45-49aa-a9e9-a21b800dd47f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005088, "uuid": "bc928b34-f9d1-42d2-9f22-661947c4351c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005088, "uuid": "f315b3f2-e2b3-4538-9a96-69fcbf678f48", "value": "4c103e3570cabd5b6432bd50fddc489307cc52cb2484c16d2a424e3be3976c56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61cea00-870b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615977047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977047, "uuid": "f8ac7f22-5a68-4859-967b-f46ccee6245f", "comment": "Malware payload (Loki)", "value": "f208f020f159d16a82a7dfbde9f100f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977047, "uuid": "026f4b46-3cd8-426c-90d6-712ac0e2cf5a", "comment": "Malware payload (Loki)", "value": "4c1c77b373a0477d5a661d62856ab5663cb17c7a054cb209524abaea16420faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977047, "uuid": "3087687a-e60b-4c1b-ba2e-ba049091df2d", "comment": "Malware payload (Loki)", "value": "dbc171206ff86f280b4123a9b9aa600b105364ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977047, "uuid": "0029b49e-f1bf-4add-93ca-52d6b05acbce", "comment": "Malware payload (Loki)", "value": "312a091bd0ae826b1acef9d2600654ac7a49f342e1f0c2fd48f76cee98ca3590b09ce6a34434e55c70e14588a9510e51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977047, "uuid": "50324352-ac49-460d-87e0-3785cc9485f3", "value": "45D49DF453248621D46B57388876A6676173A60D6CA8C7BC6DC1FE4F3C7634680B38BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977047, "uuid": "65ce0a9f-f1b1-4204-983b-7b07b90a3828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977047, "uuid": "8d4341f0-c8c8-4cc9-b9fe-3d963932515c", "value": "12288:j8cwlW1uy4PrE9FX6EOZTF9SZQE4jDdAAxf4U2Vo:VuGqFhF5VAo4U2Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615977047, "uuid": "7f5223b9-c833-46d6-8fbc-6f362045a76d", "value": 635904, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615977047, "uuid": "ea508a9e-97b5-4372-974e-939cc7bdfc59", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977047, "uuid": "7727dae6-6022-48ca-a32f-0d1386c50732", "value": "f208f020f159d16a82a7dfbde9f100f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81767d03-876a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017707, "uuid": "22536f8c-50c8-4a0f-aa3b-6b49bd68ae7a", "comment": "Malware payload", "value": "e8512a6a1fe7502684171f48f3a2dca4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017707, "uuid": "cc47ac61-fa24-49dd-a3c5-9b0e639b247b", "comment": "Malware payload", "value": "4c37eb346aef505ce6bf078faf2e0699cfb2622b565190b52c1c0b4e9bab93e7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017707, "uuid": "e339ec19-74c7-47e5-8574-51ce883766f6", "comment": "Malware payload", "value": "4cec5a16a4f443451ca93ec588295935c46c5e06", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017707, "uuid": "82f82437-2065-4912-aaa5-70aa9ef798bf", "comment": "Malware payload", "value": "0b2df5437dd6ed487da1059cb778f2bcde6431f6d77738d21e5692a708796457f58b7a7cfe95beea85aa37af59cd5300", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017707, "uuid": "bef36074-8fb4-4013-aa61-065fb65dcf9a", "value": "3B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017707, "uuid": "2717d104-d93a-4885-a116-cbabea5e3e54", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017707, "uuid": "223eefaf-9ac6-429f-9fb4-36c5beaeb52f", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017707, "uuid": "ccf14600-afc4-47b9-9885-28c738816470", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017707, "uuid": "05d37012-080a-4cb0-911f-1595632367b6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017707, "uuid": "29ab8dfb-9c18-4c7c-b595-726dd0d74b80", "value": "4c37eb346aef505ce6bf078faf2e0699cfb2622b565190b52c1c0b4e9bab93e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4916ee-8750-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006743, "uuid": "2467462f-0836-42a6-b75c-4c8093eb5038", "comment": "Malware payload (Dridex)", "value": "c134e44fcb4d63b91534e7140fe218db", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006743, "uuid": "4b837275-a767-4417-8a09-3860336c231c", "comment": "Malware payload (Dridex)", "value": "4cc478e2fe52602ef4123c4d2a3b39fb80b7e1213d5e4b7ee004548945dc9c81", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006743, "uuid": "61137097-0a10-463f-b119-fa3d75e8ddb0", "comment": "Malware payload (Dridex)", "value": "575f00a4671265dd45bbc196407c97358cbb3531", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006743, "uuid": "6d7bd832-f975-4482-9f1e-6338300ab6a0", "comment": "Malware payload (Dridex)", "value": "31e7f976c0f647182aa8d206e8b4145aaa3b77bd2997e648e46a501e7901f5c6ed4df5008848f7b115e494d90fcb3538", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006743, "uuid": "59d8cfd1-6f03-48a3-96c6-1523fd702601", "value": "1F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006743, "uuid": "967bd205-da59-4af8-b335-e00e851dfb59", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006743, "uuid": "ed4df39f-7614-430b-b070-6a286d9fcdb7", "value": "3072:I9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:I9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006743, "uuid": "344cb698-4414-4d9f-aaa7-38c81839b523", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006743, "uuid": "cac82256-367d-4010-bc89-fcf4bfdd8d5a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006743, "uuid": "3941dcb2-ea27-4897-8fc0-3234eb9cfff7", "value": "4cc478e2fe52602ef4123c4d2a3b39fb80b7e1213d5e4b7ee004548945dc9c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5e205d-8778-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616023928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616023928, "uuid": "fa8b0936-4ad2-4155-b6a4-9e022711ff2e", "comment": "Malware payload", "value": "3adf69bac21fb73f2db842efbf64f072", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616023928, "uuid": "1fe24100-fab6-49f9-b128-75bf06ad77d4", "comment": "Malware payload", "value": "4cc4a5fd9820cc44ace44308322e585901be33b701d32b256809d3ba51a8c80d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616023928, "uuid": "4851e1a3-79a5-4a09-baac-31f485099b64", "comment": "Malware payload", "value": "c6e221b33af94d138d24cf93fb5f2ce1db97e46b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616023928, "uuid": "1ca81f99-78ea-4253-8247-69b24134445f", "comment": "Malware payload", "value": "662d5e1ee6056c598a6e97909d90b6286cefaac2e7f7d564f581beba7d61eed4ed5b8563e6210ce1babad52baa41de14", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616023928, "uuid": "1dfc0875-b10b-45cf-9a46-7f8fee9d833c", "value": "0724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616023928, "uuid": "f7f15f51-193e-4b24-b42a-a72335b3020a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616023928, "uuid": "ba5e0561-8638-4bcd-8504-28e8cae3fb2b", "value": "3072:29Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:29Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616023928, "uuid": "d4daf3ef-466b-4957-9eb7-57c3f584bc43", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616023928, "uuid": "3fe73766-6828-42a7-8b0d-40a25bf5ae29", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616023928, "uuid": "bce4e259-5e1c-49a4-bee2-0a0e513097f3", "value": "4cc4a5fd9820cc44ace44308322e585901be33b701d32b256809d3ba51a8c80d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069a85d5-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615969397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969397, "uuid": "2e53aa99-3161-4a3d-839e-978c1aa5ed84", "comment": "Malware payload (RedLineStealer)", "value": "1cab063cc0c194cc5c81e71aad8a94e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969397, "uuid": "c771c984-bd91-434e-8073-40c0731dc900", "comment": "Malware payload (RedLineStealer)", "value": "4ccc480c0ae855a876e266122a05dea65506fadedee20f1857525a41ef3932f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969397, "uuid": "c2d8ac17-436a-4315-94b9-5cfe48a7807a", "comment": "Malware payload (RedLineStealer)", "value": "bb4d5267f05e3e4f42ad7576f8a8e57a47da5653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969397, "uuid": "58ca87f5-19da-492f-8bc8-17d0f19b21b8", "comment": "Malware payload (RedLineStealer)", "value": "287a391f91c1354d59c3d79986b39e4ef2fd75fd13b3bf8e9111c4fa96f08d8a673064eb6b20a970b3484786fd9277c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969397, "uuid": "cd19d302-b2be-4024-aa73-1fb563446ff3", "value": "74651AA1EFDF6A2CFAE7E14DE3B3394B1840F31E1049109D1572AB14A973DD62E64C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969397, "uuid": "8d63fe59-cdaf-4c82-b1f3-03bcb29c380f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969397, "uuid": "d0f3c1d4-a452-4bbf-8cb6-29f105d93c04", "value": "6144:kyRQUPQSetlQnZcONGhSJvVP1fHvq05qHE:kyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969397, "uuid": "77dbf219-4140-48e2-88d5-1b04dafe8d6b", "value": 1505072, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969397, "uuid": "c4af7306-d15b-45f9-97b5-09ac6ee6e193", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969397, "uuid": "2fd5acf2-0c24-4209-9d45-8e07b213fccc", "value": "1cab063cc0c194cc5c81e71aad8a94e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fe2e85-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615968812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968812, "uuid": "4aa59449-beaf-44a2-a2f9-bd5870e75200", "comment": "Malware payload (AgentTesla)", "value": "ef51e6a06b32b25b36d487f992947363", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968812, "uuid": "2946cf66-ef71-4060-8ead-831cd22945a2", "comment": "Malware payload (AgentTesla)", "value": "4d7c96c2ecc1b924fa394686c3135b81f4cf4922dd9942dad908034def196159", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968812, "uuid": "0dc5b7dc-6eb5-465e-9bb5-a93f9193f483", "comment": "Malware payload (AgentTesla)", "value": "c6cffbec86ab087dc6e8298a29fde6d46daa26c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968812, "uuid": "45ef001b-c87f-4e20-8046-278e06c07be5", "comment": "Malware payload (AgentTesla)", "value": "7f95a9045202df91f611643644f2449ef8449e2be12f905e7811f62ba4c7b4432ed4a647754da3c223e7fd3b87c62833", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968812, "uuid": "ad292194-5f83-4163-8903-f3e576548bc2", "value": "B905BE027284ADD6E42316B25CBFD93011B9BD5D9175C53E3686BA2E05F331220BBB7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968812, "uuid": "72bd898f-2c3c-43b6-9343-c1b1adc7dcdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968812, "uuid": "6612ad75-83b7-421e-9315-4b4386f37ae8", "value": "12288:pq1BNqj9JYE9yV/lbsuvB0svy+yJdGzX2h7a1L912dn:pyrOYE9yV5ss0sa+yfGzXa7Cpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968812, "uuid": "e61e62e2-1ff4-44ef-a2a4-c0dd9ddb509e", "value": 820736, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968812, "uuid": "359ed7b8-4452-4da4-8801-d6c2be070c18", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968812, "uuid": "a5a0ef48-82ef-45fb-9c97-3063fdadfd0a", "value": "ef51e6a06b32b25b36d487f992947363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f18197-86fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1615970112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970112, "uuid": "de430e92-6978-4ad9-b339-3b9e71aba6d3", "comment": "Malware payload (AsyncRAT)", "value": "3b0fbb70810b253761e9d077d05fc14b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970112, "uuid": "e006fb85-c14e-4e45-b87b-fb282238923b", "comment": "Malware payload (AsyncRAT)", "value": "4da93427998ab4c4af427e8734998244df31603491da638abc284a082e8c16a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970112, "uuid": "6ec3f741-f4a0-4e3e-8523-60f6b6376ab4", "comment": "Malware payload (AsyncRAT)", "value": "9062f154e030bc0c9cd57cccb0d0ec7c69f0913b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615970112, "uuid": "1cb07248-cafd-4290-ac91-1d7d199ae934", "comment": "Malware payload (AsyncRAT)", "value": "66d2f0385efa8f26b16165f3ef1db7fc6f850fe42632f598f6a95796a58ad48f9c2637e5a055726815eccae29c82ee0c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970112, "uuid": "a4333be3-8be7-403a-ad39-aea338bed9a7", "value": "A0F0DDEC8E3AD56EE40745AFF92FBA9F5A044D079029B8610055834C26031D9CC0B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970112, "uuid": "1510c8f1-1945-4761-aa47-43440509b918", "value": "12:6O70dK2OB1YRGgc/XHLC/GObqrj+09G5JWRQIUHT6B227DKxgYRIYJYb:Z0dKz8GgcfrCXuGp5JWRQ7HT6B9+Xejb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615970112, "uuid": "9ee79554-080b-4ecf-a8f0-ba2009c20b93", "value": 655, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615970112, "uuid": "92e0faec-f406-41d5-8ebc-7969c8627c52", "value": "text/html", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615970112, "uuid": "040110c2-47a9-4b99-9189-64518f907014", "value": "3b0fbb70810b253761e9d077d05fc14b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78c8e53-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008349, "uuid": "c3b9a265-c1cc-4f91-b055-65874a08a3be", "comment": "Malware payload (Dridex)", "value": "b7492e286a737dbee8cb2d40a542dda7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008349, "uuid": "6de82999-9291-4872-adf7-0b340796f62b", "comment": "Malware payload (Dridex)", "value": "4dad601b06735aebb0693ab3d7f08278537c38a42a73ace0b947a5cf3c785580", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008349, "uuid": "33c1c842-7e32-462f-81d1-230309a6d422", "comment": "Malware payload (Dridex)", "value": "2dbf7562256828cdb81368339a7fd6365bc19e9c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008349, "uuid": "39b03534-49e1-47fb-b111-c1a037c762c7", "comment": "Malware payload (Dridex)", "value": "1a55e0ddb62a64206613e750fa1d1a052bf3a204d9cea10e4ab16855ebe253c688b9c62153883a2cf3b1e75a05464289", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008349, "uuid": "b1973c9a-aa24-42ea-8b0e-c2d3ee8b23f7", "value": "1424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008349, "uuid": "7c348d61-acd7-4827-8614-5f3de3c4530f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008349, "uuid": "04065b98-280d-4324-8e91-0d3d07bd3ec2", "value": "3072:49Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:49Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008349, "uuid": "f440c9d5-74fe-495a-9180-079601e2cab4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008349, "uuid": "89797319-e321-4126-9ace-caf8e79d67d3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008349, "uuid": "df9fbc0f-d921-4876-8a26-9cf7a0beed2c", "value": "4dad601b06735aebb0693ab3d7f08278537c38a42a73ace0b947a5cf3c785580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9b024f-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009087, "uuid": "f965cbcb-84b0-438b-ac1a-eb45837c9969", "comment": "Malware payload (Dridex)", "value": "367bb6edcefe0baedb42d480b053a582", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009087, "uuid": "f78f8a60-da26-4856-984f-f403dbce68a2", "comment": "Malware payload (Dridex)", "value": "4daedef8f273b3edb0e595e57157c97eed9ec4bad915bb4db948d89a2fcee722", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009087, "uuid": "f29463b9-6d28-4f20-b2fc-2b00970ee9f7", "comment": "Malware payload (Dridex)", "value": "7e6ebc25fc547b822f64da5d6d390bde1ef29e19", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009087, "uuid": "de477b23-e779-486e-9f88-d6502ecef0ab", "comment": "Malware payload (Dridex)", "value": "efcca5e085bf6fa9e251de0c3d49504bee535bfa197d776fbd2a56b27a7ece018ca3186f304bda01e0d9aa60dc097b7b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009087, "uuid": "42bc6923-b168-4e2e-bf08-3b87f7a574e1", "value": "7924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009087, "uuid": "7715eca4-3a9c-4583-81c4-a80327124c1f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009087, "uuid": "39e7cdfe-c97c-47ba-9c59-0bc2909b3265", "value": "3072:J9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:J9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009087, "uuid": "313f3bda-770c-42ef-a0f9-b1403b955e83", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009087, "uuid": "89ec1932-d590-4b6f-85ea-156cc6fe6912", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009087, "uuid": "fb265e54-8a2e-4c9d-940c-482a9d0ffca1", "value": "4daedef8f273b3edb0e595e57157c97eed9ec4bad915bb4db948d89a2fcee722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f58e9b-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003185, "uuid": "c3bad6ac-4470-4e4a-92d5-b42d6ddff63b", "comment": "Malware payload (Dridex)", "value": "861888cac98d76285562580d1fccdc25", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003185, "uuid": "6305447f-e8a9-4fd9-aee2-6166993ca0f5", "comment": "Malware payload (Dridex)", "value": "4de3b15190ec5fbec76be64126a3bd88d5b7004b31beeff90ac643362b8d216c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003185, "uuid": "88ab5266-a55b-4f2b-b65a-a2cf8cc7f2f8", "comment": "Malware payload (Dridex)", "value": "a2c3f07776ca7e553555f0e2d32070da43f9e949", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003185, "uuid": "a93ec8f7-93ce-4db5-8702-a5f62ef2071a", "comment": "Malware payload (Dridex)", "value": "6c8532653cfcc66fff51e96f3f9de02c4f96c9fc273badad67f6cfcce7603712116ea9c4825a7d634376ade3aeded483", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003185, "uuid": "d2c8a019-a3af-443a-8978-24ec11d23d7a", "value": "1024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003185, "uuid": "cf8dccec-79a5-45b3-9fec-9b588217ba41", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003185, "uuid": "34fdb1fd-0564-4ff8-a2d6-0f0f3f14c5f6", "value": "3072:S9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:S9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003185, "uuid": "c0cd8f5d-ca31-4971-b0bc-42c4220f876f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003185, "uuid": "6a1401c9-7949-4e9e-81b6-35d605ea3706", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003185, "uuid": "1730c2b2-bbc2-4991-b5df-7d351d99369e", "value": "4de3b15190ec5fbec76be64126a3bd88d5b7004b31beeff90ac643362b8d216c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fa86f2-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017070, "uuid": "e83923b7-8216-4acb-8d08-4099aaefa464", "comment": "Malware payload", "value": "ff41b9a60c9762e9e5f0651a87cdc798", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017070, "uuid": "d8ed2a7e-d4c2-4d81-88a3-60cb3609b01c", "comment": "Malware payload", "value": "4dea851be595e1ad22126361a957c15b2a76f9b564f9b96c58be78a2f6fb8431", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017070, "uuid": "e8de81de-7cec-4669-aa83-f679b1ca4ff2", "comment": "Malware payload", "value": "57c8551c68c321deb36d27c6639b04476279b581", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017070, "uuid": "4a1fec8f-a936-4779-9bb9-8a205ef62a1e", "comment": "Malware payload", "value": "d31a81609a3e42f94f6f8ac4b27bad9bb18186fd1d0e2094aa8ba89b2a784f774b0f9f8376724e6bc3111b76fd9ad1e9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017070, "uuid": "af710b83-2f38-49b4-9357-e3c8fc706563", "value": "D624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017070, "uuid": "9b2fb0ae-1d30-4f92-bf92-5ba47cbfdcd2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017070, "uuid": "edb6c62e-f16a-4576-be46-d689bb1e2640", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017070, "uuid": "2fe47a53-2b99-452e-abe3-267f0366a296", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017070, "uuid": "e17ac951-12bb-461d-84cc-df57028eb8b2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017070, "uuid": "978d4e03-6c96-4f50-851c-5c4d53e1bee4", "value": "4dea851be595e1ad22126361a957c15b2a76f9b564f9b96c58be78a2f6fb8431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c10f5b6-8755-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008598, "uuid": "ee0ff599-27b0-4c55-a22e-cd31b43f5777", "comment": "Malware payload (Dridex)", "value": "15e1dbbc2b2773d7870eb5d14e1c8058", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008598, "uuid": "0bca5cea-806a-4c40-bbd7-e8cb1c96e767", "comment": "Malware payload (Dridex)", "value": "4e2ab8d184dd00346795e12fe3e57ee9b1f22f16399345ce4f2e79c9616d3061", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008598, "uuid": "5c67912d-e3c2-4f23-9fd0-cbc8c2eb8a43", "comment": "Malware payload (Dridex)", "value": "00a238dfb16c960ff87ea9ca7d2b6f8c63cc5391", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008598, "uuid": "e45712f0-5855-408c-9774-64f3862f1c7b", "comment": "Malware payload (Dridex)", "value": "bf9fe4071b752a492f6c1ddd220c93a6a025c8e9420e58a5c98e37e95089cb98804377da6c62b4574d6d62ccfbd66600", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008598, "uuid": "ef43089b-90b2-43b7-98bf-5fd3f8620578", "value": "8324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008598, "uuid": "3179d12c-58c3-431d-abbf-e814b35f6aea", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008598, "uuid": "af08d2fe-a396-4331-991a-b2691c314850", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008598, "uuid": "d79f7399-2fc2-4de7-bdde-aae015124ab8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008598, "uuid": "a7df8de6-8526-4fe0-840a-5457611021c4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008598, "uuid": "54768bcb-468b-4898-9e8a-7808469d774e", "value": "4e2ab8d184dd00346795e12fe3e57ee9b1f22f16399345ce4f2e79c9616d3061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53617658-8758-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009899, "uuid": "7196ed95-16f2-4581-8665-8985cd96d3a8", "comment": "Malware payload (Dridex)", "value": "22a6ab0140352246c7317df75f6a8906", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009899, "uuid": "2062d18a-6d76-458b-bc8d-c5553829d522", "comment": "Malware payload (Dridex)", "value": "4e33b6f01a18f0856b7e8db6a239282bcd67e7498cf6d35efd69f4193d443b57", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009899, "uuid": "37646a2e-d95e-47ba-89f4-f52a790454f6", "comment": "Malware payload (Dridex)", "value": "3323537c3e593b07c6c6337c4519c3591ff1763d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009899, "uuid": "4444bbc4-24f6-439a-9d06-17c3b732c8a7", "comment": "Malware payload (Dridex)", "value": "793544dae3575b8b10904e0b2e7bcbe04598f2f11710eed391362705f1fa897c42a14c656be103992d54be4bc926e5af", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009899, "uuid": "01572ed2-354b-4f61-bd4a-a42b8f739fba", "value": "B424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009899, "uuid": "a70a420d-62fa-46da-9002-3883231fd19f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009899, "uuid": "0c16e2ed-43bc-4d9b-a18f-e9cb01e23bb3", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009899, "uuid": "8eb0351f-cefe-4be8-a21b-ce0834ffdd34", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009899, "uuid": "eb33f53f-6d89-487a-94d7-5c40250d44b1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009899, "uuid": "fc81fc5d-89ad-434b-bac1-d1be1b65f5c7", "value": "4e33b6f01a18f0856b7e8db6a239282bcd67e7498cf6d35efd69f4193d443b57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd77e61-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004250, "uuid": "45f11947-3405-4bae-81dc-c0734fababd1", "comment": "Malware payload (Dridex)", "value": "23b1be481f9bb640e2814b6ae96ed2f0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004250, "uuid": "ec2fb42c-3873-4466-a966-b67f143e62df", "comment": "Malware payload (Dridex)", "value": "4e48d13908f015be892ffdbead36572d7797a0ce810e9e71e83ef781c4a9edc9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004250, "uuid": "df8b490e-0ff3-44d7-9f84-fe5818172af8", "comment": "Malware payload (Dridex)", "value": "f469145a96208c04cfe4bcbea74d105812963b9e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004250, "uuid": "e3fd915e-5be5-4a89-b4f8-468bfc3e026d", "comment": "Malware payload (Dridex)", "value": "c65e11955844054e3fad41f2c5d51ae4392c0210c93449963de81192d32808ee2742df6db3988d6e654d96f8dce4e415", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004250, "uuid": "d076b7d9-0d85-4db5-9060-7e971a791c5e", "value": "8124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004250, "uuid": "5aecb546-d5b0-45ef-9796-a98c590a675e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004250, "uuid": "fd3f4a93-f13c-4697-a091-ddd4aebe5814", "value": "3072:G9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:G9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004250, "uuid": "338bca0e-83e8-4ae1-bb6c-f324d1fd4445", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004250, "uuid": "21ef78b9-9a99-4c45-ab04-99eeb2e9f2b7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004250, "uuid": "5bd8e9c0-a15c-46a3-a16d-351eef7fb884", "value": "4e48d13908f015be892ffdbead36572d7797a0ce810e9e71e83ef781c4a9edc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9658bd0-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "34e6cb7c-41d4-4dce-be3c-f206135b77ff", "comment": "Malware payload (Dridex)", "value": "820f2ee3cfccf70b4b100e0bc62dc448", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "25608c88-7f5a-43fd-b085-5e6b091b7059", "comment": "Malware payload (Dridex)", "value": "4ec74b91f5988cd94f8ee6569804d978398d88c643b521a95786d716b917a7fe", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "8a203770-5fb4-484a-b2b0-df35eb61c455", "comment": "Malware payload (Dridex)", "value": "0e83986ebe3fe5d34a8d84864ad9dd3253f5938a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "29632820-4dca-4860-b142-2142670e0c6d", "comment": "Malware payload (Dridex)", "value": "c0b8daa0530e0d6860c01228051b2a6c35df1dd8cc9f9871a0fa513d2e6ad7df903687f708cbb7c2268ed6e1f8199c61", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "f5332b4c-a906-4580-92da-6871270f9670", "value": "0124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "ef7f8c14-f533-4e31-83f8-352ea0369caf", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "98ce0ff5-788c-4a97-a824-b57edf6bc998", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004084, "uuid": "19ae5acd-df9a-43b8-a424-d0a01270aa52", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004084, "uuid": "72a408dc-d87f-418c-9ff6-28ee2f5bbff1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "fefaf100-8e49-4e67-9391-3f70b297d849", "value": "4ec74b91f5988cd94f8ee6569804d978398d88c643b521a95786d716b917a7fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251eba8f-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616013257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013257, "uuid": "994c221a-f235-4650-8fbe-8bbc6d5c6d16", "comment": "Malware payload (AgentTesla)", "value": "a8af3aaf33d404d8cd4e6df8b15a5e28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013257, "uuid": "5cfcd2da-37c9-404b-b5fd-7bc4bfc83f4b", "comment": "Malware payload (AgentTesla)", "value": "4ec7ef3073c7c42fbfb7be09045af399b21ded0cc14227487da1015f8f2c3c25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013257, "uuid": "e609c1c6-a558-4e32-b74b-c53b69cbb515", "comment": "Malware payload (AgentTesla)", "value": "1595c873f20d7cd8d8e965abc94d9d67e0fbb18e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013257, "uuid": "53f24f0f-d2e6-4ba8-a42e-56238a08881e", "comment": "Malware payload (AgentTesla)", "value": "ad042afcfb2527ab2722aa29d58ba6045c2de76426a3cfb3cb4a04c93968008eec40478fd3a36848f3ae8801922144fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013257, "uuid": "6162cd89-977d-4f37-b9c0-3ce27000891c", "value": "80D4E13223B47B15D0B913BA2878524113F2F40AAB33D67E7EB5A4DD05A3B90C6B3675", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013257, "uuid": "25ba2cd3-cf57-443c-bef8-329cd3aa310f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013257, "uuid": "499e2efc-5a35-46d8-b5dc-2f27bd6aadbe", "value": "12288:6zqzFq1KGUQ8ca/e/ZizZ4+9QC/EPQfCdeDo3LeYIHjeiXH9KCoo2OWl:iuFyLUQO/tp/ExibzlNooU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013257, "uuid": "4f03a790-43db-40cc-bf20-4ab051d42c49", "value": 605184, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013257, "uuid": "e1108a2f-a0bf-44c7-8969-cf9f8908f9c0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013257, "uuid": "61bd2646-f8ec-4cf7-bcec-aba44bb93344", "value": "QAhqxmnssOm5ho4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb01ebf-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013595, "uuid": "82262288-81fa-43a3-bf01-2fe95d93539d", "comment": "Malware payload (Dridex)", "value": "35485fc7fb423fd493a9592517b6eabc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013595, "uuid": "dc1c90c2-7296-40e5-a16e-0567be7fc2ce", "comment": "Malware payload (Dridex)", "value": "4efca3f20224606859192d132455800fd89e11321acfc11c5bd0aa1343404e65", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013595, "uuid": "a976162d-72ed-4cf1-a222-e9ce1b27ebf1", "comment": "Malware payload (Dridex)", "value": "3c246cb73637f66448bbe7affddce021f4b5c65d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013595, "uuid": "20b768dd-85e2-4410-bdef-ef0b32dce937", "comment": "Malware payload (Dridex)", "value": "84f6252712f3331ec1e227e5c4b2ce2a0499ad9333ab2e8ee0cd6f521764c682fb12adc882344f30f31455c7f27f7493", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013595, "uuid": "4dbbb60c-cc93-4c59-aef5-f61b89e378fa", "value": "B724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013595, "uuid": "d316a695-2b7f-40ad-a1a2-00503d8301c5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013595, "uuid": "f8f32518-ec79-4585-8af0-328295e38baf", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013595, "uuid": "e4aee258-ee6e-4d0c-a972-2dc0262d41ff", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013595, "uuid": "db5ea2c7-6ece-4984-985d-8dbec42d55e3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013595, "uuid": "6f975023-4e55-4507-967c-d55da15a727d", "value": "4efca3f20224606859192d132455800fd89e11321acfc11c5bd0aa1343404e65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b273a99-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001859, "uuid": "061b6f7c-7359-4e96-8553-e7c51aa87025", "comment": "Malware payload (Dridex)", "value": "9620f8316e851e53052983600b310557", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001859, "uuid": "87a3cdb7-6f81-4b28-ae30-d086c4ce14fb", "comment": "Malware payload (Dridex)", "value": "4f72292268966f8b1d97636b1d728ddecdfbf15732d7061c424ea7be50be03fb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001859, "uuid": "868d56a6-84d2-4357-b1bf-87d1bbc03408", "comment": "Malware payload (Dridex)", "value": "2ef2d7c88b294e661c7b09b3a57ebbfee61c59d5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001859, "uuid": "fe42be04-5032-4896-aa13-7334df9f4952", "comment": "Malware payload (Dridex)", "value": "54f4f53f91a25b39cbffb5dc15a5396edd9ae5ff056b2d199cc86cbacdbb3ff492ba682cf2082c1d7548d218e1cc6f95", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001859, "uuid": "37bb979a-9fa3-4b1e-b3c3-aa737dc44331", "value": "B524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001859, "uuid": "2a7c3e42-798b-4067-aae1-b08fdbb178f2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001859, "uuid": "7ad5a277-f64a-46cc-919c-01ded29c44ed", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001859, "uuid": "caf91d3f-789b-42d7-ad15-78a627817446", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001859, "uuid": "1e1a4330-01ce-41e9-b616-2e4886c1dd8e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001859, "uuid": "9dcf8651-1d54-49b9-839b-2b616de121c6", "value": "4f72292268966f8b1d97636b1d728ddecdfbf15732d7061c424ea7be50be03fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42b79a5-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003672, "uuid": "a7af1b6b-06eb-4a99-a058-6346b0b8fac0", "comment": "Malware payload (Dridex)", "value": "8fd246838dddf8bd6cebb875d40ea1d6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003672, "uuid": "f7ad3db3-ab99-487d-8095-a2cf180520c1", "comment": "Malware payload (Dridex)", "value": "4fa851d075dc12bee77d95563f5307df6d1f8d470113bac1e5647f080f8bcefe", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003672, "uuid": "3cb04dcc-4b20-4176-883b-d39b913a772e", "comment": "Malware payload (Dridex)", "value": "626aee934bcf93a95a8668e4f549f39199abd6bc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003672, "uuid": "757f2ba7-e473-4294-a277-4040167b7c62", "comment": "Malware payload (Dridex)", "value": "cf24ae6b3e12303b1e1bdcd6b1d1cbaf8906a121b1d5879a3bf70b59805c5586c946058b30bd03b695ac054baf6fc396", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003672, "uuid": "88259b73-8596-4834-908d-d59b6f75b5c0", "value": "EB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003672, "uuid": "1db3d348-835d-4115-967a-21e89e4c726a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003672, "uuid": "f46ce9f7-60d9-4a9d-8f4f-e2d80b7af8b5", "value": "3072:K9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:K9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003672, "uuid": "f4b27277-5bec-47fb-a4de-d62898e21b4a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003672, "uuid": "a99e5c33-c0be-4db3-94a3-c3f8711f1fec", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003672, "uuid": "54dd2fff-334c-4923-b2c7-0a18ae21294f", "value": "4fa851d075dc12bee77d95563f5307df6d1f8d470113bac1e5647f080f8bcefe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce86711-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003955, "uuid": "ea4b6cc9-e939-40d2-aea6-2a4deecb5696", "comment": "Malware payload (Dridex)", "value": "be1fbdc93519894a49e69c9467f81bd2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003955, "uuid": "5ffd3df9-fab8-4235-bc83-c17b00579a7a", "comment": "Malware payload (Dridex)", "value": "500b2558939b618b90e2790b522ef45e3ac91a57ea29f519e0803aebcc849f5a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003955, "uuid": "f3ef1c0a-0d73-42de-954a-15234d877a74", "comment": "Malware payload (Dridex)", "value": "032ea672bd1127a408f5741cd0bd294c1f64755a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003955, "uuid": "a1f1a484-a0f5-4291-b449-47a66ebf3a76", "comment": "Malware payload (Dridex)", "value": "0143b364f889d54b3e2c8866e9b37e4f08eb9c97881fb4623ba792706884f27fd1432c45cf99da5cf0da4357735df3e0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003955, "uuid": "bb497577-3ac9-4abf-9cb2-a0d6ec983351", "value": "4D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003955, "uuid": "a5536d26-55e7-406c-802e-cd19370b74c7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003955, "uuid": "08fb8722-ecf2-4bcb-9620-5e12d0b1941e", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003955, "uuid": "0f58eb76-078c-4d26-825f-48e01de81e9e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003955, "uuid": "7440d2e8-eb1b-433c-bef3-97325b7ab3c7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003955, "uuid": "9c660a15-559c-429b-9115-21b3eb94d001", "value": "500b2558939b618b90e2790b522ef45e3ac91a57ea29f519e0803aebcc849f5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de034c70-8762-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014426, "uuid": "69f0003b-105b-4728-a53f-35e722f269b3", "comment": "Malware payload (Dridex)", "value": "795573efe0a7f678ca89fdbdd8fe1f83", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014426, "uuid": "1031725c-4c94-4da3-833b-b2c70857b187", "comment": "Malware payload (Dridex)", "value": "503f449807a34396dc7c50f8b7012ea0f08f563e2afbfa707afba22183f5994d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014426, "uuid": "a02214c4-8882-455a-b10b-a2b875b7d262", "comment": "Malware payload (Dridex)", "value": "ff598bd45b24f3def08979af6ec3c73dd4da79fe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014426, "uuid": "37d3f5de-f3ac-41e0-9f09-ca54a9d88e20", "comment": "Malware payload (Dridex)", "value": "4c52fba7fa8f13144a5ff5a577d518498522aa43e34e49032873ed5b94e04527dd2089254273e7d483f6fbf4ed796563", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014426, "uuid": "7c6bb126-0219-43e1-894d-6864cdaf3767", "value": "9524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014426, "uuid": "28a13193-33eb-4841-b5dc-6582d19c5262", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014426, "uuid": "38382812-e1e2-4c59-ab2c-2caae78bff7b", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014426, "uuid": "adc8b816-183c-411d-932e-26cc889b6234", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014426, "uuid": "f1906123-01cc-4a8b-b1f4-1a9ddad51460", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014426, "uuid": "df58ffe8-ecf0-4f00-ad0c-baa3adb8cf05", "value": "503f449807a34396dc7c50f8b7012ea0f08f563e2afbfa707afba22183f5994d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadf1a3c-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013159, "uuid": "23473209-e5b8-4f38-ab1b-51abe275fed5", "comment": "Malware payload (Dridex)", "value": "09d6597cf90440533779377e00fb604f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013159, "uuid": "96d371ed-b6c1-4e2e-a098-ca3da31418f8", "comment": "Malware payload (Dridex)", "value": "50d54a0112e80d07be4dcfcf0712e687edd247ba9d5ac9a0139b7ec09b82b09b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013159, "uuid": "dbc292a1-b8ba-4c40-9c74-1722af5a4ace", "comment": "Malware payload (Dridex)", "value": "400f7157c0418b2d8a5bd7e83d2d09fde5453a4c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013159, "uuid": "3f446394-8bf8-4f75-b595-3a780f65a79c", "comment": "Malware payload (Dridex)", "value": "5fda4f5b62964251d3b1d00d90b64fdda498621a0d9a609f976e97a7426afd95f6d63af5fd35f33347bb72ef68bcc566", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013159, "uuid": "7be4d7b0-3f59-428d-9dd0-7acd94b77f91", "value": "C124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013159, "uuid": "caa656b5-ac20-4ec5-a880-f1e4dc15c4d8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013159, "uuid": "e8de0e8a-237d-42b2-8487-c2f63fb544d4", "value": "3072:n9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:n9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013159, "uuid": "72f845bd-dbc3-48cb-9806-0e754964a2a3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013159, "uuid": "c51f7ab0-b609-47a5-93d4-ae89658c147e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013159, "uuid": "755380e0-656d-40c9-adac-eb02a91a9eec", "value": "50d54a0112e80d07be4dcfcf0712e687edd247ba9d5ac9a0139b7ec09b82b09b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a609dcb-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004676, "uuid": "0f813af0-5391-4014-a6fb-1699c1d1042a", "comment": "Malware payload (Dridex)", "value": "76209303d702858779efd6cfdd8b808d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004676, "uuid": "2f2106dc-78ae-44ac-a128-3abf99e90266", "comment": "Malware payload (Dridex)", "value": "50d79cf5a15152902c18624c17b259463b0c9334174a18e9d1277a71e2d96ef5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004676, "uuid": "cf0b076e-ae02-4b32-8ed5-27e810061a1f", "comment": "Malware payload (Dridex)", "value": "bc76acbac4dda48990638bf645f44c36c189b878", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004676, "uuid": "be971b46-3ad6-4093-824d-dc314143e5fd", "comment": "Malware payload (Dridex)", "value": "19c29f08f0dcdd7b6ca182afe53ad31c5f4b26784c8506bcbb79eea316b6f9f0cd5842c817574ec4860d491179d414fe", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004676, "uuid": "f562ad99-d9ef-488f-84ef-f898610c1076", "value": "4A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004676, "uuid": "010f4262-d6e7-4c68-b585-ee454c621c30", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004676, "uuid": "3610d749-29fb-4009-8f19-fd5e61b1279c", "value": "3072:b9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:b9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004676, "uuid": "a05fee38-3c41-40e4-abae-8d7f77ae7d05", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004676, "uuid": "4833640a-7d93-4347-8ab8-7af83e11ded5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004676, "uuid": "6a5fdb0d-f518-4e9f-8c4e-583fc25d81ed", "value": "50d79cf5a15152902c18624c17b259463b0c9334174a18e9d1277a71e2d96ef5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716742f2-86f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615966140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966140, "uuid": "557ecd12-cbe7-4f85-adf7-d44d44684a53", "comment": "Malware payload", "value": "74c4c72a0389ef1dfd46c5d3d4545e78", "object_relation": "md5", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966140, "uuid": "11a5232b-5ee4-48c8-ae03-9a0a1276cb3f", "comment": "Malware payload", "value": "5170144b043c93346767e5d18a5e4b7ef104d96b2ee15e43cd75dca8a0c580c8", "object_relation": "sha256", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966140, "uuid": "2d3d6035-f704-4342-b67c-1d1521446a63", "comment": "Malware payload", "value": "6a617d27bc5f9ecc4fb93f5539a11b1fa4bfec0d", "object_relation": "sha1", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966140, "uuid": "f8452e9e-6669-47b5-88c7-fa7512f39dda", "comment": "Malware payload", "value": "5d36c191a5ad76a49267cd1e9e5cacd285c4af401d8d75323f965094c90a600442541eefc339d3364b8714cdb7f36f75", "object_relation": "sha3-384", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966140, "uuid": "ba074930-095f-4d89-879b-014edcc4c4cb", "value": "EBB3F20EE3145CADC239B07FA605A8F4655D73A1A892F40B2528FE0575A99F31BEF0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966140, "uuid": "6ab0e539-8b31-4f03-a616-37f38d6fa397", "value": "3072:+qOYPvsUtFARPULAZemMA5uAgz3xQGaFRVnfdCgJU:+vMFAeErgzBQGcVnfdPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615966140, "uuid": "85a4cb73-929e-46f8-9040-9acbb2d2504d", "value": 116314, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615966140, "uuid": "cb59bd57-bcd8-4da9-9f8e-89283574f913", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966140, "uuid": "09d1250c-8168-4a93-9f7e-c5a2c6de1e92", "value": "5170144b043c93346767e5d18a5e4b7ef104d96b2ee15e43cd75dca8a0c580c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdcc02e-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616001888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001888, "uuid": "dee03b50-5108-4b01-9a8a-98c0c4a333b5", "comment": "Malware payload (AgentTesla)", "value": "953d09d674ca55d41bc70543b6ed3ecb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001888, "uuid": "3b04879f-ea2f-40d2-9450-8ab2f92cd8cf", "comment": "Malware payload (AgentTesla)", "value": "5187dfb44ee0629f1b0e153b3ce6ebc0c42521fd0a19bc4fba0242290a7d9b6b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001888, "uuid": "5009839e-56e2-4bc5-b043-71d75a967167", "comment": "Malware payload (AgentTesla)", "value": "eb077ec4f3db35e5324fc5a0433bb34c43c76003", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001888, "uuid": "acfe3a96-55cf-42a0-9cf5-a07802494d9d", "comment": "Malware payload (AgentTesla)", "value": "702549b50bad0147b08c18ff5817ad461bbbc737fde2ddb84fe4475d652a8241934a82576ffc53e010921b633b738a4c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001888, "uuid": "c788ec36-4ff1-4234-ac70-d27d75ff7cc1", "value": "250523259049DA5EE4C2C76040F3542AA4FDE4FE1BBBDD1F318CF2AE86BC988C745685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001888, "uuid": "9c9f713c-4eff-485a-80eb-e4eb5e016011", "value": "12288:dj1W41jU6zhEe8RmqeuktxZ6FQmKEvT4K45J9TRh8BKfoJs3kK6Ligxw0aI0dio:V1V1pimEkLZ6KTk4JJFR3GsUKaigFZro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001888, "uuid": "14f23b4b-a512-49a2-9e55-6d07b21471b8", "value": 851864, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001888, "uuid": "f93f8538-4466-49eb-90f3-057500c3abbe", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001888, "uuid": "62db8802-d934-4440-9358-3403b8a1e5bc", "value": "PO# 560211-GULFMEC plant.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf696144-8752-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007503, "uuid": "51a77efd-d45c-4d52-8dfd-8d41e52089e5", "comment": "Malware payload (Dridex)", "value": "d7566e62f6abb514dbaec520d2c26421", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007503, "uuid": "55253967-98e2-4cc4-8958-ad1ecf6e7f22", "comment": "Malware payload (Dridex)", "value": "51b9cb28a9051f32ecc761d6c897d3d60ead68079b125d6f7890b0e98c8a154b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007503, "uuid": "f3bf2437-ebe0-43aa-9666-77b16ebe726f", "comment": "Malware payload (Dridex)", "value": "d69c6e06c0c96e919168464d14b3db0cb21d2893", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007503, "uuid": "f80fa6c6-547b-4973-b24c-9dc7d25c3dfa", "comment": "Malware payload (Dridex)", "value": "89f7312e482dbd979ce56f0bc58f00b5a1c9149f1cb97480b5cbdc680b23d5357f59e010e47155167385d8ad3c9d28b1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007503, "uuid": "633be912-8263-4433-bd3d-164ff34aff9d", "value": "5C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007503, "uuid": "79a08c0c-fc6b-4f57-b00d-1b25d28dc7b0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007503, "uuid": "c0bc74b5-a9ec-4e89-a548-bd6fdc4726ef", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007503, "uuid": "885bcc92-2607-4a22-9636-6a5f4cfdb3b2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007503, "uuid": "76d78a3d-d2e3-4053-93ac-b2743a9a4e1d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007503, "uuid": "5a590710-c985-4488-9a25-7fa29653fa01", "value": "51b9cb28a9051f32ecc761d6c897d3d60ead68079b125d6f7890b0e98c8a154b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08f6155-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013571, "uuid": "08ac68e2-0122-461e-ab68-1bda8c93b3ce", "comment": "Malware payload (Dridex)", "value": "b3676514b73a2432c0c4022d3f952179", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013571, "uuid": "945290e8-1d44-4dc6-aed7-60fd25d5357e", "comment": "Malware payload (Dridex)", "value": "51bf273306096dc49b91a69ea7e6af821ddc156eef7019ed1731a5910b78dc44", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013571, "uuid": "861f0f86-b008-40dd-add5-50c141a61ae7", "comment": "Malware payload (Dridex)", "value": "35373051fe81df4284d780888149da0fff4e95ce", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013571, "uuid": "8f1a6c14-9d8d-44e7-9b95-10896e70f9eb", "comment": "Malware payload (Dridex)", "value": "2f1313dbd8449168d25ffb63499bdeabfb57633f0f2e748c8ce5a90149ddde4967b1963294a5f4253b7e3bb8c337b492", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013571, "uuid": "2de25a63-f7f3-42b0-b4da-bea80f15deca", "value": "4224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013571, "uuid": "0e708bd6-8326-410f-9da4-2b14e245035b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013571, "uuid": "5cd67577-fddb-4041-93de-ecfd9add8ba2", "value": "3072:C9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:C9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013571, "uuid": "3023d67b-551c-42c2-a921-d3aaacae639b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013571, "uuid": "1b178fb6-fb82-4503-ad02-f498ea1a3816", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013571, "uuid": "5c6721b0-54d7-471c-8c38-98d12f332992", "value": "51bf273306096dc49b91a69ea7e6af821ddc156eef7019ed1731a5910b78dc44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dd4b02-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969505, "uuid": "41a2e230-02ba-4bfd-9481-cb2a2448f796", "comment": "Malware payload", "value": "f67d50d3ca318b7dc910ea10830f5c39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969505, "uuid": "d0199249-30d4-495a-9d09-4e2944efae64", "comment": "Malware payload", "value": "52376f221552bdfdc3619e9c5776b6e53e5819421e5d55de992c86114e8d601b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969505, "uuid": "7415df0e-1956-4cbe-b8a6-97282a13c91d", "comment": "Malware payload", "value": "519f2543a6bc8d83a5ebf1ecdbbdced980ca66d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969505, "uuid": "0cc0664f-e876-49ca-a274-dd6cbf309b0a", "comment": "Malware payload", "value": "941a0df6e55be4824834966887a25bb477e3152b9a174b32609cf09051aa60b4eb8ffbe6140d7ea8a43ab3f63cb8956b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969505, "uuid": "f0d68107-9854-4a26-b862-5be2fd971db7", "value": "E4A3BE21B9902187C2DCED3719853BB1423F57E9ED26572D2E2FA0BB3C3112F446AA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969505, "uuid": "f3a597f8-0fe5-489e-943c-133f921df9aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969505, "uuid": "5957b423-6e22-4bd5-95bd-085cd2b58c84", "value": "1536:WOVM3EFVBIe2eOm5qn080M0+5eS3ZtlvNIYAEhIuQBRGbDqbJc/PO06sGtUrB:nNTRB5IveWZTvNvNhUB/bJcnO00UrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969505, "uuid": "a2bac6b8-4c25-496a-89a9-4ea81e23a5c8", "value": 98304, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969505, "uuid": "c7b39cd1-920f-4176-b4e7-db09b452a1d2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969505, "uuid": "1393c84d-c10a-4b21-8de8-ab5451fe1953", "value": "f67d50d3ca318b7dc910ea10830f5c39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102083e4-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616012792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012792, "uuid": "cf195920-7501-4f29-b03f-f2d91b017778", "comment": "Malware payload", "value": "e0cdb9036e8f181e38e41048df390d69", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012792, "uuid": "6a84a2bf-26b5-4c11-b3c4-1293888958c8", "comment": "Malware payload", "value": "52393e37a2897d01d1aab78fea043cce95b90b927facff48cbb1ae853de51696", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012792, "uuid": "17a4918b-0f10-4fc5-b901-9011eb9049eb", "comment": "Malware payload", "value": "d31256dec65eee9b73f8e6f7088fa293066646e5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012792, "uuid": "530d2942-e954-47a1-872b-f4cab04b7010", "comment": "Malware payload", "value": "653abc546826c449ced142891b9c456c10dbd6261b028fa1e3c3dedc695e132470585d5d61a93467510e54e2fe22cbdd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012792, "uuid": "d6740279-f3b1-4073-be84-85e085984f9f", "value": "6524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012792, "uuid": "13f99feb-b0c0-498f-9d96-1cf47a988d2f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012792, "uuid": "d57019f9-f4b1-426e-a9e6-bf1da1703db8", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012792, "uuid": "38764bdf-6d42-44a1-b273-755107bb3483", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012792, "uuid": "dceddeb3-fe07-459c-9ec7-51ef5b6cbb84", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012792, "uuid": "01a9c2f8-2cd5-4384-9ca6-8c5303c18fc8", "value": "52393e37a2897d01d1aab78fea043cce95b90b927facff48cbb1ae853de51696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d263368-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011257, "uuid": "afaf4c04-1b22-474b-8a4a-ccbfedbc3ed1", "comment": "Malware payload (Dridex)", "value": "e19a843c9000730cffbb281f167cbbe6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011257, "uuid": "da3d129f-d51a-461c-aa97-1c1fef71afc1", "comment": "Malware payload (Dridex)", "value": "52c30a1c25f2960fabad6c720679b66b6e006235d01b84e0af2c3be465d2e345", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011257, "uuid": "5e1477ec-efc8-49c0-b0a1-875b05e18369", "comment": "Malware payload (Dridex)", "value": "64b77838ba5a7756bc0706e464c0ac282e5d419d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011257, "uuid": "0fb8ad69-c179-4d2f-a7a6-3ec1239aebb6", "comment": "Malware payload (Dridex)", "value": "66b138d12520f56a8faece258eb73be42099651ed3040e11e4dace6c04b7d683188a2ae79899b88ef0693cbc9f9c5a53", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011257, "uuid": "6cf16fdc-4b65-4be4-bf00-271c5fe56c86", "value": "FE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011257, "uuid": "19cc88fb-42fa-443b-a085-408c7969d905", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011257, "uuid": "f39eb783-bb9e-4514-8a7a-be9b843b5689", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011257, "uuid": "1d7a71ac-feb1-4303-a8c1-80996237f714", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011257, "uuid": "f1172fce-ecbe-407c-8ed1-ab91c50c94b4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011257, "uuid": "ff9327e0-c9d5-4386-88a7-6c9db8d59993", "value": "52c30a1c25f2960fabad6c720679b66b6e006235d01b84e0af2c3be465d2e345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d670f7b1-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004105, "uuid": "193dcbdd-123c-4a3a-9343-bf029535c3cd", "comment": "Malware payload (Dridex)", "value": "71b9940431bc5caffc7f2a22e22e6a27", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004105, "uuid": "4e3d7ea1-7aff-44cd-b673-8f2c5a667cd0", "comment": "Malware payload (Dridex)", "value": "5356533875e3be4e2b90c7b3bf4927a4b9cca6b0eff54f1cf49c586c05380e3c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004105, "uuid": "04984187-33f3-4155-94d4-1b6e28c7f9e8", "comment": "Malware payload (Dridex)", "value": "90c6755aad4025579ae63aba46989c6882d0d3bc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004105, "uuid": "97e82c38-200b-4a4e-b808-877db5b4642d", "comment": "Malware payload (Dridex)", "value": "20f72fa9298a1b7043a170007ca06c6f3c2a2e0bada3b21365be724366e20e123e94fd51ceff634b4b920a69afe4f1c1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004105, "uuid": "5e880a6a-6830-4253-8e09-9789b0dcf264", "value": "6624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004105, "uuid": "36e74c3d-b7d4-4eba-b4c6-aa27135f9398", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004105, "uuid": "e3edc63d-195b-4c45-8cc5-5ac44bcccc4f", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004105, "uuid": "f51f0f2b-0aec-451d-b773-da28073093ef", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004105, "uuid": "b58f906a-1ca9-44f5-9290-5852b72d5fae", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004105, "uuid": "4b356592-3787-472f-b8e3-e73ac4d86e31", "value": "5356533875e3be4e2b90c7b3bf4927a4b9cca6b0eff54f1cf49c586c05380e3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80992fb-8763-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616014819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014819, "uuid": "c19dc53d-80a6-4504-9733-1e0baef06bc7", "comment": "Malware payload (Dridex)", "value": "606626df1d8169bdbcad761974218997", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014819, "uuid": "f6bbec30-e37a-4f88-abee-044d54e1ea21", "comment": "Malware payload (Dridex)", "value": "53d4448ec25891195977cbe02a3bc0d63bef359e014436b0d06def71dd98a375", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014819, "uuid": "a76053fb-4db3-4c8e-82fd-7d57ad9b29b8", "comment": "Malware payload (Dridex)", "value": "d61e5b6e0cb1751e689312303f66be00e25ffee2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014819, "uuid": "9f148c0d-0e27-4280-a015-87ed0772d2d2", "comment": "Malware payload (Dridex)", "value": "17d545cf00f1234ca38344dff7aef5ddeafc5da5b15ff2ffe6daca5dcfc32825e77350f3d13c150d57b4e8eedb012b67", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014819, "uuid": "026fb807-0df6-4088-8180-e5ac45d6146a", "value": "7B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014819, "uuid": "ee9d9ebd-f9db-4b4a-b43c-207ee8d52d36", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014819, "uuid": "93da2cae-fd34-4775-88a2-a96484e8e9f2", "value": "3072:F9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:F9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014819, "uuid": "f552bd9b-36f0-47e5-b1a7-9a16e49adda4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014819, "uuid": "185ea323-3c27-4326-adcb-c762700078a3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014819, "uuid": "d5921665-e23e-4352-9579-ba2e0cbaadce", "value": "53d4448ec25891195977cbe02a3bc0d63bef359e014436b0d06def71dd98a375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3277b247-876a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017574, "uuid": "00229625-9a1d-4dae-965f-2a51230ff7e6", "comment": "Malware payload", "value": "3defbc47eca6dd2b201e1cc7f992b2b3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017574, "uuid": "9876df84-cdc3-4175-824f-b9b1fd138506", "comment": "Malware payload", "value": "53db50751256235595c5a028cfd5d3831d721bb53a34140578cbffa73dbb113d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017574, "uuid": "24d70bad-8980-4a3f-918b-d4e6d8877e6e", "comment": "Malware payload", "value": "17003bbff1c599f3e5ea67d5d5f32105f75bf006", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017574, "uuid": "cf305f38-6e71-4d4a-a704-2b4631fb2a86", "comment": "Malware payload", "value": "67fc58bf8d2d9f5c70cd5b748c0417cfec86a13a41878db985f8c4f6a58264324531b132eaffbd474d54a43b84261294", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017574, "uuid": "a6a00535-c7ef-4857-847c-68fe1cce7f52", "value": "EC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017574, "uuid": "e24e88e2-3821-41d8-a97c-0869b51b7259", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017574, "uuid": "d651f1a4-6884-4ddf-963d-b15a1779160f", "value": "3072:99Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:99Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017574, "uuid": "6120185f-aa01-4469-9dc0-3412ee042044", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017574, "uuid": "860ff431-a803-4dff-9266-c9e131b76730", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017574, "uuid": "bf066762-4401-42b5-a4f7-0d8dba4a09c5", "value": "53db50751256235595c5a028cfd5d3831d721bb53a34140578cbffa73dbb113d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cbd5a1-86eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615963299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963299, "uuid": "2e2f8189-e99e-4e88-974e-4ae3c3caa17c", "comment": "Malware payload (AgentTesla)", "value": "a9401e103e657260a8a6a405e70af588", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963299, "uuid": "1d3b826e-fc88-4f4a-8e1d-44eceefa61c8", "comment": "Malware payload (AgentTesla)", "value": "53e79aafb56c2a49cfa32cf3263f8f8d37ea051af35ff6965c1d12b7ab382f4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963299, "uuid": "597a28bf-cdb9-4908-a58e-aa8095cc3b63", "comment": "Malware payload (AgentTesla)", "value": "73b860a24675c03be009cea737df511da418055a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963299, "uuid": "0f6aa867-410d-48b9-b94e-5c76490b408b", "comment": "Malware payload (AgentTesla)", "value": "3c6d35aec50f57c6d695b1f74ba87f96325e0773e10252e15724d047878340a9fd19030b5f5b2fe76017b900c2176e63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963299, "uuid": "1865418d-52a9-4a97-a960-7ada38fb1770", "value": "47A423B2706CB33642BE55C1068F7A9A5C8C17FEE9F02BD5E57111D2A321341BCA70A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963299, "uuid": "74222ce8-1a7b-4ad0-9f39-40e8ecdc1bc0", "value": "12288:ccN8s6Nr6GdQgRksrkxmQ1mEXuwaaBg2a:c0oN+GNPrkxm6mH5aBna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615963299, "uuid": "5fd8b1f3-d06f-4453-b067-142abe3284a5", "value": 488247, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615963299, "uuid": "8e2da3c4-722b-4fc0-a7a2-6a303f2322a8", "value": "application/gzip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963299, "uuid": "e0c9f05e-197d-4ddd-90d7-323c58fd1c8b", "value": "Purchase Order #17032021688776587757865776-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8520364a-8703-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615973475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973475, "uuid": "ebab9724-e55a-4ff0-ab24-ad8a33dfe310", "comment": "Malware payload (RedLineStealer)", "value": "ecd8ffbea7663996b2d7298bb3088e6a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973475, "uuid": "bcf216e6-d1d5-4524-bcaf-93eff071446e", "comment": "Malware payload (RedLineStealer)", "value": "541eea3db458d43683da16a81d5d9edc6c0b020008a5a3314ba624a4339917a3", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973475, "uuid": "27a7956c-293a-4d8d-a2d4-cd83f7852f32", "comment": "Malware payload (RedLineStealer)", "value": "0f57aa1bbdca911955036057ea54ccc3a4eb45e2", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973475, "uuid": "0a731bfc-8d98-4239-a3c2-7ea095aea9ca", "comment": "Malware payload (RedLineStealer)", "value": "87bd44fb09959d58ab63aa84dfa2897e682aaac76cedec69a1279f359d1e10fec4833a8e321281f7a49fe93a753658b7", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973475, "uuid": "251b5b84-aa01-4f78-b582-919bfe2b7f1b", "value": "2A24BF2171C0C2B3C4B7517444E6CB799A297032077A96D7BADD2BBA6F213E1A3352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973475, "uuid": "1945225d-e589-4440-93ff-21d20ae88e62", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973475, "uuid": "60836985-a4ef-4ce3-8c5d-4607dcffbd36", "value": "6144:aDKW1Lgbdl0TBBvjc/dAynn0DzSsQ+iGPj+n:ch1Lk70TnvjcWyn0Drhj+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615973475, "uuid": "4fbe1eab-b89f-4e53-bd73-bb96007f6446", "value": 210432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615973475, "uuid": "a39b1baa-e974-463a-954e-79668cd8d390", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973475, "uuid": "47dbfe04-26a1-4b76-ad8e-e017df4f582b", "value": "SecuriteInfo.com.Trojan.PWS.Siggen2.61899.6544.29541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7440c2-874e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005597, "uuid": "55ebc3fe-82e3-4e61-b154-d791487fcf65", "comment": "Malware payload (Dridex)", "value": "48d0b4167e0f41b810506a8086907d64", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005597, "uuid": "3f2f6261-7305-4eba-ac13-24ba538ddef8", "comment": "Malware payload (Dridex)", "value": "54962f8ba0e64ab053bbe2527146e349e17d4cb488d06d3305ceb8aacf494fcb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005597, "uuid": "806d0086-a1e8-46e0-b09d-b7e72242e9a2", "comment": "Malware payload (Dridex)", "value": "f5a7e7bafca80ab9f3f705f89915f5f151c26bbe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005597, "uuid": "8eb5e594-4d98-4b8e-be2f-fdac4cb1a9d9", "comment": "Malware payload (Dridex)", "value": "e56fb080af05d0377891a950b474fd8fd53187baee929d9151a0f6f238a65c5536884ff7ce7531d688e963ef0e05ec02", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005597, "uuid": "3e1b08d8-8c7f-4005-8950-e50f5c9184a0", "value": "1324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005597, "uuid": "fa4aabef-d0a0-4f42-ab09-bfa205760a91", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005597, "uuid": "69276a9a-0dbf-4523-aa91-e7db1855ab9d", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005597, "uuid": "18dbfd2d-35d4-4729-a78b-87d6e91997c7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005597, "uuid": "0003253b-719b-40c6-90bf-61f6ba00c1d3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005597, "uuid": "ef6a6b5e-081b-47df-a0ec-292632e2f945", "value": "54962f8ba0e64ab053bbe2527146e349e17d4cb488d06d3305ceb8aacf494fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32c469f-8765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616015643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015643, "uuid": "d38b97a6-c6b8-4fdf-992c-846b44d43d47", "comment": "Malware payload", "value": "6f06ff64f2e3956bca77409ee4472390", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015643, "uuid": "0b54e35f-f126-46a0-a7c9-418aabb5ad61", "comment": "Malware payload", "value": "5509755b03a0d08dbbd5aa782628872defc061ef7c818a89afd31aa8997053b6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015643, "uuid": "1844bceb-e2f4-469e-95e9-f3a56742ca16", "comment": "Malware payload", "value": "9d642600044f752f7664e106f6ce7a4b8f14d380", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015643, "uuid": "452d3e39-d480-4d43-ae02-a16b6f50c0ee", "comment": "Malware payload", "value": "7f4d18d9388c9fcd57ff0215e3720e10ec9f4506365e0dd6842e9c75069c8d4a3ee97efd825d251865d11bfc3a69f0fa", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015643, "uuid": "e3817057-5767-433f-ae4a-98612dc56b9b", "value": "E224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015643, "uuid": "4478bced-1c90-44b6-9c81-1b7dbb754237", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015643, "uuid": "0e6f2260-81fc-4802-91ef-ae107c940966", "value": "3072:A9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:A9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015643, "uuid": "01a3153a-43a9-41ae-b2ae-718823eae662", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015643, "uuid": "6533060f-6016-4ed1-bcfb-fc19932f41b5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015643, "uuid": "d17ed62d-9985-42d3-b16a-1d3da4279b3a", "value": "5509755b03a0d08dbbd5aa782628872defc061ef7c818a89afd31aa8997053b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4539a06f-874e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005580, "uuid": "5181bbdb-128a-4094-9667-1e04740ddb25", "comment": "Malware payload (Dridex)", "value": "42042ed9505c738b5120b407db672216", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005580, "uuid": "6d93e0bc-ec9d-4c64-88e7-90d5c4bf7c11", "comment": "Malware payload (Dridex)", "value": "55b4777aabca8ac43dc3b0f13f8d7400d83c8ac5584c1fa7381971ea8b503533", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005580, "uuid": "05323c31-1588-4f9c-8224-61d64505a048", "comment": "Malware payload (Dridex)", "value": "a062af8d03b5be2ffd67faa6cfba628c42b72b04", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005580, "uuid": "8f924e49-ae78-47ab-8955-45fda4c7f132", "comment": "Malware payload (Dridex)", "value": "921e7f80c3c5c5030c09cc4d22e57ed391c15ca40474d9d3e4d9fe8086e7cca2f5fd89d4064e93d96d9e28646b8f9d2c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005580, "uuid": "83da9dee-e285-43d0-9789-b8a1c8b31875", "value": "DC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005580, "uuid": "c614cac8-4e3f-4841-ae01-9fe059b986b6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005580, "uuid": "ebf736f5-c6b1-4df1-a36c-1039be101fa6", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005580, "uuid": "2b17a851-7151-4504-b51e-bf5019295054", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005580, "uuid": "874e8097-9220-488a-a087-313d98be74e6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005580, "uuid": "b2b20867-d43b-4115-8029-bd7c255845a2", "value": "55b4777aabca8ac43dc3b0f13f8d7400d83c8ac5584c1fa7381971ea8b503533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b65a98-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003512, "uuid": "836e55d7-8848-4e10-b1f4-cb916db5c2af", "comment": "Malware payload (Dridex)", "value": "a09a618306e6a820752213717e03585f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003512, "uuid": "a42fff97-3477-4654-a497-431da63e0682", "comment": "Malware payload (Dridex)", "value": "55b749ae228763c1ffad06e153b7295724ec963031e69793ba8d367b5be972c9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003512, "uuid": "bb118047-e81d-4420-9dcc-6f3111aa8efe", "comment": "Malware payload (Dridex)", "value": "e6e9ba8ef7afdec32fe84533780e8a770d94c4ec", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003512, "uuid": "20ae8c81-ce21-42de-bf9f-a5c95e88dd60", "comment": "Malware payload (Dridex)", "value": "e573a794ed86cb6a24ea8f2ad011a764e2276a4567d93d6a492094c6e34a4bd29e00108970fb1e86874c1fb34381cfaf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003512, "uuid": "53a9fe65-84cc-4361-8cba-9e9e65fbb492", "value": "DB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003512, "uuid": "23c7e3a9-84d6-4d16-a3d1-2699f48cd42c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003512, "uuid": "2453d422-d66c-4a75-9b1e-8e03244569b7", "value": "3072:N9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:N9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003512, "uuid": "0cffd778-7a2a-48a7-a9fe-e9afefd85e34", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003512, "uuid": "34028a66-3de3-4ac5-b7eb-980763d2a500", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003512, "uuid": "2ec4fa6b-e961-4aaa-a18f-3c921c9f240d", "value": "55b749ae228763c1ffad06e153b7295724ec963031e69793ba8d367b5be972c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2636f44-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615984718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984718, "uuid": "962eff50-0fd2-4d99-85e7-13b7187fa46a", "comment": "Malware payload", "value": "524dfc23f74e7d86c745161d772eb665", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984718, "uuid": "a44c3160-3acd-4f51-b17d-e13e8aba58f4", "comment": "Malware payload", "value": "55f00caca04195086552d253d67560cc3d97f1e91a7a56e3367c67e3d2b06c5d", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984718, "uuid": "ff044639-e7ed-4ef0-835a-9c4531aa3e51", "comment": "Malware payload", "value": "1ad3ef42bafe7c5286277b69a98c17842730456b", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984718, "uuid": "eef062b8-bd9c-4609-b991-52672ca3236f", "comment": "Malware payload", "value": "a2bd112013883196a0f72a8195f76a688fa44701283cd75fd82044ce8601d49c1060fafe24695a2a2e3c52b146280085", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984718, "uuid": "44a6fb06-6ebd-468e-a47b-804e66eb83f0", "value": "3EC4238C2DF517589BE6F41063255813F89E301A837B62D62BFC4F23A6D6C8683B751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984718, "uuid": "95f76025-bfd4-4c29-838c-d2aad1311da7", "value": "12288:kwwFvUmO0Kd0Oe3F25B9mQX/QU24sBO2rph1RRaKQmvuj:X7X0KdS3F25/1c4X2HU2v4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984718, "uuid": "bbfe3cbb-fc6e-4fc9-aa4c-9988e9647fa0", "value": 559632, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984718, "uuid": "e0daf831-8607-4f7f-b818-a4f9b3edb135", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984718, "uuid": "4581b7a6-30bd-4dbc-86d3-74be3f74b689", "value": "DHL_DELIVERY_CONFIRMATION_CBJ0017032021068506.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48ef850-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Arechclient2)", "timestamp": 1615969259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969259, "uuid": "ca3a5f1f-dfb0-4d9d-b7ca-cfca0d42f28a", "comment": "Malware payload (Arechclient2)", "value": "64be5264f3a58325446865be38c05b34", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969259, "uuid": "e152544e-de03-4036-bcf8-625d079a26e3", "comment": "Malware payload (Arechclient2)", "value": "561a8b830e902a0ba18457a0aa8db8a8c663de8ee33e6009f236cedff00f8cbb", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969259, "uuid": "9befb46d-4cc5-4973-aec7-b24c51a43458", "comment": "Malware payload (Arechclient2)", "value": "fdbad9468075747a4999b7b30fa7cb7b60fdcb4e", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969259, "uuid": "3997db75-97f9-4f6b-afe3-503562e6d57e", "comment": "Malware payload (Arechclient2)", "value": "b28bf51b899ea5fb7a94da541b72ceb63be737704f0e0abfa0ebd2c9fc0e830271fad68ddd3cf487f4a1d400c882919d", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969259, "uuid": "39b19333-233d-403d-9579-05ece8479756", "value": "016512514693A632C4AA22325D11B351D5F5CFE80B0813A7EAC5F02B7FB33E1DA2C9D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969259, "uuid": "8e17d9c3-e765-4387-8932-0ae4e9a80bef", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969259, "uuid": "ee8bac7b-6729-44c8-b603-5f8de15b60a2", "value": "24576:Z53uhF9SQLLqzkUQrRjlOYvsiEP+tsDirDlmLrgH4tN96yk8ISOm1w+p6njCph5r:Z5+hFsQLLqAllIqsDirDlAOUw+4852Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969259, "uuid": "5a07aa1f-339a-4d0f-ac0b-20cf7c5d6979", "value": 1462950, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969259, "uuid": "2f34d149-56e9-4ff9-9163-ef1c8b354068", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969259, "uuid": "cd78abf4-cdd3-4a63-8d47-4cc47b8d5585", "value": "64be5264f3a58325446865be38c05b34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c37fa20-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010450, "uuid": "3b02dad1-faca-4130-89aa-9679de20c9cf", "comment": "Malware payload (Dridex)", "value": "b87c046f2475f9d386e943fdc3e6ce82", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010450, "uuid": "b13d3103-d733-46ef-85d8-9df0c665d50c", "comment": "Malware payload (Dridex)", "value": "5628a42e01f447f875f83b409ef182980f7f74295ec832e322323723babd11d3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010450, "uuid": "9ea7a872-c61d-4c27-ae81-cb41e152b128", "comment": "Malware payload (Dridex)", "value": "6182b9797bc7814a0e457da4e2919626f426f6f2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010450, "uuid": "267fb542-c373-4ff8-bb33-9dac5155cca0", "comment": "Malware payload (Dridex)", "value": "ae3de83c0eec55b836bc60e1f6d4ed47607486b04a40928ada3f218d55e09e65ed2366d078f0802256fe1de0f35ad852", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010450, "uuid": "b99c0ce2-110a-4810-a932-db2fcc6b930b", "value": "6224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010450, "uuid": "de89a102-d3e7-4029-b3ab-daed93fdd9f7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010450, "uuid": "5da6b410-a626-414f-8218-0ef2fb2dff54", "value": "3072:A9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:A9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010450, "uuid": "fba01c61-a70d-4509-a1b8-c29e085bcafc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010450, "uuid": "69380e72-45dd-4cea-9878-a2df62682aee", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010450, "uuid": "1783e3f6-4857-439e-871e-3ccce506001c", "value": "5628a42e01f447f875f83b409ef182980f7f74295ec832e322323723babd11d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2544b582-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010251, "uuid": "7b086d6c-1a71-482d-bfd4-7a7831ea40a5", "comment": "Malware payload (Dridex)", "value": "57d2201362c5d181980286b4421a61eb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010251, "uuid": "ded2e43d-e5d6-4161-859f-3e930c4a08e3", "comment": "Malware payload (Dridex)", "value": "564bc7ec180f2af7905cebc25e44996f190e2648d855bae953a43f15009f4fbf", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010251, "uuid": "a4f81575-d6d8-4d95-bbc5-e2faf8df5166", "comment": "Malware payload (Dridex)", "value": "08bf71263d9c35dc17512913aee478c21da0ab34", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010251, "uuid": "b0f08502-5ff7-48b3-b017-80f29a172c36", "comment": "Malware payload (Dridex)", "value": "34f596f3ea31ceb1ed1d5fc93feefdb64ec120c49ebfb1afb03c3f1753f73e592fdd5cc16d42d35b502482cbf85ab3ae", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010251, "uuid": "30af9884-cff2-4bbb-b44e-3fa9e85c8361", "value": "3124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010251, "uuid": "bb88caf9-8f40-4282-b6a7-17022540f28f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010251, "uuid": "dcc208ea-75ee-4da0-85b0-8175c721c6a8", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010251, "uuid": "cf978ec8-733c-486c-8a04-19f3a61d1b98", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010251, "uuid": "af068650-f763-42d4-b702-489805da5c5d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010251, "uuid": "d2f88ecf-15c3-4985-ac96-be6e96643900", "value": "564bc7ec180f2af7905cebc25e44996f190e2648d855bae953a43f15009f4fbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c512037-8761-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013833, "uuid": "eb9ae491-3d39-43d7-9b07-d75aabb05d64", "comment": "Malware payload (Dridex)", "value": "5b4a1abbd12f4091d81dbc876e7f7f9f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013833, "uuid": "c7cd3e43-fe17-4662-88e7-1a2a2567489a", "comment": "Malware payload (Dridex)", "value": "566072a117742042c57aae794556b9f553e081f4ca5f1121328679cfce7c900a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013833, "uuid": "3c80694d-084d-4ff8-8ef1-b00daa7d4f31", "comment": "Malware payload (Dridex)", "value": "3791374dabc30e4d9a4d720a8ce53e6e93f62277", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013833, "uuid": "dd24c04c-72f7-4ca3-abd2-5ff46c88f9bc", "comment": "Malware payload (Dridex)", "value": "f8626a1b1ff6849ea2078a0fd97203bd808ef6e2900ba38fefa1ee462acedf9e6199325b1180b1b77d832ecdca0d5e53", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013833, "uuid": "bc2e693e-f4fb-4d61-b0fb-81a888e39ef8", "value": "6124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013833, "uuid": "ccb5ca15-c882-474f-8492-288976b5d49d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013833, "uuid": "c90355fc-dc12-4cbd-af93-690f5290d816", "value": "3072:oF9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:U9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013833, "uuid": "00d4ada8-def2-42a0-9a82-c522fa1c1542", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013833, "uuid": "e5886ef8-b46c-48cc-9397-1a41521bac22", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013833, "uuid": "69154459-e01d-49cf-af0b-ca3c32d0d472", "value": "566072a117742042c57aae794556b9f553e081f4ca5f1121328679cfce7c900a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8db607d-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004110, "uuid": "9ee2828c-394f-4261-acf9-ebbcd9819c21", "comment": "Malware payload (Dridex)", "value": "b4f8637d673b98cb0c766db068c671a8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004110, "uuid": "291bd4dd-87d8-406b-9c4c-c42ec213216f", "comment": "Malware payload (Dridex)", "value": "566d7712ec89b27de00fc715539ff65da32f493ff227d35bbf140f8e9f5f4eeb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004110, "uuid": "c525e36d-83b3-4765-8a23-f24050a0f163", "comment": "Malware payload (Dridex)", "value": "6e38598a4fbeed7fae162d9c5012f92f706d6c2b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004110, "uuid": "3b83239c-704e-46d3-932e-2c618daab3a8", "comment": "Malware payload (Dridex)", "value": "7196ff094c8ecacce5a476d16a2568ca3c32ab2d5215256c14540402b5317b203d4b48a332442a261e3b1512e8d41dcd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004110, "uuid": "a65b526d-611c-4e78-b756-3d77c8faa50f", "value": "3424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004110, "uuid": "d18d2942-5e3b-4d10-b650-cc69ee56e928", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004110, "uuid": "07891a0e-acd0-40dc-895f-9d22edf394ae", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004110, "uuid": "562ac02c-3c00-4f0d-927d-44af28b5a968", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004110, "uuid": "0a9eac7b-8326-4505-8487-373560f3b227", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004110, "uuid": "3f9d0bed-fe10-4a9b-ace5-a709c555ab3f", "value": "566d7712ec89b27de00fc715539ff65da32f493ff227d35bbf140f8e9f5f4eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cace215e-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004515, "uuid": "763eb93d-00d0-49e9-a1bc-ad6541157c5d", "comment": "Malware payload (Dridex)", "value": "bd560ae8b35f149f8c6f3c3f9f7be6e0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004515, "uuid": "f5386b51-9fb0-43ac-9239-d8383fa11ca1", "comment": "Malware payload (Dridex)", "value": "56e1e0108c1b8d129872ddb2a591d5916b5ec8efe79aa4709a3b82eabdc8e44d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004515, "uuid": "2f06e41e-25d9-421f-87c0-8bf863f47edf", "comment": "Malware payload (Dridex)", "value": "2c14dc244d7969e202d07d638764f3a17988104a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004515, "uuid": "9ea178d4-7c11-4c51-bcab-ef56c0f46a93", "comment": "Malware payload (Dridex)", "value": "81cbb672bc921c380ab615d67e1d293bb2214adca0c31fa64a2ef634e8619bfec2a80aacd38ed870c2a4ceb2f72e83a9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004515, "uuid": "98918376-a131-4245-a7c9-9a82cff97eb4", "value": "4A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004515, "uuid": "c0a2facc-ad2c-400a-b389-a0a2d034a918", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004515, "uuid": "9a134220-98ea-4c99-beb2-4c0617859338", "value": "3072:z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004515, "uuid": "dc6a6441-4ae3-46f5-aadb-a97c7e521550", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004515, "uuid": "9d5aa7ed-0fc5-4799-9b78-29b7e00638e6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004515, "uuid": "839a7e50-133f-4cef-9f93-d7c0fed5b32b", "value": "56e1e0108c1b8d129872ddb2a591d5916b5ec8efe79aa4709a3b82eabdc8e44d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca11913-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615969488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969488, "uuid": "a594cd50-2631-46f7-a2ae-e7c85a4d04e6", "comment": "Malware payload (Dridex)", "value": "8210503bef39ca77e60ae1b66d51a369", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969488, "uuid": "ef1b9002-fc39-4e60-b859-f3f20937df94", "comment": "Malware payload (Dridex)", "value": "570f10b1c889294bee74959b007de2ab99f61d9b577a1a090ddd528c37640cf1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969488, "uuid": "02ec0a18-5b95-4e0e-9597-c794feba76f6", "comment": "Malware payload (Dridex)", "value": "f65ae7caf2f874fc82c0a8b32c421dc5f0bdfaa6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969488, "uuid": "78bc422b-2e90-4375-8543-240fa6531aa4", "comment": "Malware payload (Dridex)", "value": "b416bc55c3a5bc5fb6ea4fe99cdb21697b9b8e8084e4ac2f519580fed2ece99784959dcc68024258bc1e48494f5ec11b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969488, "uuid": "e734693b-3e43-4d52-9939-2423106fd9fe", "value": "7D14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969488, "uuid": "745c0f04-a2ac-48fd-9d54-2c7120b4c7f2", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969488, "uuid": "d0d8e1d0-6f76-481e-8b64-3f99191192c1", "value": "3072:I1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:0i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969488, "uuid": "7279700a-3098-4649-b783-a6df4e3c1a63", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969488, "uuid": "bdf3129b-42fb-4746-94b1-936af89d9695", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969488, "uuid": "c22908f5-e699-460f-a128-014f161baabd", "value": "570f10b1c889294bee74959b007de2ab99f61d9b577a1a090ddd528c37640cf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9513cbbf-86ff-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615971784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971784, "uuid": "5dc6f525-280f-499b-b715-43a19b4e53fe", "comment": "Malware payload", "value": "f7654c89280576ab9fab7ead130b28a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971784, "uuid": "c3c84332-703f-47cd-a83a-e5b61de0e4c8", "comment": "Malware payload", "value": "57984a5cbc5c741c46caca055114dd98a33a55db69c42eead7d84392e8779f41", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971784, "uuid": "7793213c-1ca5-4840-8eac-c5f5b8250782", "comment": "Malware payload", "value": "11c6d2e30deaae56d25a57150537a1d746522dd1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971784, "uuid": "a3a915fd-32d3-446b-8e16-7a1b8343a2d5", "comment": "Malware payload", "value": "12b142a71c120cc1c3a2f8d59d05bcbf2c5e289a87495e8ada0abdef083791fb29c4d6ebe07e15822d6036862d7e314d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971784, "uuid": "b96cf262-2d74-4ca2-9117-2ea888d4d2e0", "value": "D875012943381B56E13D13319CA2652403A59C1932F2D7FDBED5BC983ABB35486F21BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971784, "uuid": "8ca8eec1-f877-48c7-8c29-4f5c907b5b43", "value": "24576:Nazck3c4Ry4VPa4TAb332Rj6p3sjaKg6k4U2Vo:Ae4U4Ba9zoji8vxU2Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615971784, "uuid": "8140236e-c5d4-485f-973e-08ef6bae98ee", "value": 1638400, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615971784, "uuid": "1931fbf1-dafd-40d7-8bec-536eb6c63d2a", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971784, "uuid": "2134040b-dbdd-402c-af63-3e4c15341c7f", "value": "IMG_539000464453890800033.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c3d1e7-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "eb757bb7-7c1a-49e9-88ca-9e3b4d24ac36", "comment": "Malware payload (Dridex)", "value": "a15b0d78a1185019b252d5ecfa40ad81", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "54bf507d-a61d-4d1b-ae64-e7b1905dc6f2", "comment": "Malware payload (Dridex)", "value": "579e752ea2a57484abe415cffa1e8d4aa4ef5290e7b8589ec14a725cc2d24009", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "9abfce37-bc11-4e5e-a6fb-a28ac9b0f29a", "comment": "Malware payload (Dridex)", "value": "03b3b0aa1560ffea4a798928aeadd658fc4ce2c0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "713b9f76-6b5d-4f0d-b1cf-8422eb7cd7ec", "comment": "Malware payload (Dridex)", "value": "a3da093c614650a7d59b4690dd3805e15ad6fcab0a2ee1495138dd94aa97f03ef6fc0c60e55cb04b56104d1a37865b41", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "9d12c9fd-4ef0-49c3-8e38-d424037692de", "value": "FD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "591e0dbb-d81d-41a9-9d3d-75f09ee94a71", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "b3d705c5-62f0-49ef-a1d6-ac12fae73160", "value": "3072:K9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:K9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003839, "uuid": "4505c379-ffab-4520-9e13-35104de587c8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003839, "uuid": "ff25586c-fb9f-488b-98f8-bc9111791d97", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "00c3b8c7-bb88-4f79-b839-4e02bd911c82", "value": "579e752ea2a57484abe415cffa1e8d4aa4ef5290e7b8589ec14a725cc2d24009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50718144-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003451, "uuid": "44b5546d-a701-4571-8283-cd4014dec017", "comment": "Malware payload (Dridex)", "value": "8d27f534a34f34803cb137b773759580", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003451, "uuid": "f7786e92-d512-4097-a59d-95553a9826f8", "comment": "Malware payload (Dridex)", "value": "588055fef2c8f56da18a97485d133af4e3c37ce81afac7a8794fe11ec22cf664", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003451, "uuid": "e17b0f60-268d-42c8-aea0-55ca53340559", "comment": "Malware payload (Dridex)", "value": "b2a2124609134d686de2eaa60ab570acfcf11fbd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003451, "uuid": "d6a4212e-baa9-4216-be9b-21d2a9c491c7", "comment": "Malware payload (Dridex)", "value": "47665da9dd48a10d8bb24acca187cc8d2ef3abb48de0153146ad35caa06a0bf80e9421c48d2bcd66a6b36192489fb597", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003451, "uuid": "d7e1e43f-6743-4cec-bb28-83a08851820c", "value": "F724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003451, "uuid": "2ecd4388-e0e8-468a-a765-1359259a681e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003451, "uuid": "3282102e-1d3b-4148-8a72-8fa9d5cd924f", "value": "3072:W9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:W9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003451, "uuid": "da1f2ab6-218b-4298-ba0f-bf0645b94073", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003451, "uuid": "340da343-abb8-47cf-ba81-52aa8066237f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003451, "uuid": "49c9d009-3ee0-4b8f-81dc-4ab95a056758", "value": "588055fef2c8f56da18a97485d133af4e3c37ce81afac7a8794fe11ec22cf664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0b7908-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005132, "uuid": "011e1fa9-01b1-4090-bf43-11c103a9991d", "comment": "Malware payload (Dridex)", "value": "df2afba513f2843e35ca8b2412bf8f7f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005132, "uuid": "762fa3c9-50ce-4f4d-8c00-30f438b70663", "comment": "Malware payload (Dridex)", "value": "5884af190b9332a69e7e0fb4a242eee98e75813c961933deccd0eee025499050", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005132, "uuid": "33446806-c06a-4c0e-94f6-45c5fde10496", "comment": "Malware payload (Dridex)", "value": "279661d6f49457e394b77704800ed7ac0f7df270", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005132, "uuid": "68c5ffa3-bf0c-41df-8344-c7c85df7a578", "comment": "Malware payload (Dridex)", "value": "4d184cccdae519bd00e86d34455775dbde86e77fa4a77e30459d350540ee370da14a8f549ca3c8bf4996510c211cbd95", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005132, "uuid": "9aa03462-b76b-45d7-8814-1c603cc22a62", "value": "0324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005132, "uuid": "8a94ad82-6776-4918-ad56-1abbcd704412", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005132, "uuid": "103c7338-1ade-4c2b-b7e1-8cb3c0447042", "value": "3072:N9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:N9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005132, "uuid": "5cd21fcb-d0d7-49c2-8f36-2680592764d3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005132, "uuid": "2e3be796-653b-422f-bebb-79d9cf18b587", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005132, "uuid": "1bf24ec5-a996-4091-b64e-5e7baf02a545", "value": "5884af190b9332a69e7e0fb4a242eee98e75813c961933deccd0eee025499050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a48c7a1-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003844, "uuid": "f6e9999b-bced-4fce-8389-7f6108b2e362", "comment": "Malware payload (Dridex)", "value": "9a7c7dc5bdf8be8017041e9e96e77a1b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003844, "uuid": "ba5f007b-2f67-4ac8-8c96-677cd74c214a", "comment": "Malware payload (Dridex)", "value": "5888ee0095e35c518e7331bc08abd2e28ce2b531e2469d43f32752bd9e1f7967", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003844, "uuid": "36594eef-6283-4e64-82ad-e8c2d4f67130", "comment": "Malware payload (Dridex)", "value": "1bb36cad2547181590e777383edc616d916b9b26", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003844, "uuid": "212f8e93-105a-444e-ace4-9cfe9dd82633", "comment": "Malware payload (Dridex)", "value": "d141fe9295748117090aa4d09a07cb88dfba48f03cb83bb81925253ea54af041acc401b2dab5a9387d4a047deaa2194d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003844, "uuid": "e6021405-6c4b-401e-bca5-82e188a366b9", "value": "9424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003844, "uuid": "705b89c8-9f5d-4199-93da-1a77269a0e23", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003844, "uuid": "d91874e9-c79c-4b40-90b6-4ae85163d604", "value": "3072:s9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:s9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003844, "uuid": "0e30a82a-6659-4adf-b37a-ce132abd56d1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003844, "uuid": "40442506-9a02-4621-9a57-d60d695a827d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003844, "uuid": "e36f98b4-b497-4a43-a2da-50bac2fec501", "value": "5888ee0095e35c518e7331bc08abd2e28ce2b531e2469d43f32752bd9e1f7967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63539cc3-8757-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009496, "uuid": "3f1106ea-d224-4983-9a54-1316113e5c40", "comment": "Malware payload (Dridex)", "value": "474b019170e540bdbabfd936608ae296", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009496, "uuid": "f4f0a0f2-0b86-45a3-be03-ebd69b57956d", "comment": "Malware payload (Dridex)", "value": "588dd57ab1383e8f606d43fb7f95c03cbb42f770c07abbf77962000a86ff66b8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009496, "uuid": "90f85c9a-67a8-4b5b-89e2-72f25ac9975f", "comment": "Malware payload (Dridex)", "value": "5da9531c684d004b03f6dff806ba66d1de3ca97d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009496, "uuid": "78a49ff6-287b-45f2-a0e5-b9c4d236da35", "comment": "Malware payload (Dridex)", "value": "ee8ef3509ef981d23e2b748aa64094ed90055b433f293cd155d16d76907e1ddbdf35130a1410fbaa8d0d2a0ab1c7e6c6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009496, "uuid": "18f00f79-7424-446f-bf52-f0d70224c09a", "value": "D724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009496, "uuid": "0ec1e572-7031-449a-b257-45ad0098d931", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009496, "uuid": "5eaec1d3-6599-4125-ba80-0e3b0044e6c5", "value": "3072:W9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:W9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009496, "uuid": "fa75b9bd-c74b-4b7f-b831-41304899c7e2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009496, "uuid": "21b09ed0-23f1-4c28-8dac-ef035e87fcf3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009496, "uuid": "d5efda18-86ab-4304-8312-d62babd0c1a8", "value": "588dd57ab1383e8f606d43fb7f95c03cbb42f770c07abbf77962000a86ff66b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cf19a9-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003703, "uuid": "1ba30f19-1d0e-4f51-ac40-d228f7cc66a5", "comment": "Malware payload (Dridex)", "value": "ecc76e33e0803192757812f83b1a63fb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003703, "uuid": "4ed3d51a-ece6-4264-813d-b85adc55df89", "comment": "Malware payload (Dridex)", "value": "58be5703ea3166a8b16db2f1b5e7ed33d5919f9b7b63e091eeb8ca01f6ee5a9b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003703, "uuid": "4abb3c5e-c3d6-444a-a4d0-79b006483d20", "comment": "Malware payload (Dridex)", "value": "053d76708e8b62c866ed711ba7dcfec587e4ea7b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003703, "uuid": "e4c9f35b-688d-434c-8c92-915c2bb33da7", "comment": "Malware payload (Dridex)", "value": "54559109ceb0f1dcdba10b3039e70064214db8b96aaa0406cee11fac3c346cc29aea5c01637f840a7a28356d499e1eb0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003703, "uuid": "48c60994-d07e-478a-bea6-19111a7c05de", "value": "4A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003703, "uuid": "58c27a5c-fb27-4c91-a3b6-74b8e186171b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003703, "uuid": "6b51b5de-7b7a-40e4-b0e0-15836c4ce495", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003703, "uuid": "749a8582-3a8b-48b6-9fcd-a9d11973becb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003703, "uuid": "9f74b9a3-92d3-4a33-bfb0-24ef2bd9ff4b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003703, "uuid": "9829ca45-803c-4ea3-9efe-01295707eabf", "value": "58be5703ea3166a8b16db2f1b5e7ed33d5919f9b7b63e091eeb8ca01f6ee5a9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724dfae8-8752-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007373, "uuid": "314d94d2-06dc-4723-a8c5-e2399c6d762a", "comment": "Malware payload (Dridex)", "value": "26ff304dee265b38113153640a22c471", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007373, "uuid": "5d40ea09-a92b-44f4-8e9d-8f73bada1e70", "comment": "Malware payload (Dridex)", "value": "59321e807de75f2a9541d39b44df95add24778f3870ffca2954a4dcfc2692f70", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007373, "uuid": "e7b48159-33bc-4760-a774-aece60dfe296", "comment": "Malware payload (Dridex)", "value": "854acc30057479ae19eea271603b15804b3ec83c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007373, "uuid": "3d7ad927-6b3e-43c8-8404-1c3dfd841ff4", "comment": "Malware payload (Dridex)", "value": "9cc28a2f5adf46e342ee4f5fa58eadd3ee6b6ea43d951a55c2911818c96d036ab755923e80c277009da239910f2ff216", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007373, "uuid": "da8f4d3f-7485-42f0-acff-67a3ebb06958", "value": "DB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007373, "uuid": "8ea36e05-51ca-4e28-91f2-6be5bc9c0a5d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007373, "uuid": "e2cc5ca7-3dc5-41cc-a849-14e15b2c9219", "value": "3072:k9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:k9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007373, "uuid": "394c9710-eb24-4d63-a82d-809c00378a21", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007373, "uuid": "34333a17-0183-411f-bf3e-4b731a2d4a08", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007373, "uuid": "bef0f59f-8cfd-4a9d-8e2c-24c9ae129c12", "value": "59321e807de75f2a9541d39b44df95add24778f3870ffca2954a4dcfc2692f70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a559bdd3-86eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1615963221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963221, "uuid": "d21837b2-0d72-4539-a395-8e56b88ecc5c", "comment": "Malware payload (SnakeKeylogger)", "value": "e61a08656923dfc5eea355f2d63db3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963221, "uuid": "b260db4c-11c1-425d-b593-2b0f51a2ffe7", "comment": "Malware payload (SnakeKeylogger)", "value": "596333128235cdde25fdcf5d2346202f54fa0af9028549512d6317d95283f861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963221, "uuid": "4cd3ec32-d59b-4c11-9ae3-4c29816df3a1", "comment": "Malware payload (SnakeKeylogger)", "value": "9024899abd4fb2db14f071ca1e084cf7bd434abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963221, "uuid": "df2387dc-bdbd-4d1e-a4b3-3b43702f62d7", "comment": "Malware payload (SnakeKeylogger)", "value": "5f3b1c65f8652f1798938e09e84694aabf09312571454fee36297cb50011332ac14d8d77b02070406479ae421fc36b47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963221, "uuid": "fd6cf913-0769-4486-b530-cb50aff4776b", "value": "A4D572C5B628F1B4A38FDAEDACF6495434C2C95EB16E51DA36C4238A1C01B17C2FBB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963221, "uuid": "96fc5759-640c-4ad8-9715-66261329f23c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963221, "uuid": "749efce6-93a2-4896-b5f7-011af91ddd51", "value": "24576:8j+028mcqWWrWWe4rEVJNawmNuWGdyEV4YVHn5X:8j+03mCWr6VNaK+3YVZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615963221, "uuid": "96c939e6-62ea-4ce3-82c0-cc3b4f26f70e", "value": 2754560, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615963221, "uuid": "71be6434-74fe-486d-90b7-04bcf5e5d89a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963221, "uuid": "ffb39997-7389-4805-bc0f-06106476245b", "value": "34007#40FT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6303efd3-874f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006059, "uuid": "5c48f537-1634-42c8-add6-c3a30f0cfa67", "comment": "Malware payload (Dridex)", "value": "40ddf04e20751b9c5cf21eb5f941e74b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006059, "uuid": "e9be16c1-e120-4f0d-af08-ea7b6b5f90c1", "comment": "Malware payload (Dridex)", "value": "5970893f9049aba04035145495d4b752b64d3d0cdc987392b12560e9ff7dbfec", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006059, "uuid": "93247232-d2a4-4e1c-9bd1-76d29040100b", "comment": "Malware payload (Dridex)", "value": "b54916f75379c238a6a14cfc39e99599b5b17076", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006059, "uuid": "463b37d7-c6ad-4773-85f4-5d74a1106147", "comment": "Malware payload (Dridex)", "value": "b951d86b2fd10617d0241ba63133aac90b58663c06b7e75f99c3fec03a13be8c3726c547520bbeb2514e0af46c62b012", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006059, "uuid": "9bfc567d-de41-4757-832e-9d133fbdc773", "value": "9B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006059, "uuid": "ca002a10-262f-47e4-969b-c962aad9b1d2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006059, "uuid": "ac776af4-fe0b-4e7f-8cb5-f30b9828a5d7", "value": "3072:K9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:K9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006059, "uuid": "95346992-347e-423e-9944-0b580407f94a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006059, "uuid": "e89bf344-2873-45a1-b382-916b3654e870", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006059, "uuid": "1261ccb9-9bb5-432a-ab61-8ed5ae63281a", "value": "5970893f9049aba04035145495d4b752b64d3d0cdc987392b12560e9ff7dbfec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec23c62-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001757, "uuid": "98165d8b-0427-4e52-81f8-81f91ec41e3e", "comment": "Malware payload (Dridex)", "value": "6fa752e8903f1246a02786dc689db8de", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001757, "uuid": "073cda5f-e421-45cb-8fae-7b4ef5255edd", "comment": "Malware payload (Dridex)", "value": "5a79445a4af9d86f2ebc4bf49373902d51ac720ea41fafa280731d1ad133b398", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001757, "uuid": "1c36cf82-5fad-4cd8-b0ce-c00d8f2ce8c1", "comment": "Malware payload (Dridex)", "value": "10eba116ad4c27c56490c89847190d9fba04ea7e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001757, "uuid": "3b201b7b-1825-4a46-ab4c-d9e4866fc613", "comment": "Malware payload (Dridex)", "value": "d553350e42da148b31afc358aa2ac93d8516090e50f93c20a6d514817a53d6c7f6fa4fd66c794e1ab23ae65aaf93b7b8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001757, "uuid": "ba8f1441-2ce7-49e0-a8e1-072269d83d76", "value": "7724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001757, "uuid": "72054e91-941d-4304-8055-aa259fb26a20", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001757, "uuid": "7a29d4da-c057-40b1-ad3c-401992541842", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001757, "uuid": "932e41f5-09f3-4c17-98df-d2e5249cb568", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001757, "uuid": "ec40f275-1132-4216-9fb8-0461c73100f1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001757, "uuid": "4ce1302e-d02b-4f9a-8753-a1606b6e92ee", "value": "5a79445a4af9d86f2ebc4bf49373902d51ac720ea41fafa280731d1ad133b398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699c98ea-871e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615985025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985025, "uuid": "cda99ac7-525f-42f4-aa04-809f61df416f", "comment": "Malware payload (Formbook)", "value": "5f50303a0a62ff1269c5b5347b11119b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985025, "uuid": "86fdc955-be24-482b-9702-915d926c2d2a", "comment": "Malware payload (Formbook)", "value": "5a865b8edb83f6a2a367af5b1cd56be61013d05cb316016cd5c517440e9cac83", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985025, "uuid": "9beb943f-2ccb-4074-b9e7-ad54c9fbfeb5", "comment": "Malware payload (Formbook)", "value": "e46aad4617300f4403790dea65a33c3f5317b6be", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615985025, "uuid": "46ed5ee8-257e-4c63-a748-bb4da074e2d9", "comment": "Malware payload (Formbook)", "value": "2d0409e5d38b8216aa62de934e8368af84c80f03da5c5eb6215b002cab645a89970ca1ce348bde4fa8b54cce6c90fcd5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985025, "uuid": "c66db30b-6932-4ccf-8c9c-aecef292ce55", "value": "A10533B506A90A6B8F112795C3C9BC0F947F696B6BBB543C3905F0CBB8DD6FC4082944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985025, "uuid": "7de5ceab-ef51-4144-8475-be59654d851f", "value": "12288:in79v4p8iIoybRWK+Xyesj4ldohWv7GhIfQdyb6LKkpqw6dzN:ip4DjyAK+XyepbpvlQybaKkZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615985025, "uuid": "b5c2eb8d-cf8a-46fa-b0de-e5efbbb4710e", "value": 806189, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615985025, "uuid": "401498d9-a13b-4e4f-89f6-fdf326f1ba26", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615985025, "uuid": "c9ce5f26-1eb5-41d5-ae27-aee467d0f9dc", "value": "Shipping Docs_Original BL, Invoice & Packing List.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afeef7c9-8763-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616014778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014778, "uuid": "327e7f19-4c62-45fd-be5a-3f4aa5ed3265", "comment": "Malware payload", "value": "bcf9b54b4fc8b7811f2411c4a88c4b22", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014778, "uuid": "4537fdfa-164d-45bb-9522-6501354ac9d7", "comment": "Malware payload", "value": "5aa6c291a37489f03fa2c55650e4aa4200d7a5dda2fe0cdb20695e6a264064d9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014778, "uuid": "1496f4e4-b2c9-4475-a28d-2cd6f7befe32", "comment": "Malware payload", "value": "70766fcc6706e83d314a6b885b37bdb4b9558982", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014778, "uuid": "a1a27821-0634-4b2c-982a-c77d8ed35f37", "comment": "Malware payload", "value": "c507ec7360e2d21ecbbf57e2419592109e2ee741be13a4973db015a6acad673c64d86c40598437f61b45dba01ea303e9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014778, "uuid": "91d95bc6-8c33-4661-bbb7-1d26d6b6d9dd", "value": "A224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014778, "uuid": "920d1e8a-bcfd-42e0-a135-fbe0688cf4cb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014778, "uuid": "ec94dd11-b44e-426e-8406-922604d85ef2", "value": "3072:W9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:W9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014778, "uuid": "25c9be7a-7ec9-4abc-85c3-10994e2f0c05", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014778, "uuid": "46c1d740-3667-4b61-822d-c4101308fdf9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014778, "uuid": "9280b31a-341c-4e7d-9a1f-30c6f508e36f", "value": "5aa6c291a37489f03fa2c55650e4aa4200d7a5dda2fe0cdb20695e6a264064d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5ca050-876a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017569, "uuid": "9101c124-daf6-46ac-b1f9-6cd82700f7ac", "comment": "Malware payload", "value": "9e72c184f8895fd16090ef3d7ad2f526", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017569, "uuid": "adf4b8df-f1c9-4877-856a-664065c68c9e", "comment": "Malware payload", "value": "5ab2ce4aca287c888fa6a81a3b418df814998ae5f946f1f42eab2e62adf3a49b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017569, "uuid": "a7836921-beac-46a8-a34d-1deadb07188c", "comment": "Malware payload", "value": "a4de45ac7275bf210db7a2b3e32af089ebfe98c1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017569, "uuid": "57a2087f-51ef-4a21-8958-1ff921a4041e", "comment": "Malware payload", "value": "d433b0cc450f4b511095764064286ce2435c71372cfd8cd6107b4b67528063b19176b12381441e2e4de21a1aadcf7b20", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017569, "uuid": "b803324b-918d-483f-b238-03ec5f72c258", "value": "1824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017569, "uuid": "8d2767de-5c90-48f7-ac22-9e7e3e13604b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017569, "uuid": "ae8c5cac-7c12-485a-ab63-465616305d88", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017569, "uuid": "79db0e4a-3fc9-4223-95b1-c343d41e269c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017569, "uuid": "52ec1f54-cf65-413a-9c1b-2065066e91e4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017569, "uuid": "36d99c7b-d7aa-491b-832c-ba4928d81fc1", "value": "5ab2ce4aca287c888fa6a81a3b418df814998ae5f946f1f42eab2e62adf3a49b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3010d953-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010269, "uuid": "9d3f92b0-2ef8-41f7-82dd-d495d07018ac", "comment": "Malware payload (Dridex)", "value": "a99cf5224313f8606faf545a44aa2f05", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010269, "uuid": "801a3b10-47f1-4840-bfae-247a39f280aa", "comment": "Malware payload (Dridex)", "value": "5bb488e531e32d75fbc3800fec7d8a067256c233ac8d0d6b09b1902799d74b43", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010269, "uuid": "5b5d4370-b306-4041-9472-bcd32d54d8bf", "comment": "Malware payload (Dridex)", "value": "5bbd9730993164941008e347f600212ed1f72451", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010269, "uuid": "f9ba41b2-c2e9-405b-a48a-ece3eda1d7e1", "comment": "Malware payload (Dridex)", "value": "c9ec9825f4e8eedd52449f991cb153ce875c55ae65e01d113769ef0fe1c1cd71143947594b567b70a23a28a581d034f7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010269, "uuid": "aeee75d7-d056-4671-93a7-5100a2a5ba49", "value": "8F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010269, "uuid": "3fd78415-9368-45df-95f2-387148124edb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010269, "uuid": "4dcd83b8-1393-454f-aeb3-3413140f3ccb", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010269, "uuid": "eae42c2b-afca-4551-8db4-070a2c37044a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010269, "uuid": "ccb653c5-9630-4516-ab91-f954fe2eada4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010269, "uuid": "3d49ae7d-47d1-4be6-860c-507e19a65f80", "value": "5bb488e531e32d75fbc3800fec7d8a067256c233ac8d0d6b09b1902799d74b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7fd983-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003736, "uuid": "6c783ddb-592b-4718-b1b4-f532a640ea83", "comment": "Malware payload (Dridex)", "value": "ccc442066c5da21118c648b90fb57077", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003736, "uuid": "5c59b706-8f9d-4b2a-ae37-c4a14e8793b4", "comment": "Malware payload (Dridex)", "value": "5bc7332d966447b994a7cc9a5bc8e58135dcb2bdd6b30d56c85ee963aa54b46a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003736, "uuid": "9025787f-aced-4ab4-82d4-fb965730ad78", "comment": "Malware payload (Dridex)", "value": "93773285eb551b09580eaca784d752e70122ef58", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003736, "uuid": "5f6d05d4-b92e-47c8-92a2-896d369bd4c0", "comment": "Malware payload (Dridex)", "value": "56d23960aa13c35c421e4b202ad8ef562f1548b4375d1c40793a19ecd931c4d8da5b1e11cfbf3e5ed603b82bad92fea3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003736, "uuid": "a050f264-a4d3-4bad-bfb4-6eaa50ab9771", "value": "BC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003736, "uuid": "47f84fc5-2994-46f6-8beb-b5bc2d1977e8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003736, "uuid": "cac9f96d-f918-4a3b-ac66-60234dc19094", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003736, "uuid": "94d22b90-04b6-4078-b78f-3550b7d42893", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003736, "uuid": "9a8c4bbd-731b-41df-b333-0e589861791c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003736, "uuid": "633d9022-fe4c-45a1-9723-70510fa90469", "value": "5bc7332d966447b994a7cc9a5bc8e58135dcb2bdd6b30d56c85ee963aa54b46a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a6c2ea-8747-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616002844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002844, "uuid": "ce0ed8ca-ffba-4ce8-a6da-b9de01e129f6", "comment": "Malware payload (Dridex)", "value": "5d17bdd34cf8789bc54a97c827b9fd92", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002844, "uuid": "1d440ea0-732c-4d7a-899d-248e1e64f6a5", "comment": "Malware payload (Dridex)", "value": "5c47fd26c9b5f84dded1b604bb229e147392ad18a9d1539d4f920eab3c1c1dec", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002844, "uuid": "30d6cb40-3949-452d-9f52-5542303b4bb7", "comment": "Malware payload (Dridex)", "value": "15f0ed59a523e959c16ef7bc5ac57abc03daa64b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002844, "uuid": "1171947e-f439-4d2d-aafc-936aeff20688", "comment": "Malware payload (Dridex)", "value": "f820217dcee9c5e445c4c270c0debc0f57e276e53b099c2280a1d4e9a5f9f6818c2532fd31a84caca131a5b31000663a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002844, "uuid": "60251a60-c618-425d-a64f-5c54d25df426", "value": "DF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002844, "uuid": "bb85e909-2e1a-490a-9926-ea9b305dc588", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002844, "uuid": "364c59a7-3066-4a61-b50c-a86cdd98e030", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002844, "uuid": "a302f226-e347-4161-8782-5d7d1b1b6323", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002844, "uuid": "697ee4b8-3f7b-424f-aed3-c36c55c2f75d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002844, "uuid": "96777c26-4487-422b-8fc3-a80ea6c5a6d4", "value": "5c47fd26c9b5f84dded1b604bb229e147392ad18a9d1539d4f920eab3c1c1dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47e9849-86e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615961985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615961985, "uuid": "106f16e8-3c4c-4cc8-9e19-12f41b565d49", "comment": "Malware payload (RemcosRAT)", "value": "330cede082b4cb2b742b77f4f11a2979", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615961985, "uuid": "67b1383c-517d-4e3e-ac7a-944247627f60", "comment": "Malware payload (RemcosRAT)", "value": "5ce8fbb2506d901c97bc2f7f1eafc6f02b7ad14e4b39ffd17fa76db0530e020e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615961985, "uuid": "0579a26e-7828-481f-80f6-c442b1fece46", "comment": "Malware payload (RemcosRAT)", "value": "78e028ec37ab2ad3b0971220815dddbd3302f629", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615961985, "uuid": "a465f11f-b1cf-4e89-ad42-05720e4e75fe", "comment": "Malware payload (RemcosRAT)", "value": "e0894f1dd1df089db5799b9da75121372e6017c95e75121f9322f741712162066766e719b24017556393cb693415885d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615961985, "uuid": "1d21c791-07db-474b-ae41-1e4b49f4c54e", "value": "CCA4AEB876047CE67A6F576BDA96BCDD03B626239ACB94CD4064B7C305A3335EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615961985, "uuid": "6f3c1019-34ff-4a87-b670-d4ddd3259f54", "value": "12288:+55AWFCVbFkMRZs7J1UYOZKWBSeKPARs8wzHgWDFHz2ehzN:UAIC9FkMRaN0cQ3S8wzHDFHz1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615961985, "uuid": "44df939e-72ef-4b95-a0ae-f846c22977c5", "value": 470394, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615961985, "uuid": "da83c0a0-97d9-446d-8602-88d9f6d2396a", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615961985, "uuid": "d05a827b-3be8-40a0-9d5c-887394d9f573", "value": "2021 RFQ Products Required.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb19177-86bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (RanzyLocker)", "timestamp": 1615942778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615942778, "uuid": "5e863c78-30fb-444a-a4ed-d98c216c18b3", "comment": "Malware payload (RanzyLocker)", "value": "00e4808514cc401027e426b128182991", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RanzyLocker", "colour": "#537C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615942778, "uuid": "95139f69-6979-440c-82c4-44dcf4e72f99", "comment": "Malware payload (RanzyLocker)", "value": "5d0af3bf0dc7d99fc87d844a0fcd99796b9257ba02d78510422c498d445f0d0d", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RanzyLocker", "colour": "#537C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615942778, "uuid": "e77b4c38-da05-490c-8e80-a56fa3b04875", "comment": "Malware payload (RanzyLocker)", "value": "f2131e3bddda9bf52f4c3a52547bf7c93960f66a", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RanzyLocker", "colour": "#537C32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615942778, "uuid": "020fed25-5c18-4b80-bb21-5a1376080d95", "comment": "Malware payload (RanzyLocker)", "value": "61c0bdf4791f2e091b54f59517a00e23de796dd29e3504c09fe6eb3b92313612f6891054df6fc68cde673c235f675a02", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "RanzyLocker", "colour": "#537C32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615942778, "uuid": "0f7d9987-04a7-4e4c-b700-e31cc51312fc", "value": "41D37D5071C0C4B1E576493285E8A6A7AA7DF9300F618F6B33E40B2E1F785D09A35DEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615942778, "uuid": "6e5e1205-46ba-47df-a65b-888e297b1f5a", "value": "65f731597048104980e8041a141b37d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615942778, "uuid": "dabfddee-1c06-4bbd-aa1e-48f628d4b2bd", "value": "3072:1ZO75plD368W/5SeiLHpV3IhzfW+3g70XdlqgDuYUB/vemeeCLmJLV:1C5px3HW/3iLHpV4hzu+jd7uYU5JeST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615942778, "uuid": "b67ebacd-4bf8-4533-8573-7f279c4fc453", "value": 141312, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615942778, "uuid": "7ede80be-4aaa-4085-b6ac-37f859b92e19", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615942778, "uuid": "418f09df-695b-4a28-b7ed-1dac05b61934", "value": "5d0af3bf0dc7d99fc87d844a0fcd99796b9257ba02d78510422c498d445f0d0d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbae2f8-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003443, "uuid": "fa0b7261-db76-4d6d-8a3f-0bab311fd0f2", "comment": "Malware payload (Dridex)", "value": "15d104d0966b271c541f13cca70d062b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003443, "uuid": "bb5f8c5f-b05d-464a-9c29-afa5d34ce4cb", "comment": "Malware payload (Dridex)", "value": "5d30b0df71b909022e0da888e3e0354bb601f77fad3092eca7d64297ce524881", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003443, "uuid": "31c558bf-dc8f-4fd6-803f-991075d6938a", "comment": "Malware payload (Dridex)", "value": "5996cf79a6e121e3ad678bc08f5ab095590b07bd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003443, "uuid": "c8a91fa8-9a75-4011-a2e2-97266bdcf279", "comment": "Malware payload (Dridex)", "value": "aea9310eaf153b33808043e1b572a4b463361ab2aad6aeb1bf7a188396899df8e90b56af61d45cf90633ca31901bae53", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003443, "uuid": "cf8548fb-a525-49ab-8135-e437d609a4bd", "value": "0224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003443, "uuid": "b417c207-c898-4f2a-9645-a34cdf4454c7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003443, "uuid": "d457ec68-2cd9-45f9-81b0-ad2c1a746995", "value": "3072:/9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:/9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003443, "uuid": "f322563a-798c-4eed-a14f-602ff2addcc5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003443, "uuid": "9dd96837-5e3e-4a3a-a230-311f60c4beed", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003443, "uuid": "82c1001c-d0b9-458b-bb1a-1891328bca22", "value": "5d30b0df71b909022e0da888e3e0354bb601f77fad3092eca7d64297ce524881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7433f90e-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003941, "uuid": "d66aa88e-83a0-465a-b5be-a45059d286ae", "comment": "Malware payload (Dridex)", "value": "8b7865103d2960aedc5013dd4cd1bda3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003941, "uuid": "2766cf36-2e8f-4b3e-99c6-9e77278d4dc1", "comment": "Malware payload (Dridex)", "value": "5da1125a718b4e9d32710c5ab9ae93998511150f63e9968b7090257757257aed", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003941, "uuid": "b67c0f84-5edd-405c-84c8-8401e47a1057", "comment": "Malware payload (Dridex)", "value": "17933efabd184cfdbb7de27844b2e390979b05ad", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003941, "uuid": "9a1fa669-f3b2-43fa-838f-b4c4afcf89a4", "comment": "Malware payload (Dridex)", "value": "a937914d73c49a2e84cea9f33b9d63303254fc3d8d54142561111db07fdbcf4488e7c960fe79c168b158c96438e7203c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003941, "uuid": "d574f5c1-4791-4514-815a-f2a9b3a04768", "value": "D024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003941, "uuid": "58938b70-e3c7-4a2b-b9d3-3face2352cd8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003941, "uuid": "3dc0bd8b-12ec-4190-b2f8-5c760c57dd18", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003941, "uuid": "36bd26d9-b50e-4410-ac15-5cbc85e62971", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003941, "uuid": "c9edf349-18dd-421e-89d2-8305fe8dc73b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003941, "uuid": "ec5427a8-502b-448f-baf1-8292afdb19c5", "value": "5da1125a718b4e9d32710c5ab9ae93998511150f63e9968b7090257757257aed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bb4c9d-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003858, "uuid": "0de7a142-b229-46bf-98ec-c5456eeedf68", "comment": "Malware payload (Dridex)", "value": "98ecc757a8eee8fe306ee0ca6534f28c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003858, "uuid": "01349078-0e7e-4eab-b402-e81fafeb59e5", "comment": "Malware payload (Dridex)", "value": "5dbd4ad99021cfe603603c0a007b508cb4c65b0d451faa9e6caba92703a916d1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003858, "uuid": "c9503257-3984-4833-9cbd-aeac46fca384", "comment": "Malware payload (Dridex)", "value": "d76d5a885b159167e270c503f1c9e3eca77cd799", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003858, "uuid": "99397eb1-da88-42bb-9aa0-b66c33f8dee0", "comment": "Malware payload (Dridex)", "value": "afbccd8ba2eb14444ac047c84f358b2b59ff52b0b0a4600da498d5e164d0d2ddd49f1bfcdcaa7acd325178e1c339894e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003858, "uuid": "8377d010-be6d-498f-8c44-3ea6a4d77ee1", "value": "6824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003858, "uuid": "fb9e2a5e-2f49-443b-9439-cc51eba6bde4", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003858, "uuid": "20514afb-7117-4ded-96ce-1c7281be1165", "value": "3072:A9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:A9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003858, "uuid": "2f9a4d0d-b851-4d2c-b992-7194a65bb899", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003858, "uuid": "f5be6f42-4b80-4160-8008-0927c768eb1b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003858, "uuid": "2196fadf-12a3-4f97-ba50-8b5982e0f05d", "value": "5dbd4ad99021cfe603603c0a007b508cb4c65b0d451faa9e6caba92703a916d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fed68cf-86f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615966111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966111, "uuid": "4872424e-381d-4bba-8c4a-6a740b7d26c2", "comment": "Malware payload", "value": "ac0b99228647c4be42cabdae9fa0f8a5", "object_relation": "md5", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966111, "uuid": "d99f8b80-09a0-4fb3-8932-0d75c3e7b0d5", "comment": "Malware payload", "value": "5dbf7507ae75cbd25993ae3b073890cb0a58082d1d5c2e0bb016196f0c7ffaca", "object_relation": "sha256", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966111, "uuid": "c7f9f42a-07d6-4351-973c-e3688c78c8ba", "comment": "Malware payload", "value": "55374aca729f354f3c06ca2b98bad7a4c7b315ab", "object_relation": "sha1", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966111, "uuid": "c18afbf7-c4ca-4d0d-8741-8aed8a6d3f67", "comment": "Malware payload", "value": "c58c9f98eb13c2cc37a04dafc13b052a3bb34ef44cb80c9da54c39f8088225b669e69dd2e45e5be738d0101cec8989f8", "object_relation": "sha3-384", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966111, "uuid": "bce7ab30-feeb-4ceb-b369-7191a5c7afec", "value": "5DB3F10EE7155CADC239B07FA704A8F4A94DB251A853E50B2428FF0965E99E30BDF1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966111, "uuid": "826026c3-5134-49fe-aac7-12571af54e65", "value": "3072:+xOYPvsUtFARPULAZemMA5uAgz3xQGarRVnfdCTTWH:+YMFAeErgzBQG6VnfdYCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615966111, "uuid": "11bec5ee-bb1e-4df5-9f98-fffcde1360c0", "value": 116315, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615966111, "uuid": "f6a1c698-5b5f-4e82-abc5-3f4060438df2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966111, "uuid": "5d1e46e4-7f86-4602-bb25-1cb925abeb67", "value": "5dbf7507ae75cbd25993ae3b073890cb0a58082d1d5c2e0bb016196f0c7ffaca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60410c4-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615968403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968403, "uuid": "abcd6a70-0005-4076-a18c-b241da6f9d28", "comment": "Malware payload (RemcosRAT)", "value": "b8a6a0c01050d17721d00b94ad68979e", "object_relation": "md5", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968403, "uuid": "1ca4846e-3f55-40f7-b1f4-60b4808952c8", "comment": "Malware payload (RemcosRAT)", "value": "5e0fe09b76750751f25ee170f4e3f5d3de441614a887316e3a62334d859b769c", "object_relation": "sha256", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968403, "uuid": "ecd3d515-cebc-47e0-b3a7-c4668ef11da5", "comment": "Malware payload (RemcosRAT)", "value": "da0b4360345ba491e8d4ef3251a8f93bced9636b", "object_relation": "sha1", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968403, "uuid": "2d7f1842-838a-4ff2-a279-d96f8a3e5465", "comment": "Malware payload (RemcosRAT)", "value": "cf605cf92628e552f803586dc918774d5a342c53ebc8b6df9b4a478ad53bf063f450290613216a8ce82ed46fdc89e872", "object_relation": "sha3-384", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968403, "uuid": "9806fed4-19b7-4478-a384-b82e98ae36e2", "value": "05655BAD321071EEC857E472DE581CB4EB603DBB835B1117946336A9DABC887CF644B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968403, "uuid": "73ffa536-c0d0-4ede-a963-3345f9caef76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968403, "uuid": "eed4bd57-a9bd-4f88-a308-5b43392fc077", "value": "24576:M9OtXKn5weQrUBhLe5cFNBAwR3ERsmyhP0:I5+zUB5FXA0EOmym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968403, "uuid": "67418f98-081b-4253-993e-9c360bcd63cd", "value": 1418240, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968403, "uuid": "69234560-09e8-4dc4-b4c6-bd431a8e29f2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968403, "uuid": "99e115ae-fade-4c04-8333-10e9b9b30949", "value": "5e0fe09b76750751f25ee170f4e3f5d3de441614a887316e3a62334d859b769c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39122ae-874e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005738, "uuid": "5ad11ad7-5684-4bc8-94bc-51b8a068f027", "comment": "Malware payload (Dridex)", "value": "c50d2dbf9da9011e3162ca35efd2f611", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005738, "uuid": "07818e9a-05c4-49fd-9d18-5d541208f949", "comment": "Malware payload (Dridex)", "value": "5e262a0967a90dbb68c13f8d2a127ca6e5aa1f4de94cc16b7415839e1fa9d138", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005738, "uuid": "068936e3-4e17-49ba-a56c-73d845e2586f", "comment": "Malware payload (Dridex)", "value": "97202a490d8dc4dc5f926bc81d33f109a4dfb905", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005738, "uuid": "1216b5b9-297a-4b9e-90cc-557cc342dcac", "comment": "Malware payload (Dridex)", "value": "47ca8835cd11b31c4e96a64d680987cf6fd979b51cee22be831da6e3d727d76e71363c137883548943c9467e90573e32", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005738, "uuid": "c0152158-4720-49ab-918a-634739ef23e6", "value": "5724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005738, "uuid": "65c1ecb6-c609-4fd7-9458-5b8de0c637cc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005738, "uuid": "3ebb83ea-55fe-49b5-94b7-e2a252a72681", "value": "3072:Q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005738, "uuid": "77906977-dac6-4586-a12a-4afb422d4525", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005738, "uuid": "2ab20e32-698c-4865-b27f-b474bc86f9b1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005738, "uuid": "14a30c9d-7bcb-48a1-aae6-f098580caaff", "value": "5e262a0967a90dbb68c13f8d2a127ca6e5aa1f4de94cc16b7415839e1fa9d138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25f7f56-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004099, "uuid": "c2a08966-c40e-4645-bf1c-e087aea325ec", "comment": "Malware payload (Dridex)", "value": "302a3e6d5ad1bd09f5538cd1dc1ae417", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004099, "uuid": "7f3ab026-06ae-4a15-bfd7-a8b4af8b7b02", "comment": "Malware payload (Dridex)", "value": "5e4f2bfd0d57b46c9c06131f4cf467902869170abe978551c4c86f25650506e7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004099, "uuid": "6cafb9d0-0dae-4430-bcd9-6ae99bb7c7a8", "comment": "Malware payload (Dridex)", "value": "c53f8ef95120f45643f215f11ab4cd193b75ee08", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004099, "uuid": "6e7b78cd-0542-4dfd-8078-b87dfc205b2b", "comment": "Malware payload (Dridex)", "value": "c3bde12657ba63cbc12451ba8db55ac2044976f808404a7b37db002f2eee8cfa46f7febec5a075d65b174a541749e387", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004099, "uuid": "7ed2361a-237a-45f5-937c-297aa526bdf4", "value": "9A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004099, "uuid": "2f81222a-a288-44ad-a933-24bc00df4280", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004099, "uuid": "f2acc72a-4d41-4cdf-9d3e-b1ebeea36d4c", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004099, "uuid": "b56f1ed5-34ab-40b5-805c-e4f12257d8ae", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004099, "uuid": "c68fb872-c35b-4e85-8d56-03064021f322", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004099, "uuid": "27a267a2-d34f-467b-a9e2-86271279f640", "value": "5e4f2bfd0d57b46c9c06131f4cf467902869170abe978551c4c86f25650506e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617b8b76-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001762, "uuid": "adb2b651-b172-4f8e-b6c6-7f5e1a85fdb2", "comment": "Malware payload (Dridex)", "value": "27d936ae4837cb1d0d52210737268d2d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001762, "uuid": "6bf72ee5-c9aa-4e23-8426-14a326e05b18", "comment": "Malware payload (Dridex)", "value": "5e664e5439ea5a5849e65e271e6406ca483ffe80447b4360fcc1b8d40113dddc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001762, "uuid": "c782920b-6f64-42cb-bfe9-f871d9c0b873", "comment": "Malware payload (Dridex)", "value": "bf2692baf65e01525ca8e785cae25d3d917e9fdf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001762, "uuid": "37669030-10e4-41f0-8586-4aba911321c8", "comment": "Malware payload (Dridex)", "value": "17e84dcfbfa22975d34a6c9470815e3fad8cfca8f569b1440b699c6cc6a3044fb863b2c3ca755536be0e2de83893805a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001762, "uuid": "8e432cd2-7c18-4edb-ba53-752804e61f10", "value": "6224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001762, "uuid": "16441b1c-013c-4619-9994-1077cef9d815", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001762, "uuid": "308835a9-878b-4125-951b-a358f46a2a74", "value": "3072:y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001762, "uuid": "6575048a-4c35-46ab-8a76-13a7b03ea1eb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001762, "uuid": "d4197904-dae7-4cc6-a51e-0e3b3d5d8c51", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001762, "uuid": "caf000f7-bbe7-4a2f-bbea-fef441cb02c5", "value": "5e664e5439ea5a5849e65e271e6406ca483ffe80447b4360fcc1b8d40113dddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28bcd933-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008109, "uuid": "a2875852-7841-4c47-9237-685c4b70f630", "comment": "Malware payload (Dridex)", "value": "359a4f3edf7b04cb7cf58126056e55f5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008109, "uuid": "2defe00e-bb99-4e87-933e-168c2dcf293e", "comment": "Malware payload (Dridex)", "value": "5eb9c2cd05b9ae21b68969a686517f3d6d969e0cb4a3880eefa570c7aa8da854", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008109, "uuid": "0b26611e-0259-4699-bbb3-265444973576", "comment": "Malware payload (Dridex)", "value": "26ed96481c8423643cbca0574940950e2843f679", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008109, "uuid": "fca637cd-f5b4-498e-bd71-54bcbfa163cb", "comment": "Malware payload (Dridex)", "value": "723d331173453f4312514ef94165c87f45fdc0ee1d3d8db90700712ce52d371d7309a6be0e3639cb1c5ca655344d7324", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008109, "uuid": "4eca286c-c09b-459a-a3af-97f65242a785", "value": "DD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008109, "uuid": "0afe2760-c44b-4608-aaef-61913b53e7d8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008109, "uuid": "60276de4-1bdf-4ff0-9c3c-db3de404f595", "value": "3072:J9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:J9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008109, "uuid": "713514be-f169-43ef-8b83-aadf0d181f8f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008109, "uuid": "5024ea11-3966-450c-861a-76d7f3fb7018", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008109, "uuid": "b60e1e74-f6a1-4d27-9f84-9d505ef12778", "value": "5eb9c2cd05b9ae21b68969a686517f3d6d969e0cb4a3880eefa570c7aa8da854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5adbbef3-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004328, "uuid": "5a50aa39-fe38-405f-be96-5e0f8e306e54", "comment": "Malware payload (Dridex)", "value": "4da087243c0f6f8adb9381ca35dd00ef", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004328, "uuid": "9f224422-77b5-41aa-be1f-76b84883e4d0", "comment": "Malware payload (Dridex)", "value": "5f6cbfec8ff8b0d7d89d17760436428a2519924217d51aeefda1300ec3672486", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004328, "uuid": "f73b6172-b1f9-4642-aa3e-f0e6ded3ecd7", "comment": "Malware payload (Dridex)", "value": "cc4b56798f130b977386e48bad0849dafe4420ab", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004328, "uuid": "e04fd52f-4299-473e-82e5-1bdcf56bd144", "comment": "Malware payload (Dridex)", "value": "62cd58cb3a14ab458f2fe77b69afc89bcdd1d2050c4502d4f543dc02d7ba90b5b2f4a12626dcfc1fca66156852e8ec00", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004328, "uuid": "8a0b2088-1da8-49ed-b3ee-0f8f25f67de1", "value": "1224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004328, "uuid": "df16631b-55e0-4678-8890-ef2a4706b4b1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004328, "uuid": "326ff7bb-c268-4376-92e6-652fada9a571", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004328, "uuid": "e1c822ab-75d3-4dd7-8293-cb2fa51f6499", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004328, "uuid": "6348d555-467d-476e-bcf6-a653f9e39e64", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004328, "uuid": "84c0594d-478a-4fb1-97e0-eed2e19d4fb0", "value": "5f6cbfec8ff8b0d7d89d17760436428a2519924217d51aeefda1300ec3672486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715926a9-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003936, "uuid": "e1ddb34e-0e20-47a8-9f70-47b84b254f09", "comment": "Malware payload (Dridex)", "value": "15e78cd9640f2daeb8931963061371ee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003936, "uuid": "0e244f3c-dd92-4e2e-b56a-ea96a2ba66ba", "comment": "Malware payload (Dridex)", "value": "5f892a9c90bb10694e9dd5a640341c7c61cc1d0ace9e9a461cbf2a3c385bc1f5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003936, "uuid": "e0d4a15e-83e5-4524-a335-4ded1aa9c082", "comment": "Malware payload (Dridex)", "value": "0227d7fe7a696d440974f198508cc96f8b5153e3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003936, "uuid": "22d0587e-cbbb-46c0-a50b-67785c109eda", "comment": "Malware payload (Dridex)", "value": "9abcab3af068a4b974978bd20806bc4dc4d9041836333becbb9c55128a93e3629ca5f0d884ae1ddbe65c133bd838b40a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003936, "uuid": "87da4394-5e82-42e9-affd-1477d456e1cd", "value": "5624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003936, "uuid": "304554ab-ff3d-4fee-9fdd-221622942771", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003936, "uuid": "26912f93-d12b-41d4-b1fe-382921c13cf0", "value": "3072:K9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:K9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003936, "uuid": "8aad257d-2836-43ac-9728-f97f8815f1ce", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003936, "uuid": "1f42cfda-8561-4de6-80c6-f23c738885a9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003936, "uuid": "8caeef72-352a-4765-9dc3-978ab9ff03e7", "value": "5f892a9c90bb10694e9dd5a640341c7c61cc1d0ace9e9a461cbf2a3c385bc1f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6fb86c-86eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615963310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963310, "uuid": "5152f1ca-701b-4596-a5d6-874f56ffb836", "comment": "Malware payload (AgentTesla)", "value": "4645828f50c3bca5f322ad70b061b2ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963310, "uuid": "268d997c-1180-485d-bf03-f94eab1c3bb1", "comment": "Malware payload (AgentTesla)", "value": "5f9a10a2caebb78a305800c2fd28d3a4a9387a5415df54fbfebf26e2150997a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963310, "uuid": "48f47d90-50e6-42e5-9f92-47ae194d55e7", "comment": "Malware payload (AgentTesla)", "value": "324e34efab25cc6e05044b9bb6425dc9e38e617d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963310, "uuid": "a6483bbd-8b88-46dd-95a1-2323de669815", "comment": "Malware payload (AgentTesla)", "value": "f7126f77928a2649006e6c5e910cc2d72d5b984374831840f5d4b5485f3aff09c59ee75845701b0f64c85a26f9618e96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963310, "uuid": "7b5eb766-0cb6-482c-9417-30cf113c860c", "value": "C4C4015223B47B25E07817B50C7D56011BF2FA4AE7B3C7BEAD92B0C90562704EAF1636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963310, "uuid": "dc6f93d6-831d-4266-ad0f-ce64f23e8bb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963310, "uuid": "a9725eeb-9a9f-4baf-9cd0-4f8bb0c4bb51", "value": "12288:ck1Wp6NruG9Qg7k6hCHoK7m83GwY+B82VP:c4WoNKGt9hCHo2m1h+BrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615963310, "uuid": "0d284a5a-15c2-42b1-bf61-51d278e003a9", "value": 569344, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615963310, "uuid": "59156e5a-f6db-4284-9412-e349e1796455", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963310, "uuid": "2e3f200c-5f89-4a39-be47-16c2066aa267", "value": "Purchase Order #17032021688776587757865776-pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99ba876-86f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615965456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965456, "uuid": "2f1fb15a-f917-4572-866c-2135278eb7ab", "comment": "Malware payload (Loki)", "value": "a7b79f6cddea985530f47a2afb106e14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965456, "uuid": "f0f5baa0-ab9e-4b5b-b426-be405bf22b2c", "comment": "Malware payload (Loki)", "value": "5fa77a1c81a699223dd25f2aba643b88deb29f8da5e2654b0e405f90f1918abf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965456, "uuid": "eff2539b-f032-493d-bd70-16df4412ddf0", "comment": "Malware payload (Loki)", "value": "7cd0519dc6701bdf10c085b5b60d7690c65b8107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965456, "uuid": "d2c9dd82-b2a9-42b3-9caa-abbe30880d77", "comment": "Malware payload (Loki)", "value": "30864fa10ab9a44d26b7e70157bc77632204f1a81bee5e40a91c97b5aaf204690a28f07bad82d2063ce79610fd0942ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965456, "uuid": "6cd293c6-8a7e-42c1-905e-64422d1721dd", "value": "97D4ADD26740A664D4A7027A883B9AA36473A50D9D79C53E2C91FF4F3CB234A407787F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965456, "uuid": "79e4a2d4-20f8-4206-9c27-7daf21330ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965456, "uuid": "13054755-9958-4882-aa9b-985cc075e8ba", "value": "12288:bIz1B1AoOo7AGSRnf3XBBQN7DAtE1rdAA:bIxBGGStnwxuYhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965456, "uuid": "9a1c4ceb-0ff6-42a7-8a72-53f03f4d7181", "value": 624640, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965456, "uuid": "d4af2390-5935-423f-b5da-8aa7341990bd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965456, "uuid": "dc1df50f-c4a6-4255-b394-b49a81c806b2", "value": "a7b79f6cddea985530f47a2afb106e14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9d51ff-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003819, "uuid": "9d97db8c-8376-42b4-b778-9812e7612ce8", "comment": "Malware payload (Dridex)", "value": "2722751d0ff16e55bb060e8ef13d7df0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003819, "uuid": "e7fb0f87-2882-4849-b81b-c9c7442872f5", "comment": "Malware payload (Dridex)", "value": "60230ba3a3cd20a7207479f369147528bbc5369d8b3bd4245ba1080f20505a81", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003819, "uuid": "178c9986-bfbd-4d5c-b3c0-6452a3137c2a", "comment": "Malware payload (Dridex)", "value": "d22abf5df122fd117723d2ec57720db83d164ea0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003819, "uuid": "3757cea2-ba68-499e-8c89-7febb38c8ab1", "comment": "Malware payload (Dridex)", "value": "ecd2fcc463c0f4c3f7082a65bb5db8b056385dcf1dab4629cb41e893ce409d3f30f6d77f19bff4d928098ff974b6cc02", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003819, "uuid": "c09c7e7d-0d21-4024-9c82-d5370eb52214", "value": "E124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003819, "uuid": "d1ac981a-a6cc-45f9-9cbe-11863e3cb059", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003819, "uuid": "54395c84-cc99-4d43-a18a-be6fa797df4b", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003819, "uuid": "c39f1424-b6e0-4db5-9c39-59ddfbeb0754", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003819, "uuid": "a3860ec4-3506-4d32-889e-7c60a6b48e98", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003819, "uuid": "ee51c6d7-f63f-44d3-bcef-a3b7fd8508f4", "value": "60230ba3a3cd20a7207479f369147528bbc5369d8b3bd4245ba1080f20505a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed24615a-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003714, "uuid": "f1fea4d9-cf41-4272-aac7-34a69553d39d", "comment": "Malware payload (Dridex)", "value": "69c671a908817483a60f39a6e19b5520", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003714, "uuid": "9e3b5e8e-2e45-407a-9b48-1287bac91c16", "comment": "Malware payload (Dridex)", "value": "616a212c6edce642217ee04caf3ddb196a0ad1319227102ae2f5c94a4e777039", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003714, "uuid": "f070b7f5-71aa-4a37-8629-cd7ab5a0e528", "comment": "Malware payload (Dridex)", "value": "e303ab54d08d73d59204d089acba2d3435158b09", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003714, "uuid": "d38b08e6-db6a-4546-b642-9f1f25db031f", "comment": "Malware payload (Dridex)", "value": "4448aaf4f097dfaa76a72e7ac8789dd42091b4cc1ff3199b8bc37be3a2f67fb7125fe40dc3f2c2a6abf0046fcb708d1a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003714, "uuid": "0fc5a954-c468-419d-9724-1e52c7663491", "value": "4924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003714, "uuid": "3a62f67c-dbff-45e0-8e1a-bc661f2a7182", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003714, "uuid": "454aeb98-d33f-4d6b-b8a1-3b0cc61637a5", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003714, "uuid": "387bc74f-27df-40c7-bd8d-45f19d8696aa", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003714, "uuid": "6cefd7b1-8fe7-4a1d-bf71-4c5865e0852e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003714, "uuid": "2217c90e-96e2-4097-9582-a6787d4e6c10", "value": "616a212c6edce642217ee04caf3ddb196a0ad1319227102ae2f5c94a4e777039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c9de3b-870d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1615977843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977843, "uuid": "caf7d65e-a3e0-4e7c-bc22-7c7065318c76", "comment": "Malware payload (Smoke Loader)", "value": "1bf3028a0b65a4174a66f3677e872026", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977843, "uuid": "99c12757-2465-4780-8089-026b01583dab", "comment": "Malware payload (Smoke Loader)", "value": "619393d5caf08cf12e3e447e71b139a064978216122e40f769ac8838a7edfca4", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977843, "uuid": "3f6935ee-99f9-487c-b0f9-d36caa9c040b", "comment": "Malware payload (Smoke Loader)", "value": "1e33b01f84a96b93cdded1d23fdb1b7f6f58a077", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977843, "uuid": "5f3ba503-74f9-4910-be29-09e946c80d7d", "comment": "Malware payload (Smoke Loader)", "value": "48d0e06887c1eb5cdaa0add7a94571be7d71582adcc3b4a89977473c4ec036c30052d0332629c5d9d45f7501574cbbce", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977843, "uuid": "6d017870-f4b4-4364-8fc9-09cdbcb4318b", "value": "56D4127370E36171CC43853571851A68AA52B812C7CEDB5E23E25D58CAE6F409B2FACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977843, "uuid": "b96e50fa-fb16-424b-b363-00f78d5407d0", "value": "4e8e4d8a3da06a604f10a17bf079b7ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977843, "uuid": "86c059de-4c8e-4620-a080-b7acaaf63b62", "value": "12288:nTcqwHtDnDnP5qLKRKd7LE8M/vBD4pa1OWxd1Ysblvd6Q3kW7743kG1isitWi:nTcqwHtDnDnP5qLKRKBL3uvd4TWf1Ys3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615977843, "uuid": "84f84691-537a-48e9-bfbd-92bfd9b12b8f", "value": 635904, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615977843, "uuid": "69aa1bac-c636-4712-ad4e-d615bfeed41f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977843, "uuid": "913eb85c-ffcc-4a4c-b12c-262df51dbcde", "value": "SecuriteInfo.com.Variant.Ser.Zusy.3110.23624.2882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e743749f-876c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616018737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616018737, "uuid": "6c33cb34-9bc5-430e-9b8c-e69ea6492e5d", "comment": "Malware payload", "value": "cc9e718d6337392613908e4d446b742c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616018737, "uuid": "b51ed6f0-a965-4559-856d-a3c58524081e", "comment": "Malware payload", "value": "625a4a22770495f22ad58069b514987444abda546639014bf66e600117003c89", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616018737, "uuid": "228f10f4-5d37-4326-8a27-68e51de9bd0f", "comment": "Malware payload", "value": "f5612f69442181c9298015e22c9b179c98630ae8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616018737, "uuid": "6bc6d6d8-e548-40e0-9202-67063319646f", "comment": "Malware payload", "value": "9c5cd470bb26b6b259007a2c35c9b0baabfb679d488d029a19757cfd8603aff3e1b55871712284817a8ab543b2a64b3c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616018737, "uuid": "0cf7c96b-e466-4c81-9fc8-8fc7d2da6974", "value": "F614AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616018737, "uuid": "8638954e-e02d-477d-b69b-eae5cb5362f0", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616018737, "uuid": "88af1bc8-35c5-42a8-9149-1decbfbfeb74", "value": "3072:61i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ci78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616018737, "uuid": "37513624-b500-4c5f-af64-a3f6c9d39511", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616018737, "uuid": "13f0d7d0-67bb-435e-96ba-1bb4ad7a4db6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616018737, "uuid": "c052264b-477b-4e1a-9a7e-16cb49eba50f", "value": "625a4a22770495f22ad58069b514987444abda546639014bf66e600117003c89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f84462-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004375, "uuid": "2b473f2f-e552-4dcc-9c1f-625e7e413bb2", "comment": "Malware payload (Dridex)", "value": "04a6cf38064182cdd0ad232e28004a4e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004375, "uuid": "548b0fc2-3406-4d21-8897-58a2a4b491c6", "comment": "Malware payload (Dridex)", "value": "62b3f8533712ad1b5801c938b487b94af9ec8d05a928d262b8576b66226876f6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004375, "uuid": "af991014-500f-4e38-ace6-b625fef392e5", "comment": "Malware payload (Dridex)", "value": "ff1954cd92dd4b86731ef53e3f997d2baa6b8c7d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004375, "uuid": "1688af74-658b-47fb-89e7-7a59803d9551", "comment": "Malware payload (Dridex)", "value": "37f0079f59ebe5bd76cac3d81446d8413d1b9f4b95c40aef17f4b57b3eb9fbd1ce516e27387df008b8282f4704360b61", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004375, "uuid": "246650c5-5141-40e0-a3f7-91b9bce483de", "value": "8024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004375, "uuid": "3319dc01-3a91-407f-8c76-6574c4d5021e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004375, "uuid": "9a025316-5cd6-427c-bc8d-276ce7654922", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004375, "uuid": "eae5882d-66bd-42f5-b810-06c37bae9ce1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004375, "uuid": "b3636915-716f-49b4-a1a7-63e2132bf2e0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004375, "uuid": "438409e5-df06-4195-bc37-444b5603a318", "value": "62b3f8533712ad1b5801c938b487b94af9ec8d05a928d262b8576b66226876f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41d931d-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003726, "uuid": "7d367992-d222-48b1-ae32-8c25fb2b69de", "comment": "Malware payload (Dridex)", "value": "dcfc03e4f3d56a25a75054137ff8bda3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003726, "uuid": "f29f46c0-fe41-4493-a958-68704d77e618", "comment": "Malware payload (Dridex)", "value": "62eb077b662e12cebb41c024398e3eb6cb3b4f8d629aa15848a982650ede8986", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003726, "uuid": "377405c7-3c80-432a-bb5f-37eb3080854d", "comment": "Malware payload (Dridex)", "value": "81faf9275a2db2965e106895979fc2f4fab95ab8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003726, "uuid": "be2a4534-d2a3-472f-9771-0926137f115d", "comment": "Malware payload (Dridex)", "value": "3412354c1e6bdf6fd8460b7800a346ba3751cd026275b24a089c6bec319eced36a546457b3ca56784b2843ce5623af71", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003726, "uuid": "4cae5512-362b-40bc-90ff-8487a8a095f0", "value": "5724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003726, "uuid": "617cecc9-4f06-457c-94d3-67b8f72d35bc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003726, "uuid": "4748ec94-dd19-4c7e-99c9-8988a45d84c8", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003726, "uuid": "d8745676-3503-450f-b080-bde8678c28bc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003726, "uuid": "0413fc1a-b99a-41f3-8dea-d10d7cf7b113", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003726, "uuid": "24fb65a6-d8cd-4cd3-b9e7-6515c4ed87cd", "value": "62eb077b662e12cebb41c024398e3eb6cb3b4f8d629aa15848a982650ede8986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99df773d-8722-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615986824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986824, "uuid": "e91aca1a-9377-493a-a0d8-9852e5825576", "comment": "Malware payload (AgentTesla)", "value": "eccb4b199f2e094e059bab20d44e8e4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986824, "uuid": "127cb9da-ad25-4e87-8678-97b7e05e3592", "comment": "Malware payload (AgentTesla)", "value": "6319947a9646aee1e317a89a50c0d2a2984cd35269260ce6015f9172630b14f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986824, "uuid": "2f401229-56ff-4c10-ad1b-a099f2edc183", "comment": "Malware payload (AgentTesla)", "value": "9ce91e8776ca4108a9e5f9e9f9820925bbb91eb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986824, "uuid": "95a17831-5e1e-4bc1-9074-6bd817d4f8c9", "comment": "Malware payload (AgentTesla)", "value": "4793a11da7b2bb2ce1c1109b9012906665e20dd608d053307f3cf71fd6222d12a220e2023633456c616bb18c0c7599a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986824, "uuid": "fe06ddf0-e55d-4caf-985c-7ab6b0314e99", "value": "FE05BF027188BDD6E42316B35CBFD53011AAAD8D5175C53E3687BB2A05F335220BBA7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986824, "uuid": "c02515e6-bd84-4633-90c1-34d7b4a12eb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986824, "uuid": "d2427951-e929-452f-8882-0e47ee7884ec", "value": "12288:9Z1BMM5b6YEIoSQX5quo4pngHk9HgCmBrny/aJ1L1l917dy:dOwb6YKp7oInpgCmRy/UDnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615986824, "uuid": "c1ab1411-961d-4a88-9f39-8bf8afbc7b43", "value": 805376, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615986824, "uuid": "c8b29ec2-40d3-400e-97ef-f5260487a2df", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986824, "uuid": "7a0ea99c-f788-4faf-ab01-cfc91a380d2d", "value": "RFQ-P-17-6_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da15d51-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003044, "uuid": "9ec5e435-1f56-4b51-ae54-d3fcb20a6aef", "comment": "Malware payload (Dridex)", "value": "9e772a91af4c424d17916eaf830f8b7c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003044, "uuid": "1f12d987-da2c-4a87-94d5-96da000d4c04", "comment": "Malware payload (Dridex)", "value": "632617050a5ebbe66f5735ab5bc0011ae66f95868cf4e4f81cff9ef887c8b81c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003044, "uuid": "4956a3d6-903d-46de-8140-70cc7d28dfa6", "comment": "Malware payload (Dridex)", "value": "2137b7a24adf2768e08b1a780383a85db640fa5c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003044, "uuid": "82071a79-f114-4f9f-bd7f-325466f6590e", "comment": "Malware payload (Dridex)", "value": "ac43dd2cffcef53834aedb51a96c03edc2d35d974f40f1bb3ea901a82bf6daa635a341d1c7c227199548516f37db6b7c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003044, "uuid": "92b7a1c1-c739-47dd-b519-8f4c9d6651a5", "value": "F624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003044, "uuid": "32f643b5-d872-425a-aad2-5dbea2748317", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003044, "uuid": "36490b37-0532-4913-8665-ba88858acb02", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003044, "uuid": "6b56f0f5-05b5-4836-bc7d-d68ee346c6a0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003044, "uuid": "995357fc-6443-44dc-895b-2cd7296386ac", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003044, "uuid": "1a3439d0-9ce3-414c-b0ef-6c752c99e9b6", "value": "632617050a5ebbe66f5735ab5bc0011ae66f95868cf4e4f81cff9ef887c8b81c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169d7074-8753-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007649, "uuid": "546f2eb9-f0a3-4689-897b-92fb0142cfa3", "comment": "Malware payload (Dridex)", "value": "e525369dcf74be4decf431c0f20a9f8f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007649, "uuid": "51c57e01-efb9-455b-9332-1f096e7be1a2", "comment": "Malware payload (Dridex)", "value": "6354bf484bc081e0f524017c4ad1b50f858b612df87efa8afa1c055c04c5ea3b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007649, "uuid": "215914da-349c-4a21-855b-5cbc3d412e1f", "comment": "Malware payload (Dridex)", "value": "4ae28e0e01e7213dbfb7a23e4396a228c0c7a2cb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007649, "uuid": "632dd5b5-5e5f-4635-89b8-34f01ee97956", "comment": "Malware payload (Dridex)", "value": "510b28c4ab20ee57632922afb7bc2405be99a644236c029d48e67ece58966d0266620b85e53b60108c78f215866035c6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007649, "uuid": "cc21c506-4f44-48e3-8170-b0c0f83ebe72", "value": "FE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007649, "uuid": "7f255677-2624-4d6a-ac71-a1318f722d98", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007649, "uuid": "544ae3f6-53dc-45d4-9399-e50d9221bd6c", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007649, "uuid": "49a86476-6cb5-4672-80ed-6511c23f961c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007649, "uuid": "d7b67cca-cc78-4ae3-845f-35fc87038876", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007649, "uuid": "23b9fe4c-2b88-4bb5-8f7e-671eda5a0f9c", "value": "6354bf484bc081e0f524017c4ad1b50f858b612df87efa8afa1c055c04c5ea3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea967dfa-8747-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616002851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002851, "uuid": "bad17b0b-6449-4367-8726-2773d3abece0", "comment": "Malware payload (Dridex)", "value": "38c7bb5fb6619b7c0ab8afc6f277e3de", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002851, "uuid": "1573571d-d3a8-4307-ac79-88a5ab0ac732", "comment": "Malware payload (Dridex)", "value": "63bc6893fbc122b95645e1db6852961bf00a88b057a4bf840ebddc98a298763a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002851, "uuid": "eb77308e-f3c1-4938-b7b4-f548fcd504f1", "comment": "Malware payload (Dridex)", "value": "8b85ccf835f0b4226ddb2340407d917fbcdbc170", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002851, "uuid": "cb94e9f7-41ef-4830-bf64-d87805a29aef", "comment": "Malware payload (Dridex)", "value": "2c813e005928a14a45894d7a4ad80b1f3848809d5b2d817eb67d381eeb2bb001ff5b8fdc7d870540fc2b4b96471cfbe7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002851, "uuid": "cf6dbabb-be24-4c75-ae09-f477fbd5ae6d", "value": "C324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002851, "uuid": "d9bba30c-bb25-4f70-a84d-58f48ea1de0e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002851, "uuid": "cd5b7977-14b2-4123-afe5-f51daa701fd0", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002851, "uuid": "c81302be-8011-4c71-b7fe-69fb6b524152", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002851, "uuid": "ba3e0c96-89f9-4edb-a099-eaf510710779", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002851, "uuid": "d5d34446-8b45-4120-9a66-69be5f9b6509", "value": "63bc6893fbc122b95645e1db6852961bf00a88b057a4bf840ebddc98a298763a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e47b28-8758-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009852, "uuid": "3dfb68f4-9a94-4021-930e-d1ecec1dda86", "comment": "Malware payload (Dridex)", "value": "a25e99efbef24f7be9474cb90b6fc9dd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009852, "uuid": "0a55c3d4-c605-48a5-b9ec-f56bf8d20d77", "comment": "Malware payload (Dridex)", "value": "63dea58b6ec7d7e334acd500c3908000480be05430c1087c93f9565ea720924f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009852, "uuid": "80f8c253-df61-4bbb-94f0-f42e5f17898d", "comment": "Malware payload (Dridex)", "value": "c78222f73c21edbe06794896c18543b9e74aff34", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009852, "uuid": "6e9ab6ee-c72d-40b5-89ea-356e345c5d65", "comment": "Malware payload (Dridex)", "value": "2ac2cd0bf1b5ddb5bf3571b04750c9fe88b8c380d88ef9167c96538a3959388fc7c84d9262ce10a1ff3c739155f89928", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009852, "uuid": "28712f48-ecbf-48bc-840a-2b7d2e5b1434", "value": "E524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009852, "uuid": "5c94fe04-6ba5-4592-9ada-0eef8c48772d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009852, "uuid": "cb5cd9e8-55a4-4885-a921-9a398bad317f", "value": "3072:r9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:r9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009852, "uuid": "2f32ea3c-ceb3-40f5-8733-66fbd15e9b15", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009852, "uuid": "5ca4b7a2-2aa6-4ac6-a125-f6346047ed7c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009852, "uuid": "ec4e32bf-9e1c-449f-b7e0-7a072d7bbe77", "value": "63dea58b6ec7d7e334acd500c3908000480be05430c1087c93f9565ea720924f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e9cf54-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004556, "uuid": "ee29bfbc-1bfb-404b-9471-428f79672dee", "comment": "Malware payload (Dridex)", "value": "cb6e6fb42a2ec47e0e4845cfcbf5e412", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004556, "uuid": "0b7d5061-4fa1-45f8-8026-79e04465a756", "comment": "Malware payload (Dridex)", "value": "64125d8b7df338b2725cc8747b21e319bc3a98b49fc322e754869934dcc75ec2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004556, "uuid": "8ed37163-589c-4acb-83fd-cf3ca1ffe57a", "comment": "Malware payload (Dridex)", "value": "77c9b7b3c899cb2a82509c9311687cb3c2a21189", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004556, "uuid": "c7a91a10-702f-458b-9659-14baf6ad5238", "comment": "Malware payload (Dridex)", "value": "4c0cc1968ebf8246137f0fe8a0904035a40c2b7044141e1de3cb77cb8a470355ea11ed09ffd24ddef293b78496546fdc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004556, "uuid": "056d8ab7-0a2b-4607-a590-25fe6d4c3124", "value": "3024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004556, "uuid": "96ab847e-7a15-4c18-8e83-e272936e5053", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004556, "uuid": "6b69f82d-3715-4f72-9633-86ade9a25371", "value": "3072:J9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:J9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004556, "uuid": "b21bc8fd-6f86-4633-81bd-fe4ab87ebd76", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004556, "uuid": "2d1a8d96-e8ca-4e19-9eee-0c7a092286bc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004556, "uuid": "85c6959c-e6a1-467a-96d2-8dc34eb27c17", "value": "64125d8b7df338b2725cc8747b21e319bc3a98b49fc322e754869934dcc75ec2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1fdedf-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004548, "uuid": "8e2fe9fd-a493-4927-bace-21dd18fdedc9", "comment": "Malware payload (Dridex)", "value": "a852a2952499683f288a91095ef241ae", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004548, "uuid": "0c0f839b-08d9-48dd-b63b-44156f783684", "comment": "Malware payload (Dridex)", "value": "645debcf098e64d25b3f434285c9213a93675fbb538fb0abaca504411f35ecae", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004548, "uuid": "69504478-28ae-4805-b0fa-08215c47e512", "comment": "Malware payload (Dridex)", "value": "9924bc960700d2136dcdbb4b16631276beb4924c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004548, "uuid": "4e56b1a5-a89e-4b65-9895-9ed324245aee", "comment": "Malware payload (Dridex)", "value": "f9dfcfd96f29dd007f868e4321834ce3fb513fc0e0414818465ffd23355bf8e1450159822befe8e7db3ef255c7acca09", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004548, "uuid": "5e7015d1-beee-44d4-a4c4-8d79fc8e1359", "value": "0B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004548, "uuid": "f123c2c5-5e36-43e3-9c91-2fcbd88ede60", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004548, "uuid": "b6d88e6d-e613-4f37-8626-1fde73436cab", "value": "3072:pP9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:l9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004548, "uuid": "18829470-ed6b-47b8-87f2-0a2e591a6ce2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004548, "uuid": "dfb4dbd7-af8f-4b39-be1d-d675746a60ca", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004548, "uuid": "e32d9404-9de0-4d25-8a60-cceb04d5c617", "value": "645debcf098e64d25b3f434285c9213a93675fbb538fb0abaca504411f35ecae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396a0785-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003842, "uuid": "1eb30525-83d6-4c8b-818a-3027691c1c48", "comment": "Malware payload (Dridex)", "value": "68ee792bda349321eb1c9f03df5d0b05", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003842, "uuid": "2b2bf4f6-e8e9-405c-a127-a200c346e50c", "comment": "Malware payload (Dridex)", "value": "649381e98e204d7480218d53d20409b59336c539f5eb26d7b8071bb5774701e4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003842, "uuid": "b7c99702-511d-4d35-95ed-4c24abc94c57", "comment": "Malware payload (Dridex)", "value": "c60d1b81805411a327b321ea13fc5ce4f32ebf0b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003842, "uuid": "73722e80-6b38-42ea-a66a-4e17415395f7", "comment": "Malware payload (Dridex)", "value": "386f092392e44d340ab122b303628ce3f731ae64181b3b6c6bb154707775541b11fb76aec3d588c97480941670f7278b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003842, "uuid": "d1315176-b583-48ce-b9eb-3c22fe16c142", "value": "4B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003842, "uuid": "b93068fc-6790-4dfe-b562-494e1b3911c6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003842, "uuid": "d29c63ee-9c31-4267-ae99-80c13f6de8e2", "value": "3072:69Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:69Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003842, "uuid": "c891bff8-77bf-4a5c-bfef-11471d293db9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003842, "uuid": "c9d787ba-2db3-4454-b37a-0d764afed459", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003842, "uuid": "7d4b65cf-8c06-4142-9476-1154dfff26ad", "value": "649381e98e204d7480218d53d20409b59336c539f5eb26d7b8071bb5774701e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4a164a-8762-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616014420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014420, "uuid": "0f8d9168-cfec-46d4-b859-05c1df8c91f5", "comment": "Malware payload", "value": "0d1cbc78570231f058bc9c36e74318d1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014420, "uuid": "d353887b-d7c1-4b5b-bd9a-23e25ad621ef", "comment": "Malware payload", "value": "6506ec87aa7969d90f43fb72a2e68667f4722dafb2d1057d12696e18ae86c030", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014420, "uuid": "8f3eb4d9-297f-40ba-bbfc-0fa2bc7f9481", "comment": "Malware payload", "value": "cabfda91454641eff2218c8070678f1176fb17e6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014420, "uuid": "2c772fc6-aea4-4c07-8368-a801bd9e2793", "comment": "Malware payload", "value": "e858ceba28c2ef264b56aac08ed7f0b0c32c303dae61b8b5658dc426410cfb7fd654154e57d405433224011918d6438d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014420, "uuid": "417dee26-8a6f-4902-b8dd-a9e815685b22", "value": "F924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014420, "uuid": "9788209b-226f-4c75-8522-0d70c1b94dfd", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014420, "uuid": "7a11c3a9-7909-40dc-bc06-27cd1e6aa871", "value": "3072:p9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:p9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014420, "uuid": "8d8eb564-b872-4a61-b4ee-7536ff1b140b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014420, "uuid": "3fd8fae4-f89b-47fb-bffc-10f848f083cb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014420, "uuid": "8d974c49-d125-4e1f-9834-9678cee5e390", "value": "6506ec87aa7969d90f43fb72a2e68667f4722dafb2d1057d12696e18ae86c030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879cb094-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010416, "uuid": "3dc17f31-24ce-42b2-bc85-9f310ee6f968", "comment": "Malware payload (Dridex)", "value": "d010dad70ff6a37e486b185072baf343", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010416, "uuid": "a8de4a08-2f40-4dd4-a700-a21de21adcd4", "comment": "Malware payload (Dridex)", "value": "655161e743e592decdfebf0439153d29cf185e660c6e62af35aaa63ce6cb1576", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010416, "uuid": "4a8826e3-541a-4b8e-a9e7-2bf6ad445312", "comment": "Malware payload (Dridex)", "value": "01551be28fce8ea0bf6ae8e0ef315c75ee2232a2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010416, "uuid": "578eb7b4-0b5b-41d6-8a3e-51753e0e07e2", "comment": "Malware payload (Dridex)", "value": "340e6613a5433062a4d7b5f50e15ea0008b9e7f4f20010c5bf2b5b55c29a7688c8a7e1524c7a5d1d82b4fde90dd538c5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010416, "uuid": "86b32fe9-331f-48fc-b0ca-c888af41a543", "value": "2824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010416, "uuid": "2f351b0e-c433-418f-a1ce-dec61a4acc97", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010416, "uuid": "d0681b27-5d3e-4baa-ab9b-606a62397d20", "value": "3072:/9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:/9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010416, "uuid": "476bf7ae-9dcc-4581-9411-69d1251fe00a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010416, "uuid": "2e1c10db-36b9-4dd1-9367-73405a6789c0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010416, "uuid": "d7058bbc-fd57-416f-9bf6-86cc63bf8e9d", "value": "655161e743e592decdfebf0439153d29cf185e660c6e62af35aaa63ce6cb1576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c934eae4-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004513, "uuid": "09a7d37e-3ebe-45e8-b72d-51ace5a4733d", "comment": "Malware payload (Dridex)", "value": "4904db461940099cd18ac78cc1c02a47", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004513, "uuid": "f9049178-a62d-4077-bdbf-cd6453b33e6e", "comment": "Malware payload (Dridex)", "value": "655b01793c57964b521d6a8ea78fdf10e1d38832c3c833de18c6937474debfd3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004513, "uuid": "6073f7b8-c672-47ee-ba62-6855bd35422a", "comment": "Malware payload (Dridex)", "value": "1ae82f2b8c989cc149ea8d828d371c3be405f556", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004513, "uuid": "a140d635-8199-438c-8be6-f65507ef0d30", "comment": "Malware payload (Dridex)", "value": "7c1b83da2fea82899a1e7cc2d0c250a992039f03a48ba0b3352609aa15194e127a010f48bcb3f0e5d80f896e71e83b09", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004513, "uuid": "fc74452d-9571-4dea-9a6b-2b8daebe261c", "value": "0924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004513, "uuid": "622e4523-ddae-43be-921e-c5eea2ec51bb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004513, "uuid": "82937baa-dc7a-4b50-b94c-698edeaec889", "value": "3072:l9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:l9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004513, "uuid": "69796365-f87b-407a-ad95-dcc5576549da", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004513, "uuid": "5910eb07-c3a2-44b8-9e93-47d070b50963", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004513, "uuid": "b89275ea-231c-4417-9da8-d047b3599328", "value": "655b01793c57964b521d6a8ea78fdf10e1d38832c3c833de18c6937474debfd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3311ec8b-86f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1615967324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967324, "uuid": "a943d6d8-e663-45b4-b252-c7f129a474f3", "comment": "Malware payload (SilentBuilder)", "value": "faf6b126b9e054252bd88d3fcf530220", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967324, "uuid": "795ca62e-9292-4542-ab65-2f623350e658", "comment": "Malware payload (SilentBuilder)", "value": "656a644924a0bcf113d41c25e5231f24be2f1c88aa65e46d16c228b8224be07b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967324, "uuid": "67aba84d-334e-41b9-a0be-bc30c060711f", "comment": "Malware payload (SilentBuilder)", "value": "a1dd9b2f9303741c756684367d62ae67375fd365", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615967324, "uuid": "a766f07f-8dc3-40f6-b4d3-65d7d185a6a6", "comment": "Malware payload (SilentBuilder)", "value": "cd9d8ea48a5868be6ab9b58d703f64fda9fc44e8a8ce1e947cbdbf112c48fb13c474ba57bea2467ffa9b206115639840", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967324, "uuid": "27ceb044-288e-4783-96e2-8f486fbc6856", "value": "DBD39907DEEB862FC9844B3A41B34A1576D68C4D4BDB02475BD9FB2A5F3EB852E009D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967324, "uuid": "e255712f-3b9a-4035-8e59-a004825bd484", "value": "768:/+1Ud4TaBosDfW+uPIbCPVCmgUrNa1TuipEmWvYDYXPYvdJkmnhRdR57LO/RxnFO:/cUd4TaBolf22haBMYDYX4Fh3wR9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615967324, "uuid": "911673d7-2c4a-46f6-b7a1-5435ec191747", "value": 142848, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615967324, "uuid": "1d8eab7d-5e05-4308-8268-555524e016e7", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615967324, "uuid": "0cb30846-4113-4941-90e8-24eb4874f3ff", "value": "document-1988769389.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b3fb8b-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615965617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965617, "uuid": "76f40242-abd6-4b80-b087-fbc2a6a48da1", "comment": "Malware payload", "value": "30d272d2c78c9f7222687b774d4702a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965617, "uuid": "e1b145d9-0938-498b-b48f-b5d70ba614b5", "comment": "Malware payload", "value": "65a8049484709b05a5646983168e10212530d562f91d2c91427b60f998eb12bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965617, "uuid": "11361c71-1ec3-415f-ad72-00f94508495b", "comment": "Malware payload", "value": "7732f9905180323c08c89bd060f9304746621bc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965617, "uuid": "0ee4c9e4-796f-4bb1-9a61-07d151a860a7", "comment": "Malware payload", "value": "3fb6c87ebc1c849ce26bf7264d963bef53d9ad29931e94adca9101bf9c1fcb9cccb20807435e32ab1dcff1a3cef70a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965617, "uuid": "33cc275c-b3d7-4072-9aad-d8a8c6071b09", "value": "18160C7A3D6F3208F1B7101E958B4D26AF8D71162B69D02E247EA71DFB970648F43E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965617, "uuid": "503dae6a-1b8a-4753-9bf3-4f0b626f1e0c", "value": "6144:FcYg1i+pOQSuEE04jnY/PZL4/4byILPAL/zFQZWx9JU4Ln5iT+xlGgZQwRbIewIf:FcYg1iYEE04jR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965617, "uuid": "9593d264-ac92-491a-89c4-0accd54be38a", "value": 4353578, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965617, "uuid": "b0c63a41-975a-4860-afe8-a927bcb92273", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965617, "uuid": "8a9ef00c-ba15-4522-ab03-b80a8d2e7c08", "value": "30d272d2c78c9f7222687b774d4702a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4bc208-8758-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009783, "uuid": "8f5ec18a-13a6-43f1-a41a-dc0e504bb156", "comment": "Malware payload (Dridex)", "value": "61a535e99877304ba7ab8f80c83f743b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009783, "uuid": "986e0f96-33fe-475e-8e0f-0dddd614f41a", "comment": "Malware payload (Dridex)", "value": "65e3d652a9cc578c9e779f69dad20ccf064790f20215908db2b292c9b25011c6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009783, "uuid": "eacee6ee-1ef9-4604-809b-9b2dd55e3d96", "comment": "Malware payload (Dridex)", "value": "39fde953f0bbbf1cdd29b3eb51144278c848e3a3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009783, "uuid": "96938a7c-b3b3-44cd-99b2-1ed7df72cfb1", "comment": "Malware payload (Dridex)", "value": "6d73405a3dd8c9aa73d9a9775c27cf0604468a138733fcff1a68998503734fd732bc3f1b27cf236de879352624c6f01f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009783, "uuid": "509d1522-f0a9-47f1-aee4-486e1936d18a", "value": "3224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009783, "uuid": "8c3bb867-0252-4407-9bc1-77ed19cefb1f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009783, "uuid": "aec65790-676e-4ae6-a17e-1f3cfda90562", "value": "3072:K9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:K9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009783, "uuid": "b2aa2261-4198-4d12-a883-610ad7016cf5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009783, "uuid": "c689925d-7e67-4555-ae8e-fef4d0a9ea01", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009783, "uuid": "e077370e-189a-4ae5-b314-f36a7dd2dc23", "value": "65e3d652a9cc578c9e779f69dad20ccf064790f20215908db2b292c9b25011c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d954c2a-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004252, "uuid": "c1b0f0fc-9a98-48e3-9fef-5dd34a4528b4", "comment": "Malware payload (Dridex)", "value": "2d2b9a7ccd34bb7007b688bef415a980", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004252, "uuid": "e9cb1751-12af-4c8f-9b79-ef0d652fccc8", "comment": "Malware payload (Dridex)", "value": "65f2da94dcfd047648d09c274c4e072bf335a9f246bb6aa6bc229b71842b73e0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004252, "uuid": "8f4f62e6-b98e-4155-8709-789e12e00f77", "comment": "Malware payload (Dridex)", "value": "138af01c1174acd842a98778460ae2dcf6b416f3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004252, "uuid": "0639832f-6680-4c6b-9381-46f258872947", "comment": "Malware payload (Dridex)", "value": "f2795fff9207100c08163a3dce0bdff5e5b6dfcd29a70281e09ac70babebdc3e57896e054f011c0bf85dc72e56357f41", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004252, "uuid": "1cb31899-83cc-4f7c-8232-d9a9d61ce17b", "value": "BE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004252, "uuid": "7473cf7b-f467-4575-9519-7b815213e999", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004252, "uuid": "b5175626-7efc-427f-8bb0-a9004999dafa", "value": "3072:x9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:x9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004252, "uuid": "a86b6b13-1e1d-4365-af70-b155fbe8f552", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004252, "uuid": "7fb674f3-0499-4c7f-a501-a70a33ec6719", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004252, "uuid": "5273a804-392e-4ce1-9021-966717ed885d", "value": "65f2da94dcfd047648d09c274c4e072bf335a9f246bb6aa6bc229b71842b73e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7011734-8750-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006630, "uuid": "e167c485-8fa4-4546-bc69-6c57b47ec7c7", "comment": "Malware payload (Dridex)", "value": "29e65af3f53ebdbb88ee91d005930875", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006630, "uuid": "38c9480b-220f-4ba4-842e-0dbbee6b8f21", "comment": "Malware payload (Dridex)", "value": "6618739c865f9a5e99b3d3c6cbc11c78f208eebbccaa6124cbf6c43e8f09b261", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006630, "uuid": "de011361-3621-449b-9202-151679a4cf75", "comment": "Malware payload (Dridex)", "value": "68bf7281a76657687929849d7db08a3826624525", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006630, "uuid": "d87e903d-8981-4022-b901-6bebc88f576f", "comment": "Malware payload (Dridex)", "value": "15d6da3ec42e616a041f5e62bf2a0dcebb4ff435e05fc0b4304848c7e3cddae13fc150a40baedf9f033eda858f6b836a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006630, "uuid": "db472c25-74f4-4544-abe2-6b672965dfa1", "value": "A924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006630, "uuid": "63bd1b8c-0d19-437e-aa7a-0888e59f5bfc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006630, "uuid": "daabc9b7-b4f6-4775-80f5-c171873c8eeb", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006630, "uuid": "9f0ee923-3de4-48f8-9f4b-ad180af2b81c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006630, "uuid": "7fc4d7ac-9e2e-4510-b5b3-83bcdb5cc958", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006630, "uuid": "6f223e6b-5242-42bc-b34b-81bf46b6232f", "value": "6618739c865f9a5e99b3d3c6cbc11c78f208eebbccaa6124cbf6c43e8f09b261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5496cbf-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010465, "uuid": "4e3d00d5-c2e9-499f-8d6a-b3e9d317db10", "comment": "Malware payload (Dridex)", "value": "6b9744d7c12fb0b5830592e362ddc01b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010465, "uuid": "707e0c61-8a11-412c-bb03-e06d62df56dd", "comment": "Malware payload (Dridex)", "value": "661c36b4d25702064687f0ce6b2a8f48018660000d9d40d64d0d7b21b58eb3bb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010465, "uuid": "01afaaee-e662-493b-b141-f9d0d53e4654", "comment": "Malware payload (Dridex)", "value": "34b46cecb87743eccabf6c01fe0129712f79b1b5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010465, "uuid": "5fa7130a-5057-4725-b03d-00b45588f3d9", "comment": "Malware payload (Dridex)", "value": "b1e2676426ef2954365add5cc8bd2be9bab0aa6852f3751152401f0d527da0d37885c69357f58b80a727e2f5e9724fc3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010465, "uuid": "8f3b2f85-4546-42ee-b48c-80bd79d7f6db", "value": "9124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010465, "uuid": "18d4d90a-972c-42ef-8fbd-866c47c3db37", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010465, "uuid": "1aec4bc9-e69f-4e6c-9acc-31105ba3ce5b", "value": "3072:C9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:C9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010465, "uuid": "80ec6947-ed70-4e38-be80-23455b5a3aa5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010465, "uuid": "227c11ff-b803-40cc-875d-619c030a47c3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010465, "uuid": "4c460323-12d5-4ef8-b99f-75016dc9f607", "value": "661c36b4d25702064687f0ce6b2a8f48018660000d9d40d64d0d7b21b58eb3bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a335d7db-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615968801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968801, "uuid": "e966660a-80b4-4350-8045-ce0fd852af31", "comment": "Malware payload (AgentTesla)", "value": "ae79cd243b98b56cb7282ebbe1001cc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968801, "uuid": "ff11540b-dcd9-4f41-aae7-e9f3987e406f", "comment": "Malware payload (AgentTesla)", "value": "66299f1d16eab2cca6ebe65ac3239ab8fb27ea535d2fa6e2f472554c311d9f07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968801, "uuid": "09a6144d-828e-47b3-8905-ca4a158277fd", "comment": "Malware payload (AgentTesla)", "value": "e65fb96784233e5c33f708c3213d872b132f52c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968801, "uuid": "bf64c57c-db44-410c-8b17-b8c5f081c064", "comment": "Malware payload (AgentTesla)", "value": "c6a9fbf56ff7e6cc38f9b6cc0b6645b32b6e412ee11ff9df929ce21ea4d7a1e800c059ada3b3478707283a0493a69f76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968801, "uuid": "7e921cc1-26c5-4d01-861e-8a0abe16ed72", "value": "BBF4F1E036B96B46E9BDB7F2056391481B797B3FE265C30CACC660DD0A35F518252B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968801, "uuid": "bd699640-812a-4af4-9b02-456568d3b142", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968801, "uuid": "84b60901-f89a-4bb8-b1c7-580740429494", "value": "12288:fN4r582N9bR+O0XbNM1yjCaPESJZz3dLXp6PLr65enxL6MREUsZz1h2djj5Udddr:eR+xUyzPEYZLdLXp6PUexL6ODAzL29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968801, "uuid": "69ded166-3dfb-43f5-b652-9c7d89935d7a", "value": 768000, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968801, "uuid": "18401a67-c31a-4c83-8cfc-430a2c42c39d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968801, "uuid": "f19a4699-f317-4b38-9b76-0c6e04f3452b", "value": "ae79cd243b98b56cb7282ebbe1001cc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a51477e-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009105, "uuid": "d82eb450-b72e-4bf9-9bd4-69634524e0d2", "comment": "Malware payload (Dridex)", "value": "eb24185a256b653bf87c9a6d00df80b3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009105, "uuid": "846bae13-caa5-455e-8bc7-d32de2981b4c", "comment": "Malware payload (Dridex)", "value": "662b66d107036f88b7a640ad2d000a208d81a7db0d5bf6c0c57ff3fef118d993", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009105, "uuid": "1ce483ed-8c6b-4107-b102-2aff2e976e62", "comment": "Malware payload (Dridex)", "value": "09abc86496b64b84f211e47cabea458165aecb11", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009105, "uuid": "0729896d-e564-411a-994c-d80192556195", "comment": "Malware payload (Dridex)", "value": "953ba8da90a52c101947d10868b1aa2ba3ab583b756259bb1f512ee5318e14de776a1149298842df8fce8e376a1857e3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009105, "uuid": "034ff703-1cd2-4a96-8e89-25e7108b85eb", "value": "AD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009105, "uuid": "5c0f71ef-ad86-4b77-9ca0-5c243949de99", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009105, "uuid": "90732851-17ce-4e03-ac60-8b20e5d802af", "value": "3072:/9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:/9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009105, "uuid": "cebc9ba8-7264-4a3e-bcc6-fa42cee5316b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009105, "uuid": "6879bd5d-bea5-442a-bbf7-aa891fb1fd16", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009105, "uuid": "d17f23e1-c1fa-4d7a-aa5a-f6b004cf2b24", "value": "662b66d107036f88b7a640ad2d000a208d81a7db0d5bf6c0c57ff3fef118d993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68bcd37-86f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615966337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966337, "uuid": "2d990e83-517d-4952-9040-8b599bceeac0", "comment": "Malware payload (AgentTesla)", "value": "d1841849b9275645164114c17efe7dc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966337, "uuid": "bb826d63-c9cf-4626-96b1-c485144401c1", "comment": "Malware payload (AgentTesla)", "value": "6647cc7647d423b95ae916b58be3c6c1e76bf6691ff56c9cc9596cf22ef7dff4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966337, "uuid": "270f54da-e0c2-41c9-8837-520a1fb9ad57", "comment": "Malware payload (AgentTesla)", "value": "ce3238e2ab73fff4f3192d27ed95dd4ad57e4c15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966337, "uuid": "a552c1b6-9720-429b-a504-a0524201e720", "comment": "Malware payload (AgentTesla)", "value": "28b20ca1064b2f30560afd86c81b79a68a7fb039d48bbbb0f7b693ba25b2b1e2d18f22873d47b50043ada4051c7618c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966337, "uuid": "b02f7c1d-f905-43c3-bada-b4d1f15abe4b", "value": "9445CFE598C59142C80794F24C5BCB7133AF7D2E99AB840676EFF79D4E6AA834D13203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966337, "uuid": "fc76b0a2-6317-4c0f-99d4-f7a68d6ee5df", "value": "12288:/1f+xTCi7YBz1PXdAExxVdMwxyUKEUVIksFD4:/1f+ZCisBzBXd9xxVdMc6VIksF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615966337, "uuid": "31241549-4c8b-493b-a6da-79db17beb795", "value": 1245184, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615966337, "uuid": "a4d458a4-a2f4-49dc-a45a-3f024cfe1c23", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966337, "uuid": "5f2d693f-7c11-44fb-b994-c546c179d671", "value": "AKST_ORDER_31621.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135aec8e-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615962117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962117, "uuid": "d0ba9bf4-eb72-4bef-bfe1-ab06cfcc57c5", "comment": "Malware payload (Loki)", "value": "31ab910f5370a91b08051f997d3c1bac", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962117, "uuid": "41913c15-f469-4898-9318-3ed9deb07d94", "comment": "Malware payload (Loki)", "value": "66c76de8fd2ae07429c385706269ebb3fb9f32130746c71d01e992371f12466a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962117, "uuid": "edb4b604-cba9-4761-b15e-aed169e36704", "comment": "Malware payload (Loki)", "value": "6b4ce15d1a1abe87f6ecb8ca314eb088d6e00f71", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962117, "uuid": "e59ebd3d-bdc9-4cb1-babd-969f17f3ae24", "comment": "Malware payload (Loki)", "value": "51a0fde8d331d78a219a4fde39a52e3a7789fc43d83f11c6fb9f2d3a21e31deb9665b25b9652a9b5260685a0c33c4bab", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962117, "uuid": "c61a3e6a-5ed6-4433-acce-8d90e2efcf3e", "value": "81A53302BDD72F6FC72A39FA92A2937C81674C54A1489C557549F3F83472630A3892FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962117, "uuid": "053c8339-1d51-4ee9-bc54-2d9fcffc54d7", "value": "49152:jgGdXJ0w0FMtpDHhC5J4xGOL2JlFMp+30L3W/fqKkhGkJUHB:jgGVYmDBCP7OL2/FgQ0zW/fU5UHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962117, "uuid": "c9faf2ee-fb3c-43ff-b937-f6584230e92a", "value": 2211840, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962117, "uuid": "0c4ad68f-8e0e-4f94-af9b-df9526e8ff64", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962117, "uuid": "67544fd3-a034-4c95-87c8-4e4524587548", "value": "MV BERGE MAWSON.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b365094-86b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615939796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939796, "uuid": "26986f1f-f3a4-4651-bf45-90dd42b428e6", "comment": "Malware payload (AveMariaRAT)", "value": "9b8c61033a4821ecd632b335ec7a72d3", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939796, "uuid": "a9253cc7-ade0-4ff8-b7a7-89cc4d101c10", "comment": "Malware payload (AveMariaRAT)", "value": "66ce73c1a891f03c395cc767a0a0b5d333e88b88affa4a7574151eacf807a7bc", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939796, "uuid": "d79d3d53-6e9e-4e40-b235-cbe8351217f9", "comment": "Malware payload (AveMariaRAT)", "value": "29eda087dbd4594788b7eb525fb8843e7a65f47a", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939796, "uuid": "4d834c77-d237-4b09-bd0a-d322f5bcbb5c", "comment": "Malware payload (AveMariaRAT)", "value": "ef9fb109246b236bc0434794f85d611b818b4874af63163610e9f1b0e898e5fc5fc1c7c5fb803394b8cd968dfe67e995", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939796, "uuid": "f6613a60-6819-46c3-be90-0eec7589dade", "value": "50019E37F6E7D7114429C89FEC6F9F89E87005430F6955D1D0D084D78D4184A577C85D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939796, "uuid": "382577e3-4b7b-443f-b089-45da41fc39e5", "value": "12:xbIlEcT/yEZgAi3phyc8brdvkPGoXZZelhyc8brdvkPCEhXBRAZJN:1IecuEZgNpYcYrdMPGoJZelYcYrdMPHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615939796, "uuid": "c8c1fb60-278b-45d4-a883-22f5074f5837", "value": 665, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615939796, "uuid": "6a211c8c-b1c4-4def-9cbf-9681bbaff274", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939796, "uuid": "56f96b29-e2be-4b82-becf-985a5f7212dd", "value": "detect9.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e77abd-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615969632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969632, "uuid": "6699898f-824a-41f9-82b5-fd718117e006", "comment": "Malware payload (GuLoader)", "value": "9219265a35a5fedbc7cec8f7d95d44e6", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969632, "uuid": "1bb59463-59e7-404b-a534-b9d0273cefff", "comment": "Malware payload (GuLoader)", "value": "66e56ac815bf6797d791712ee2304c3ddacb40870f86eb80d9dd79cbf7e36ad7", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969632, "uuid": "a176c391-42d8-4f9a-90f1-5a512e824879", "comment": "Malware payload (GuLoader)", "value": "5f38857aad24e5098ba4ebcd5262a4073cd81859", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969632, "uuid": "5c0e6fb2-9ece-47b4-b57d-730cd05153d9", "comment": "Malware payload (GuLoader)", "value": "d0891af4c12919f71d78b0a62c324fda4bf688d6dddaff673d345051c16cc494f5a964239c61e555d29516f160b4e613", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969632, "uuid": "f72fb8c7-b414-4c71-90d2-6ba06054502c", "value": "95936CA3B5DCDDA3E31088BDD664C15C828DBCE1A2D08627B1D576AB1B7B74030D1E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969632, "uuid": "7803a6a6-e3e3-41c0-9e69-23436651d1a8", "value": "71968742d4a47f5a9aabc0f6892dc307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969632, "uuid": "e03d3db8-cb54-4131-aa29-7f7ea2f35fed", "value": "768:twzLx1jIeGRiA4ncivf/kt4pK2HRk86Z8pvxsyUHQDQi4aYIV8I7hzPr:2zfjIeGAA4csf/2ILHR08zAoQi4K8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969632, "uuid": "fd044f0f-7d51-4fcb-b16e-b16e14c37684", "value": 95280, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969632, "uuid": "b85af66c-3ffe-4294-825f-0715d006c48e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969632, "uuid": "888d4572-dd03-4c38-af2f-9b9bdb98c35c", "value": "ph.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6a10b1-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004409, "uuid": "e0f257eb-b73c-4b26-b78b-b8dd9b8f0eb6", "comment": "Malware payload (Dridex)", "value": "59201a08863741e29a35f15f638bdcfd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004409, "uuid": "ce657aa2-09f8-4ff1-b733-7d5375598d25", "comment": "Malware payload (Dridex)", "value": "66ec3683f7b2219a099511d6a0e142298f811fb44cddf39bad44aa06c60e7de7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004409, "uuid": "c996e9d6-31e0-40a6-8664-513ab6ac71a5", "comment": "Malware payload (Dridex)", "value": "1933143b583042e45982eaa2808cbe395d9bd9bb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004409, "uuid": "a49b519d-b06c-4ad1-a05c-6a6115d5c06c", "comment": "Malware payload (Dridex)", "value": "c5e66637670fed3822d0535ae3a08605dd8a56d28cbf8083467812b7e792dbd2888ee74363d6e18a71101962bc3d50b6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004409, "uuid": "3b101eb3-5dba-4d95-8b9e-9a30ba2bbe19", "value": "E724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004409, "uuid": "35be6ef3-a991-44e0-a7d1-d973c3863b8f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004409, "uuid": "6f1789ee-e83e-4c9a-8c1b-69f52902a9c6", "value": "3072:m9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:m9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004409, "uuid": "9f815217-3e47-4b15-8244-a7b1afbf2a5c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004409, "uuid": "3ba0c5b0-303a-4f65-94b0-60b2d06db364", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004409, "uuid": "d4daa095-34d9-4527-baaf-27252098ef37", "value": "66ec3683f7b2219a099511d6a0e142298f811fb44cddf39bad44aa06c60e7de7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1f167c-8703-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615973465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973465, "uuid": "5ad1af85-ce93-418a-b187-260891cb8b10", "comment": "Malware payload (RedLineStealer)", "value": "838a874b439653c3fa4e12fb709ef79c", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973465, "uuid": "a78563cb-213a-4aa9-ac6c-a17f3ed8f316", "comment": "Malware payload (RedLineStealer)", "value": "67379798051b6c0ecd91e17933944149e6f71455ad6201a1ee69c17169af9427", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973465, "uuid": "b1eacd75-21f8-4089-9520-6a714b340b19", "comment": "Malware payload (RedLineStealer)", "value": "c4185b24561350f3be3c32fd02368e8c7be63179", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973465, "uuid": "57a4a560-a7ab-43c5-a268-90839b31b627", "comment": "Malware payload (RedLineStealer)", "value": "d09baff104bdd0ecddb800bdcb542e427fcf915a108f39123136f3571f33a396d3dfa68087c3794dce97259b55cccef4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973465, "uuid": "9a5cebf6-93db-408c-97ae-686bc8242926", "value": "1624CF2175C0C1B3C4B7113044EACA799A7970314B7A96D7B7DD1BBA6E213E1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973465, "uuid": "7f913025-df22-460b-b6ff-44b80b8f76c9", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973465, "uuid": "2e20ed88-e93b-41ad-b457-c5757be68099", "value": "3072:3DKW1LgppLRHMY0TBfJvjcTp5XKv5KLaaXsgWFoblq6Z5:3DKW1Lgbdl0TBBvjc/i5KaaXsgWyRq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615973465, "uuid": "96c92822-2e4a-413a-a0f8-ef8d530369e2", "value": 210432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615973465, "uuid": "9b3c8d5c-352a-4864-92f9-1f8dc8848d20", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973465, "uuid": "c390077b-5771-4e6f-a674-b29755b83678", "value": "SecuriteInfo.com.Trojan.PWS.Siggen2.61925.20023.4720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b72e27-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003807, "uuid": "15679bd6-0ca8-491a-bbf5-bdc7686dc7f0", "comment": "Malware payload (Dridex)", "value": "9e3d8b09a42b553d8162e3d4b38e60fc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003807, "uuid": "04fa1cd7-05f8-44d3-a0df-f931643c7bf2", "comment": "Malware payload (Dridex)", "value": "6784aed3072f84a3b7f94cb441af79e7cef6894d1b2151b4eab61ca41f37e9b6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003807, "uuid": "7586ef33-5a6d-402f-873b-f2064373ff0f", "comment": "Malware payload (Dridex)", "value": "e07ca199a97b41be1ec9e3bff986724fb0eea384", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003807, "uuid": "36adc8ef-3a3c-4a2d-83fd-d133f64d6064", "comment": "Malware payload (Dridex)", "value": "36c13e983e51c4761c6404c68227790684498e52b08a1c2055a7c11236c2ce1c333d6652729216ab914aa06dba8ec85b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003807, "uuid": "49a39f1b-d926-4c39-9dc0-2f6b1acbfcd0", "value": "6C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003807, "uuid": "5bad37ca-6278-4d49-8a46-237a7136b344", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003807, "uuid": "44d7fb56-e7c0-48ae-9424-4efdb66d5fd3", "value": "3072:F9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:F9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003807, "uuid": "2179a4db-6c99-4c7a-90ef-31e96f649186", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003807, "uuid": "e51ad660-f67b-4bb4-9af0-219c64245e40", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003807, "uuid": "e45ee4c8-b25b-4655-90aa-cdfb6efa558d", "value": "6784aed3072f84a3b7f94cb441af79e7cef6894d1b2151b4eab61ca41f37e9b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01707537-875c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011479, "uuid": "f8cacb7f-c9c7-4a9a-a91b-9a6a03178f6b", "comment": "Malware payload (Dridex)", "value": "d79daa377a7fc999032a65dd89a0fb64", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011479, "uuid": "58008648-a4fe-4d57-949a-42352ff21a14", "comment": "Malware payload (Dridex)", "value": "67a206ce9d4bf121a93be1e29c0cb19081e80fa879c1c5d0fceaeb1f00eb522b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011479, "uuid": "778719f2-4ea1-414e-9a49-dbcf1ba22146", "comment": "Malware payload (Dridex)", "value": "0602029ef7f4987b6e2b2275c6b923f32fae3b7f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011479, "uuid": "e927d95a-0edf-4aa4-96a5-5ba6dd4c95cf", "comment": "Malware payload (Dridex)", "value": "e308247c69e996019b8664a2f2a87bf7adaecc29e4fd25122ecc3147fb7ac1456dcce0037fdc34adbc445dff3ccfbc6e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011479, "uuid": "5f2a59c5-676c-488a-9ffe-428c6c5cdb81", "value": "6124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011479, "uuid": "98c09266-42c7-4052-97d7-c672e111bb7f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011479, "uuid": "1a4e6cd5-4306-48a5-933a-80fdc987d4b4", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011479, "uuid": "43eb2fc7-560e-4ad8-93a7-7004dc0fea7e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011479, "uuid": "cc53a316-ba60-48f0-be2e-ada1d3670b57", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011479, "uuid": "aaa9913d-02a5-44bc-ada8-39e32268b86c", "value": "67a206ce9d4bf121a93be1e29c0cb19081e80fa879c1c5d0fceaeb1f00eb522b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674ba53e-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008214, "uuid": "13136484-f3a6-4f71-a378-337ed9f3f24b", "comment": "Malware payload (Dridex)", "value": "31860171720e4f621cf7afafc59fd181", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008214, "uuid": "88453c1f-1269-4dee-9401-891cbc78be40", "comment": "Malware payload (Dridex)", "value": "67d61994e13ce635a6b31445c7b6d24372d74aa9dbd2370c86cb123e40fcd72d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008214, "uuid": "940b8230-8bc5-4241-a4a1-38b250eea282", "comment": "Malware payload (Dridex)", "value": "d413ac06f5a09670c2d60ce99a600c6ffdf59539", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008214, "uuid": "eacdfa18-e0ec-4756-bf08-2258893f3218", "comment": "Malware payload (Dridex)", "value": "0b49d481722f94399315e98e1f692cb7959e865866b24b9ee5d6dca5b218b7b1705ae7be0682e61d3ed2a13f03687149", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008214, "uuid": "12185cc9-4498-42cd-a484-e8b0f5efe8af", "value": "1F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008214, "uuid": "47aec121-adfa-4838-9e0d-bf6265b6ec76", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008214, "uuid": "bf08f1af-1735-4e71-9499-dd7670c32753", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008214, "uuid": "760cafb7-055d-426d-885e-2cfa1dd9b646", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008214, "uuid": "0b487e52-5254-48b7-89fb-c79e2e3f266e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008214, "uuid": "9da7a407-d20c-450a-abb6-dc0b9310853e", "value": "67d61994e13ce635a6b31445c7b6d24372d74aa9dbd2370c86cb123e40fcd72d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6bc485-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001728, "uuid": "ecb2d468-3457-4919-974a-ca6b68b55a5d", "comment": "Malware payload (Dridex)", "value": "a42fea85a027ad69c81570fac156ec08", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001728, "uuid": "405a21f6-6e38-47b2-83ad-7899444dad38", "comment": "Malware payload (Dridex)", "value": "6868e5fc37bdbb0d8b24c4f63c10822f1a97487d678b33044c246fd279f16117", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001728, "uuid": "e9f1793b-e894-4fe8-9210-dcbec4401a62", "comment": "Malware payload (Dridex)", "value": "b587cf44000b40146089b9cc861cf6e4e5b2ee79", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001728, "uuid": "b45c4f64-f119-465a-8f02-2d90ff42d617", "comment": "Malware payload (Dridex)", "value": "e4b5326e231708a23751b9d7b9be444c3b3df92b845ea172ee429d05f1c5498eb32591bf85fc9269cf922cb1c17562ba", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001728, "uuid": "c1a4d001-b0c4-4969-acf0-bdd0cc51b45e", "value": "D524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001728, "uuid": "cd2598ad-fde9-4e31-bdf8-5836af2591c2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001728, "uuid": "f57803ca-b4bd-4145-b22b-290a9da7e022", "value": "3072:D9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:D9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001728, "uuid": "85d724b5-0e1b-472c-bfcf-001d0ab694e2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001728, "uuid": "d2b87c1e-fc32-4ad2-92f5-ac691569c3b8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001728, "uuid": "be309ace-2362-4beb-95db-7c423963f563", "value": "6868e5fc37bdbb0d8b24c4f63c10822f1a97487d678b33044c246fd279f16117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9dec30e-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "a309c4e5-1d48-43b2-8a0c-b8ee73e4bd8c", "comment": "Malware payload (Dridex)", "value": "c2a682f3e5789e6307e918bc7c9ec449", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "2c128731-4554-447a-80e3-40831870089c", "comment": "Malware payload (Dridex)", "value": "68e644dd8ca433230837a99c028a8f796aed2ff027540add591696b5f8f6ca67", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "fcf3e98d-0aff-489a-97f4-83097621b610", "comment": "Malware payload (Dridex)", "value": "e8bef25f66faeae62baf0ab026b841c196b46f55", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "9f4caa68-cabf-407a-8000-a4f67ed8a8ec", "comment": "Malware payload (Dridex)", "value": "725159a34b8d9f11720c91057c519e0dce2fc9e4432e48c467fb3955e7f5313b8eef6aecf058dd7d8aab0a114298ab3e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "d0d5a5d5-d5eb-45b6-8672-ff01bc0372af", "value": "9A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "5f46607b-d293-4435-bf43-430322825f59", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "0e1bb075-686a-409f-8adc-8a63f8f59933", "value": "3072:Q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003735, "uuid": "e9f4bc82-a6f0-4b1a-a071-9f22f4362dd4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003735, "uuid": "b4b2972e-01b4-4c3c-b684-0defebb8aea0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "8343f18b-c39e-4e50-b092-8bda8cbdfd62", "value": "68e644dd8ca433230837a99c028a8f796aed2ff027540add591696b5f8f6ca67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce059c9-86eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615963099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963099, "uuid": "4097e0ea-9ca8-4296-91a5-af9a6791c66a", "comment": "Malware payload", "value": "9524610bfeb75cc5da5b416683299dde", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963099, "uuid": "e816fc01-07ec-4f62-b576-118c980b53cd", "comment": "Malware payload", "value": "692eaef0a720646d48417cb2e4dc107b2dd788e6676be92592045899a3187cdc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963099, "uuid": "33f72434-6c44-418d-8a66-c27bbbafc406", "comment": "Malware payload", "value": "1d1ee71eba1e5ca8ef170de42eef88886435c848", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963099, "uuid": "85714af0-7b5d-4838-aaf3-91d3e7994894", "comment": "Malware payload", "value": "27b4f7155ba329421b04bbc57ffc0465042c72f1e314d77047b07948c2284187dd6c53c4c0c1d597aaa124e5ddb0f0fe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963099, "uuid": "241e7c4f-bab9-403f-b832-55392f6da6ad", "value": "48C42343E2314BB5EF5223562DC3187D613B37EF9AA2A2913DB534946E35EC04B2C761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963099, "uuid": "f301fa16-16fb-43be-8108-d59942ef5506", "value": "12288:1D6ESbx7e2lO4xQc99YH/YS8qGCj4/C8gZwfj/qks8hDAWYTY:1allbvHrBqGCj6C8YC/RhDGTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615963099, "uuid": "ee9de38b-8a53-4490-bee8-6b54cd992470", "value": 587413, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615963099, "uuid": "e99d84cb-bd22-4f1b-b4ca-34f3eee5132f", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963099, "uuid": "5ec29fa7-fe0d-4c0d-bced-5523102cbe92", "value": "ABMT-#75837725492447TT.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c12df0-8766-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616016028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016028, "uuid": "365041ec-17ab-42b6-aa8a-43ac180fa449", "comment": "Malware payload (Dridex)", "value": "69fa103903351c9cd997effc1dd56366", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016028, "uuid": "f07ad2e3-8374-4e35-80b9-93b247d0d9ca", "comment": "Malware payload (Dridex)", "value": "697000b63bf0979d9070ed538d080185a776dbed9935cb14c7d44f87df3b91c7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016028, "uuid": "cf726afb-237e-4515-8648-e93200925561", "comment": "Malware payload (Dridex)", "value": "0d8bd6994ace2bc45df7a18ec3975022b96d3a31", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016028, "uuid": "414092b6-002c-4824-9f47-e34d9f672b3e", "comment": "Malware payload (Dridex)", "value": "9a4fe6e8d4687fb545f0b8ee984eaf74d1638b1630fb883f5d554de5a41224a680e308c89d6d2297ca2546c6bea853ff", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016028, "uuid": "d1d516ca-5eb5-42e3-90b2-ee1a3f0d0adc", "value": "2624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016028, "uuid": "5fd529c2-5c3b-4fde-9f00-2f506af1d5e6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016028, "uuid": "61a7322d-faa9-41b5-9c31-0f7d270756d2", "value": "3072:C9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:C9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016028, "uuid": "405ade68-7460-4ad6-977e-d976ec5c8d1d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016028, "uuid": "42117f35-c7a9-497f-9859-9e8b6c77d27c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016028, "uuid": "cfed7163-098f-46e1-ae3e-05ad6749764f", "value": "697000b63bf0979d9070ed538d080185a776dbed9935cb14c7d44f87df3b91c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d15f07-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004534, "uuid": "0a45b595-d0f7-42aa-9187-19978415e745", "comment": "Malware payload (Dridex)", "value": "0ca94dfbf6f935a90320bd8a80690f3b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004534, "uuid": "5cecd323-8208-4d13-8c60-28b28459498f", "comment": "Malware payload (Dridex)", "value": "6972ffee0daf8b92d156750b775bb430a4de44c36ac1c97c636447f24b0ea69a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004534, "uuid": "138c8a06-da5a-487e-8dc5-619890f1a9d4", "comment": "Malware payload (Dridex)", "value": "7b3d683ebefdc4bf675ec1122d9e0b19808544a4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004534, "uuid": "31f4615f-b8b4-4ca5-9cdd-6a0fc67b0de3", "comment": "Malware payload (Dridex)", "value": "d254aef70066de8664c09b3dba92d8d51b571d120292c2316a4968d456dfa1968d6f1871b72e9ee3ad1caef68fb61617", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004534, "uuid": "f1f7e5c2-84df-4903-aa0e-0d40740397b9", "value": "9224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004534, "uuid": "e8b80afd-f729-42db-94bd-9a1f206df655", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004534, "uuid": "8cd564aa-6310-40a3-8408-42571de6e8d3", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004534, "uuid": "f185c9a4-cb93-4aa2-9964-6f7df2da8274", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004534, "uuid": "44c41030-a178-49f2-9f41-fc52b867961f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004534, "uuid": "cec7f350-349c-4b71-9487-9badc1f258a5", "value": "6972ffee0daf8b92d156750b775bb430a4de44c36ac1c97c636447f24b0ea69a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7584eed-874e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005825, "uuid": "390a6943-bfa8-4feb-9398-365710bdddc7", "comment": "Malware payload (Dridex)", "value": "3cd7d12de42b830d5329d87213cf5a08", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005825, "uuid": "f81ad25e-9bac-473a-958e-e031c7b5d8d0", "comment": "Malware payload (Dridex)", "value": "69a39c5caa1f8a47fb5584d40ead42b0a46108a39fd3f94b17491ccf5346d526", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005825, "uuid": "0bb65ea9-9fc8-4702-8c23-b77873b5212b", "comment": "Malware payload (Dridex)", "value": "2cdb4d091023a60444a124a2423e22b2557ab2a1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005825, "uuid": "3a62b8dc-03a8-4d85-81c0-45c9a429b560", "comment": "Malware payload (Dridex)", "value": "9912c3cb550b8eea1bcae546df13e3555acb39720130d926a972331456ef213067801bfeec1772a8da99d7db3db58068", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005825, "uuid": "a5767a3a-3255-4fc1-98dd-1285def807d3", "value": "E424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005825, "uuid": "4781aaf4-5568-4b84-9a12-a3cacb82d1eb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005825, "uuid": "d9d495a2-1ad0-4526-a545-e2900dd1a03c", "value": "3072:M9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:M9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005825, "uuid": "f87260f6-5de4-4f73-b4f9-8551ee4a8afc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005825, "uuid": "3bf15da1-c52d-4d56-a391-a77208349c21", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005825, "uuid": "c5bf6f44-f2a6-48e2-90a7-c4caeb592490", "value": "69a39c5caa1f8a47fb5584d40ead42b0a46108a39fd3f94b17491ccf5346d526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353976ec-876a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017579, "uuid": "e25c508b-eaae-4621-82d5-29dd9ddc71f2", "comment": "Malware payload", "value": "ec0974266b072b2c239880cb446c4bf1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017579, "uuid": "f0e4052f-beb3-4121-80ef-9578f65728e3", "comment": "Malware payload", "value": "69c6acc997809187eafa4c240131ec77e4c92ca3b1bb5e4a601da5f8407837df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017579, "uuid": "a245f677-e633-4c28-bbc1-69e04cdce833", "comment": "Malware payload", "value": "9b9eba8f1bb5b53785e38b87892f0785b30ffd44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017579, "uuid": "8e9ba994-94fe-472b-ae97-309b22f1eddd", "comment": "Malware payload", "value": "2d25a778c1bcbef526c204c5b9594f12f000aef794be75a500ae3365ba9bbc8a4f0727b82f4e664760ffd2597beabb4f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017579, "uuid": "1bd9dfce-2fac-4deb-82a5-153afe389b7a", "value": "EC04F11BDD094D63C80DC77CBE5B0CBCAB0CA2ACAA8477DD20B15DD57B882261D6B15E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017579, "uuid": "47130495-214c-4d39-a491-fe45643ae2c1", "value": "3072:0XFYiB3kNT+2Jozo1UW8gOvlAsku0Gy3ZsY0OPlaK/LBt:0XFYiB3kNBozoR8gOvljFy3ZIOXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017579, "uuid": "72962ff0-7d69-457f-a704-5289e3db59c1", "value": 189036, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017579, "uuid": "d51d6808-1901-40bb-a8e0-63eb1a634290", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017579, "uuid": "11a9073e-bbe2-4231-9e8d-77f36d3b9dd9", "value": "SecuriteInfo.com.Trojan0057940f1.15188.6638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4662035b-8752-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007300, "uuid": "9ab8cbfd-7067-49ad-a9f0-d86d0f760d48", "comment": "Malware payload (Dridex)", "value": "4d60de57323cdeb8ab5ea5696847142e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007300, "uuid": "6fe0989c-e389-4029-8322-afb5c62ec4e1", "comment": "Malware payload (Dridex)", "value": "69f0406b99770e701199457fb81c83e42cd4383eb6ea0c1233ff43e042f6aed1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007300, "uuid": "20c2e124-2726-42c0-9941-25984aaf7d7d", "comment": "Malware payload (Dridex)", "value": "64ed84a623e9a34c022f154daab4f06303232611", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007300, "uuid": "8ea7b645-72f3-4094-9d01-a362e90cbd2f", "comment": "Malware payload (Dridex)", "value": "913cee48a8f5651582c772e1097ded9afda4385c59ca023664ff58bc3ac673b3aea1990e415a9bc4319566f9520e8692", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007300, "uuid": "132845f5-45f3-4deb-bed6-fc857065c4e3", "value": "A624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007300, "uuid": "fdb654d2-7aaa-4787-9fc0-22437d5b9622", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007300, "uuid": "49812c53-8f15-4cbd-a23f-c55bd7707e39", "value": "3072:D9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:D9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007300, "uuid": "7c3dd97c-f0d8-4efa-adf7-090be8364cf0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007300, "uuid": "0038b4d3-b758-4079-9fde-52b66bac3613", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007300, "uuid": "3cf9bf9f-8d86-4457-ac9f-abc90b0711fd", "value": "69f0406b99770e701199457fb81c83e42cd4383eb6ea0c1233ff43e042f6aed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f282eaa-875c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011663, "uuid": "e14017e0-feb7-4dff-b6fc-8dc8b95ac995", "comment": "Malware payload (Dridex)", "value": "594b323ec6f0a4ed4dcf946e67ebb539", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011663, "uuid": "2a76000d-b031-4e14-860e-96c2f21e5201", "comment": "Malware payload (Dridex)", "value": "6a4108c7fa437a454fe0fa053724cbc2ce273843efb674c66ac7788e9db4149b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011663, "uuid": "a31449cf-bece-42d1-b501-fb61d727af0b", "comment": "Malware payload (Dridex)", "value": "e92eb119fdb1e6f6a3e411a60743f8a906ce19b2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011663, "uuid": "5db60755-545a-4087-90e8-c035e6f170c5", "comment": "Malware payload (Dridex)", "value": "3fc7d469dff83050184907ed11e8fd0fb5c5df9a550b0ce9ab6993da4fd58337834801cc2bda494be52baadb50ea9e4a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011663, "uuid": "f79c6d04-fe8c-4c93-9ad7-fac2878b048c", "value": "2C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011663, "uuid": "8770f690-d317-4abe-9d43-16e49b8a3f2c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011663, "uuid": "39556399-c3b7-4c45-976d-53d422ab3793", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011663, "uuid": "83610ad9-9ce4-4a57-a807-23e92a3df498", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011663, "uuid": "1cc48fe7-d79e-4f49-b328-f8c72acbb188", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011663, "uuid": "e1d6b02e-0383-4ed2-9d3d-74b48b4d4caa", "value": "6a4108c7fa437a454fe0fa053724cbc2ce273843efb674c66ac7788e9db4149b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1fd7c2-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003660, "uuid": "084bb2f9-f3dd-4897-adef-9f0cebaf1178", "comment": "Malware payload (Dridex)", "value": "2c74fb2bf35ab9b5382f6b543819d51f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003660, "uuid": "ee59b16b-1296-4f4f-b3b7-7518e325cd09", "comment": "Malware payload (Dridex)", "value": "6a6c1835c606a9090465c44a3bedff9fb2536082050a6e46aa8ac36291eb4803", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003660, "uuid": "dd4ce667-f4c4-468b-a2b9-a1a06366af3b", "comment": "Malware payload (Dridex)", "value": "db44527a513b9788dad97ccaf2a26fed82d64ea7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003660, "uuid": "fa4b7219-b1dd-45b9-b8f7-bd3a38b0176f", "comment": "Malware payload (Dridex)", "value": "d68c9213087305066c1edfde951c4d18f6f2e8a568bc1f08d2996af5109f1cad8b69451df146a3b665c936e24337d432", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003660, "uuid": "8f125627-ed2a-4a62-b6dc-9c9a0519c74b", "value": "0924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003660, "uuid": "231cf5a8-b930-4fe1-8d19-cad9e88d6423", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003660, "uuid": "c87ec3b7-1fbe-40f7-b5e9-301d69525275", "value": "3072:L9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:L9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003660, "uuid": "d2d0c026-8982-4524-9ea8-45c6dc11b460", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003660, "uuid": "342f78fe-1dfa-4d82-ad54-b8f001fe9e36", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003660, "uuid": "012f06aa-ee6e-4a0b-a7d2-3bc3f7819046", "value": "6a6c1835c606a9090465c44a3bedff9fb2536082050a6e46aa8ac36291eb4803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0521616-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004498, "uuid": "5ab86c52-9082-4b3d-b4fd-fddb5f80047c", "comment": "Malware payload (Dridex)", "value": "8132e7695308540c8ae9f6cca1e63e8a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004498, "uuid": "a7c35853-65b6-465c-9fe5-56e8af4fdec3", "comment": "Malware payload (Dridex)", "value": "6ad2672748ff33614e91b6d46269ebdad1477f60668c4bbcd574750c2c455ce9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004498, "uuid": "30873e9e-8769-48b2-9a72-18342f5a8933", "comment": "Malware payload (Dridex)", "value": "7e5c5d7ac709bf4083fdc2d0abff8bedb0e1d624", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004498, "uuid": "1c72f284-cefb-4909-87b1-5e605f7fdb18", "comment": "Malware payload (Dridex)", "value": "a57b2450fb28a2a0d19f946ede16bcf3104f5c2eda954a2eb32a87f50a7ba4736c055e7ec216f2a3e9ca44ac003a923c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004498, "uuid": "b8de7440-ff26-4cbf-909b-3fd9fdf57b14", "value": "6424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004498, "uuid": "f1fd8830-6a3d-48aa-8796-4cb93ea1bd9b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004498, "uuid": "1eddc537-c7da-42f4-9611-b99b0b6e7e6c", "value": "3072:S9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:S9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004498, "uuid": "69e06527-d086-4872-a2da-63e14b98349f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004498, "uuid": "05bd406f-3202-4e17-87d7-e0d3a8a4163a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004498, "uuid": "ca6e7c95-0a69-4fc8-844c-36b22e7d3dbe", "value": "6ad2672748ff33614e91b6d46269ebdad1477f60668c4bbcd574750c2c455ce9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e132673-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003823, "uuid": "c22e8c42-324a-454f-8071-0d4bcba3ac72", "comment": "Malware payload (Dridex)", "value": "c9b6df69d9929bc6f31aefdce925e51e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003823, "uuid": "599eda16-be73-4c9e-9a50-4d272f0d255d", "comment": "Malware payload (Dridex)", "value": "6b1ccd9262900b6e7fa5fb46b0df7b3fc13778073c13e426cee43adb9b0b1662", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003823, "uuid": "781571d7-c61d-412e-8d53-c1e36feed8fc", "comment": "Malware payload (Dridex)", "value": "1693c5e74a7c1255dc8a4440bb9f4498003de8e0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003823, "uuid": "cfe26064-9a65-4cd0-ae58-efefe8e9180b", "comment": "Malware payload (Dridex)", "value": "15aee26856b2e3dca5edb7f23cf55f084b31443b1d24d9ce99a03550bd67a3e4d1f5fe83dba4a1721d5c1533e55ba263", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003823, "uuid": "0ffd4dfc-9757-47d9-80c0-ba55a287c9fd", "value": "0024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003823, "uuid": "39ee40c0-5ae2-4cec-9c4b-7ad660a48601", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003823, "uuid": "daa66654-0b49-4e8f-b0f7-173a7bf09fb3", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003823, "uuid": "d2b6c104-132b-4919-b72b-b75f442a6584", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003823, "uuid": "29f31214-d883-4ea8-ad3b-14fb38d7f1b5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003823, "uuid": "1d2438e1-6b2e-41ed-b45d-1c0e93cad194", "value": "6b1ccd9262900b6e7fa5fb46b0df7b3fc13778073c13e426cee43adb9b0b1662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c42b26-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004237, "uuid": "059bd0ef-d94f-41c1-bfdd-a076b170fad7", "comment": "Malware payload (Dridex)", "value": "aff16426af0cb46e8b917ab3e20f6df0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004237, "uuid": "786f2edc-8fa4-4db9-afcf-6dfc1241578b", "comment": "Malware payload (Dridex)", "value": "6b28a31e656efe282b25dd6b7b82827d8e391c55f79e7ad1acea12da7557b075", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004237, "uuid": "37e1eac9-84a2-464a-9e61-6733391757c0", "comment": "Malware payload (Dridex)", "value": "ed70caf2d316e874a8797892eeeaa28d294694a0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004237, "uuid": "cef7191a-a8d1-41e6-92af-7f38c57fd72f", "comment": "Malware payload (Dridex)", "value": "5750b41c12943d4658b37f243c62d5117d86002058686a134230f16519deea718dc29f3722d9c58260b6affdd11cc5a6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004237, "uuid": "c630f367-c597-4f0d-91da-3f8dfdcd2e62", "value": "4824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004237, "uuid": "f8aa0680-976c-4064-b561-89c905a72374", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004237, "uuid": "fe02ce0d-4055-434d-9fea-7aed0d717d77", "value": "3072:I9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:I9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004237, "uuid": "6cb91d32-0801-4d8a-b775-d6dc0590b03d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004237, "uuid": "c7fb93eb-edf9-4cf1-aa1a-c30b27f89b42", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004237, "uuid": "2cd145ca-1cfd-4d1f-9f54-fcea7ff23675", "value": "6b28a31e656efe282b25dd6b7b82827d8e391c55f79e7ad1acea12da7557b075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d477625a-86e8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615962012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962012, "uuid": "c5f13f37-bf3a-4c68-9b65-46ad6525cff8", "comment": "Malware payload (AgentTesla)", "value": "17ac4e2e4ec9d661098f2709daafc758", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962012, "uuid": "153302d3-2323-43df-bdcc-9c4ed97727ec", "comment": "Malware payload (AgentTesla)", "value": "6b420fccd0de12888f901e34db6061d2e1d87263c06bbd04253f4dc85b383241", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962012, "uuid": "0ca74f5a-2bc8-47df-8743-819608309d9d", "comment": "Malware payload (AgentTesla)", "value": "8f01586bb1591b414c86ab8e7d68256d2ff8d6ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962012, "uuid": "a350faae-7630-4697-bfd6-d320125bf359", "comment": "Malware payload (AgentTesla)", "value": "85c5e96c566a0fcc586581a8f68711967c0aa8970744e70c1ca6b01030b32a16816223eccd791e4b345a947afd02cf9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962012, "uuid": "0b709eea-5ef3-44f5-9b99-08933fd690c4", "value": "44A27CF4BE007CE5B66F526BC969EEEC433A333295CAE4C951A977C21663270FD01806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962012, "uuid": "95c4f944-7620-4178-9df7-b3ce5e93be03", "value": "384:G70p86l3IPVPbj8ko7BcS0OKFrFEBb+4KKVZIftQqIaGMM3HQFN2O+pq5gGaKV4v:G7C86yPJoB+YKFSBbHZb7JQFUpq5gGba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962012, "uuid": "ee1dc5da-1776-498e-bc18-ad4965198797", "value": 22461, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962012, "uuid": "2c580b6c-f525-4911-9dc0-ace87d0f1cce", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962012, "uuid": "01f13eb6-a4d0-4d2f-b171-ce87f69a3825", "value": "INQUIRY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3d6af6-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615969165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969165, "uuid": "91c8cdb1-b857-4ebb-8802-7c7d29892318", "comment": "Malware payload (AgentTesla)", "value": "2e3da5883a53167a5ad87858846b83f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969165, "uuid": "91f13668-2899-4fbc-9dda-0af59ff85104", "comment": "Malware payload (AgentTesla)", "value": "6b4a6855381915ebdb96d720a10cd571f6309ee86ab7e0a71e75bdb95d2a786d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969165, "uuid": "9e5ce3b7-3fd7-4d27-b874-60e110229aeb", "comment": "Malware payload (AgentTesla)", "value": "43c86058ee1d9d341801282a0d7fdf7649d58d5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969165, "uuid": "649c85f5-e9a7-419c-b2d2-e31806e99a2e", "comment": "Malware payload (AgentTesla)", "value": "4d3596ce768ad6673ec3ee93ffc3815f4ce3b97db7bcfaaf52333897740d8f246ea60ec210c966727fe9d67f2e5fd33e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969165, "uuid": "c1a02b6d-3034-49ea-955e-7c262dec288d", "value": "CE250129033C6702E12927309892A52947F4E94532B6D7F5AEC1BCCD3D5E784DAF12FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969165, "uuid": "4a5a57aa-da28-436e-9d96-eba385f5e37a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969165, "uuid": "afa404c1-fa57-459d-93b1-be55f7ff3f7c", "value": "12288:xUsE1riOxC2XOmXrCp6atKHJFe6QuHp7mNKfmJj6LKgRoJIAdTf4U2Wo:0WOdXrKEpF2uHp3sjaKg364U2Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969165, "uuid": "317e2f1b-efea-433d-9279-3fb62b9e8a82", "value": 970240, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969165, "uuid": "861b65e3-e173-4e14-93af-2bdd44770f08", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969165, "uuid": "214fafc0-9142-461c-a04f-c0b6c56a914f", "value": "RFQ J893- PR#28201909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94de46c7-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001848, "uuid": "1ee189e5-a015-465c-a148-4c3fc04a8dd7", "comment": "Malware payload (Dridex)", "value": "60a51dfa6dbbf8e15c2adb6dc71f33c1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001848, "uuid": "6e8dc618-d759-44fb-abcb-de964b918a45", "comment": "Malware payload (Dridex)", "value": "6b8a17056ad98f1c56149ce683e6a02a8060499d58371028d300d2f648058b72", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001848, "uuid": "0c0b86ce-a1a5-4b3d-9f64-8b0d63696b80", "comment": "Malware payload (Dridex)", "value": "dae8dccf23216bb6a5d1b88f9e645e26aeab3ae6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001848, "uuid": "24bc1690-bcbb-496d-8f43-1901815b1059", "comment": "Malware payload (Dridex)", "value": "3f3d634bb5e95c185c0a41a1413820df682e0cb6b1ab9cd61443d13cd7f3a73350daf710a7621319ed60da4bde7333bc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001848, "uuid": "6b8c144e-f504-4bd2-b1aa-7923dbae5a28", "value": "5024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001848, "uuid": "958c1881-b8b3-4592-9e9b-70c7210b094a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001848, "uuid": "b279504b-8ee7-489e-9b51-d3f0186a6ab3", "value": "3072:r9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:r9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001848, "uuid": "b8ad53c7-2c3e-462a-89b6-7640c17ec7ea", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001848, "uuid": "08ae2ea0-72c7-48fa-a39e-cac82b405f30", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001848, "uuid": "40a9f231-3511-4763-812f-c0eb38e62b52", "value": "6b8a17056ad98f1c56149ce683e6a02a8060499d58371028d300d2f648058b72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4913135-874f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006196, "uuid": "855881c9-f3f9-4432-8b16-e592b504b551", "comment": "Malware payload (Dridex)", "value": "58c5aa7b5a90e4cd6c0927237d13cffb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006196, "uuid": "32f72c2b-b7c3-4637-b0cc-7a85d549cc19", "comment": "Malware payload (Dridex)", "value": "6be21536ebab26794ffb7f9187940c95c1b8ef9b6bd7dbafe3507bdb0362234b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006196, "uuid": "28121ee5-2584-4fa4-85b4-6ac3e342a205", "comment": "Malware payload (Dridex)", "value": "51d5c097dbc614e69ca317141dfef1655bdc1c3c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006196, "uuid": "9825a72f-283a-4df8-b7a5-25eb0491ed40", "comment": "Malware payload (Dridex)", "value": "7f34c4303b61f1b4ac0088852a488d9830306cee582bad2a51a6b83003906be3aefa1eb40186ff5bfd64e790b98145c9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006196, "uuid": "c9f5613d-bcc6-4c22-93da-97a947b5c611", "value": "4E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006196, "uuid": "673ea798-2694-4d26-b28c-baa34106afcb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006196, "uuid": "2d786afc-308a-4a29-a008-a1f11700f5fb", "value": "3072:m9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:m9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006196, "uuid": "234b1c97-d3c0-4a5e-983a-31bc6e99ae01", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006196, "uuid": "b4e84cbe-29f8-4d58-a6d6-4efd3604c9ef", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006196, "uuid": "240181e7-aa55-4dc2-95bd-226c4f4dc106", "value": "6be21536ebab26794ffb7f9187940c95c1b8ef9b6bd7dbafe3507bdb0362234b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb4df63-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1616012892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012892, "uuid": "e4288fd7-7261-4a2c-bffd-51ea7d0b6fa3", "comment": "Malware payload (Vjw0rm)", "value": "2e4880c0a894ff9dc5936c2d5827fab1", "object_relation": "md5", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012892, "uuid": "21d2437b-9e67-4cc7-ac95-8e166cf4ad2e", "comment": "Malware payload (Vjw0rm)", "value": "6bf6e8ff133c8bb105f3169405560a6c80bc36ab3addea2a603811eacdd1068e", "object_relation": "sha256", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012892, "uuid": "a879d687-e00c-4eb7-a65f-ad87a41b456e", "comment": "Malware payload (Vjw0rm)", "value": "b6302cd52f6a81b0e72963057061df72ef4838a8", "object_relation": "sha1", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012892, "uuid": "4fa472e3-09a9-484f-87f3-8d70850d9900", "comment": "Malware payload (Vjw0rm)", "value": "a664d31b9481baa9bc5b2f6e0a708a06876678b67401c99ab70bd416d9ff02093decddca43e0af0733c9774f48e3e058", "object_relation": "sha3-384", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012892, "uuid": "f3162e3a-51ac-4e97-b6cf-2861130520f7", "value": "F0810E9C285BC63C53D27B8A802DD148CDF548B47F68D2B5148CDAC5360E97986B29BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012892, "uuid": "8133e1da-80fe-4103-9465-0e55ef829d9e", "value": "96:SABNo5DRk2c24ZRMHXE6/BI/+Ys+fJUDdQqR7bJyKUJOS4UK:zSa2c24ZRMlBImYs+fJqfRfVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012892, "uuid": "fc927135-95f6-4031-a175-b5f6c4756582", "value": 3879, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012892, "uuid": "89faf24e-bfd8-4a7b-8a0e-c2e88504e0de", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012892, "uuid": "50cfaa1c-d3e6-47a4-9703-327f5ea41ab1", "value": "___Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd6875b-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "9472f9c4-d6fc-4cde-bda1-3b76d5044a33", "comment": "Malware payload (Dridex)", "value": "d662ae0565c5871094f5e06bd4d883cb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "9e54397e-2e4f-4720-9b24-5ed00465682b", "comment": "Malware payload (Dridex)", "value": "6c304b943d049074e6ed45e65bfe606815c3da94df3d7f337b39425b54b863f9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "7f7a02eb-75c7-40e8-82f6-c07f230e824c", "comment": "Malware payload (Dridex)", "value": "5153dddf4d13107bcab6821369eecb1ca03e730e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "419db5df-3d93-41c7-a38e-eac3da45d6dd", "comment": "Malware payload (Dridex)", "value": "12929fc3fdc7655c1d428bebbdc8292c67fd56d8f57301514bbd37d17ae449f3ea92ef8a7b19521d61532b552eb517dd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "b69a7756-52a9-41bb-904d-1441dbfdd146", "value": "8124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "998713e1-6d06-42a3-8996-50ea89d539e9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "47a7ddba-58d6-48c4-b116-338eb5e7f4e4", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003719, "uuid": "f1a1ee8c-6ace-4dba-a5a3-c6eb8262a0e7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003719, "uuid": "4c76df27-fa99-42b2-b10a-092d3b18ecc2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "8adb90dc-79a8-4cf9-b7bb-79418292fcc7", "value": "6c304b943d049074e6ed45e65bfe606815c3da94df3d7f337b39425b54b863f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9c812e-86ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1615964089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964089, "uuid": "43fde558-0694-4d20-9c97-4d730733a869", "comment": "Malware payload (Mirai)", "value": "d497d59860f65effa5ad222851efa3a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964089, "uuid": "86cf5087-dad2-45c5-8cd0-a2e90fec0006", "comment": "Malware payload (Mirai)", "value": "6c5679eb7bd905b3ee86ea5770dbfd8fb50be013c6e93ad1df8fd75a6689d523", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964089, "uuid": "0286a54f-6222-47a4-88ab-f303028dbacb", "comment": "Malware payload (Mirai)", "value": "4a76040bb01b02df3d68f15d5fa77a2acfcd75a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964089, "uuid": "28c8145b-a4c4-4a8c-bb11-331cbbc53c0b", "comment": "Malware payload (Mirai)", "value": "bb56a320c6523d2ceca3420a584041f1f9e94003668c1a23e942d182cdabe2f284e9aedf50d3a15709a99c0da29414f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964089, "uuid": "f511f27f-6774-4135-8773-889bb70acaea", "value": "19132A42B31C0947D1631EF02A3B97D0E3AB7AD22198F688360E9B59C1F5E375246ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964089, "uuid": "a93f82e7-5f85-4de6-af6a-c1a1dc570ad2", "value": "768:ErNejAEwaQqe875gbkH5EJT2Jpn92DkAmiMdT2lyI41ECE1:rUqTeUcD3jg2cIIEl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615964089, "uuid": "b69d54eb-08d4-4f4b-8f65-9c01b76f98cd", "value": 43572, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615964089, "uuid": "ff891fe3-f55b-4716-b042-53565b359a83", "value": "application/x-executable", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964089, "uuid": "74451089-6579-412d-b56c-e94bcda5d6b9", "value": "SecuriteInfo.com.Linux.Mirai.5568.30698.20986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b94ee81-8765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616015388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015388, "uuid": "b819631f-1443-4bea-8599-3fca2dbfa838", "comment": "Malware payload", "value": "3c50b616df6237315df181b078349fdc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015388, "uuid": "907d7c08-8e41-43c0-8f79-754598edd376", "comment": "Malware payload", "value": "6c9c22a5422b27dd7da71d264df7fc43e33a589d18d305f581747e8e1d971614", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015388, "uuid": "6f2f04dd-0047-412a-ba95-ddeb9584f847", "comment": "Malware payload", "value": "f981218e75e70d56c1ec978661d51889fd3a56df", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015388, "uuid": "cfa76487-abac-43a4-8896-56bdf05d124d", "comment": "Malware payload", "value": "73b0f5e11626c6108e81782acdd407235e5ad1717220e852b2fb8f4bcc560f551a285bf775afc8d737ef28aa19d9ae64", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015388, "uuid": "135c784d-4b8f-4720-9f34-557217901e91", "value": "1224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015388, "uuid": "cd5fcb5d-eb71-4c79-8672-36643d2d1f6a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015388, "uuid": "3fdf241a-d677-4734-9f46-eaa2a9b08120", "value": "3072:r9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:r9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015388, "uuid": "de1d5477-64df-4068-9aac-d65ac18c30c3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015388, "uuid": "3ceeb886-c1e1-4b2e-a859-105a7e2e473c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015388, "uuid": "165d2228-8f88-4a96-a558-7564b3cba2a3", "value": "6c9c22a5422b27dd7da71d264df7fc43e33a589d18d305f581747e8e1d971614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2bde70-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "b92d7c31-93a8-47b0-a5c5-59f823a9b1f6", "comment": "Malware payload (Dridex)", "value": "080c3763a7bee3f8f8f0636132ab8482", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "54efc255-9aee-43da-9995-4d0d7baac474", "comment": "Malware payload (Dridex)", "value": "6ce55a2e553b86080d7c2fcfc9b64b3b07111b631436ec465113fbce890bb09b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "51d6aead-d007-4739-9dd5-8a0af1b067ff", "comment": "Malware payload (Dridex)", "value": "e776f1afb09afc35aee412a7d7eca5d22ba37f42", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003845, "uuid": "1e0a8e9c-7164-4e0f-b1c7-d80ba5bfa993", "comment": "Malware payload (Dridex)", "value": "9b4eb15484db69dee9fd685fd47d8f2ff8beaf359f7e08ff93b45b044fc9cf804b3a78fa9c414fb7220ae22bb0460511", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "82d59779-fb52-4c94-b92b-74516d8696fa", "value": "AC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "393497ba-1358-4aac-b723-202e791b915f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "d8635882-7479-42aa-bbed-f40f401845c7", "value": "3072:L9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:L9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003845, "uuid": "30688a36-6f3c-4884-a6af-aef7cfd3bda8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003845, "uuid": "44fa5975-f5fc-4272-95e4-cc7cd1d50ebf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003845, "uuid": "e130fa3d-07b5-4036-8914-5ab51aeaf5b2", "value": "6ce55a2e553b86080d7c2fcfc9b64b3b07111b631436ec465113fbce890bb09b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1251b07-86eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615963294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963294, "uuid": "225b0b2d-6b69-4037-8599-4db23e073288", "comment": "Malware payload (Loki)", "value": "180f505fb7d573362f2bfd48de287e59", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963294, "uuid": "c721be23-3c2d-4c77-b553-099d176dada2", "comment": "Malware payload (Loki)", "value": "6cfd9f179d021e580950cba5106cb04b5bb942d5676c881cb6a405c7673670d3", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963294, "uuid": "0811af5c-47dd-4119-bd78-790e2331133e", "comment": "Malware payload (Loki)", "value": "a4e570e1dba478510350179b5ca422d8839fdb9a", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615963294, "uuid": "3fa8081b-886e-4515-ac15-e9dd42eeb059", "comment": "Malware payload (Loki)", "value": "c1a78db67041a5830c54af33f2fc5303e2c1855e2a4cbe8adf205ca45ddb8ef097ef518ec5ab1aad1acac8db562618c9", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963294, "uuid": "7d632527-7446-47cf-815c-67a1394b958d", "value": "2D6423BA621FC9135C6FA1949823A0CBC66003475DC24F64A9F618FDE432B2D85F99FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963294, "uuid": "2cfcaf4c-1966-4d8e-a713-8e02fe37d423", "value": "6144:b+Ie9Y9gmYEAVbYnIyFXtWY38KVQf4eH3xUce7d1I0kfdQ4A49Hd:bOGgweYLXPeXLI1IHfBA4Jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615963294, "uuid": "c18a6da8-8b62-4beb-b079-7ed8560dc199", "value": 322566, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615963294, "uuid": "df0f9a5d-e4e1-4117-976d-c298351a5b22", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615963294, "uuid": "4a20ba7e-e7c0-47bc-84a9-05f9137887b3", "value": "_AWB_CI_PL_BL _0984770_xls.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdd0b10-8758-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009920, "uuid": "1ac1046a-9d76-4063-8366-b2f68ace3b88", "comment": "Malware payload (Dridex)", "value": "288478300aaeb077babf82f473b54d36", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009920, "uuid": "86d57352-eff3-4c20-a5e7-11c34de89103", "comment": "Malware payload (Dridex)", "value": "6d32e3592ab39c3bbe969dfea1581291f2b37f113a3f48e116469a81f3583dd6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009920, "uuid": "cb80c748-6bb8-4ae5-8483-eb05956727d6", "comment": "Malware payload (Dridex)", "value": "a3501ea6cb572e0a79c61496809f56ce68770335", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009920, "uuid": "a347d023-c53b-4d1b-af70-b4a3c0d3d5f1", "comment": "Malware payload (Dridex)", "value": "31679e22b337179edf55cd591b9cd355216da14dfd98261eadcf5432c48e53c836f73cf770af1223398d487cb734e1ac", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009920, "uuid": "c5ab2a44-4f0f-49e8-9e66-f75e61df51d5", "value": "2624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009920, "uuid": "cc190bc8-9720-4c2c-b6a4-7f14910afe83", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009920, "uuid": "cdbaf923-3414-423c-a335-e535f64bcb30", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009920, "uuid": "5b924aa7-3a2e-40ad-8969-a95aa9d62220", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009920, "uuid": "bfa73721-ff2d-47df-a000-f6ca0ecacce8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009920, "uuid": "502a741c-c5e1-4803-8ce2-091f1dd20a95", "value": "6d32e3592ab39c3bbe969dfea1581291f2b37f113a3f48e116469a81f3583dd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b74eaa-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003541, "uuid": "99a67ce1-f5e0-40d8-8a4f-c562c51e3793", "comment": "Malware payload (Dridex)", "value": "f87cf003853e64d2a1e4871abfbdca03", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003541, "uuid": "78fad95a-54dc-4cb3-9c91-fd2b4e155d3f", "comment": "Malware payload (Dridex)", "value": "6d8360238af71d8ae916b06243a86f266696c6f0b04597eb87ca3b8f8a63877a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003541, "uuid": "23708c7c-4551-48ea-a71c-3f965468de06", "comment": "Malware payload (Dridex)", "value": "f5663b7d3c193a9b92988308c801b74a6c53d9d1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003541, "uuid": "26abcced-65f2-4ab8-98f0-d06308abd8d2", "comment": "Malware payload (Dridex)", "value": "dadc0dca6f08cb561db80e2f9b9ad8fa3d923aeef852baef40d9024d4ad0366b302d8699bf846852689299fa07d19598", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003541, "uuid": "05169a8c-6c4a-416f-8838-776931c6b5dc", "value": "2724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003541, "uuid": "d32b400a-5e68-479a-9227-1eab07a66bcb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003541, "uuid": "6663c20c-1e55-4f3e-9914-d16ee2174708", "value": "3072:F9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:F9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003541, "uuid": "685d7549-ee77-4b69-8ebc-24284e60d924", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003541, "uuid": "49dcaf9e-9549-4aed-aa5b-3f81aecd795e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003541, "uuid": "6574ec3f-3b54-4a28-bd75-40d8a6fd0b1d", "value": "6d8360238af71d8ae916b06243a86f266696c6f0b04597eb87ca3b8f8a63877a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759cf0ef-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615968724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968724, "uuid": "5730eb24-f4d0-45f5-b8d9-4a9bd6332365", "comment": "Malware payload", "value": "6a845ba103296108ad6414a3c9217718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968724, "uuid": "7f5326a7-26a5-4910-b9e2-38a54894914e", "comment": "Malware payload", "value": "6d915396aa09593693247c54c4a91feea691dc6e5f4ff234791a6193d2b5ac1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968724, "uuid": "6d1d27a8-381a-445c-b19c-ca2aa1777bbf", "comment": "Malware payload", "value": "f3a9926564a7eaa68bf1623ebe2f6ab21727a817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968724, "uuid": "237d13b4-308d-4834-a532-5d448d287551", "comment": "Malware payload", "value": "782e447235ae0dcdd54a07c178fa395a1128248b1e3b8fdcb03035120c89c8f23a62673987a3496b694ab1740632bbb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968724, "uuid": "343f08ba-0052-45bc-9fef-8234cff171c3", "value": "45F40202BEC155B2C6721D325979AB21643DBD202F28CEEF63D46A5DDA701D0EB31B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968724, "uuid": "b838d1f8-a235-4f15-843a-0d0c132bc81c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968724, "uuid": "a571108f-1415-4575-ab50-d9c45ca6a533", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbDE8/hma/27kMlVjHfKQxtz1oV7svLThNKRC2M:U2G/nvxW3Ww0tDEc+7kMuQx11oVKhNK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968724, "uuid": "c036b2c8-ea8b-4c2f-81d2-5d50222e4945", "value": 759648, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968724, "uuid": "02c2fc0e-5cac-47ac-bac1-a96cf71a4fe4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968724, "uuid": "43f13306-9611-4bc9-b3f7-c9cdbdb31d5c", "value": "6a845ba103296108ad6414a3c9217718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9fa265-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkVNC)", "timestamp": 1615969382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969382, "uuid": "0cdda5a0-8212-4223-96f6-cd25fa7041e1", "comment": "Malware payload (DarkVNC)", "value": "5400a701c0e533f09652176253856568", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969382, "uuid": "8cdea062-9771-46f4-bab2-333fac31aa73", "comment": "Malware payload (DarkVNC)", "value": "6dabb536b810b343e17374dc7762923dbdc99ac5c0ce65222c2977d0c5a5a9a5", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969382, "uuid": "47e965eb-440a-4a6e-aa0a-1de5b9d19300", "comment": "Malware payload (DarkVNC)", "value": "482ed6805306064a482e0a82d0e0260613588d6a", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969382, "uuid": "38028e7d-752f-4b87-8aac-8fcabb55721b", "comment": "Malware payload (DarkVNC)", "value": "f324ce9fb674668aeb0adafc026ede17e330f09fa225c7758860b63034d60cb490acacb8d9dceb5052f7bf5e749b8d34", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969382, "uuid": "e0924dc9-b1da-41ad-b5a2-6fe6c7a51af9", "value": "1E0643456F474A19FE33A1BECC8EF01DC6C187781E6E306D96BA8649B1339184FA4DB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969382, "uuid": "f7c253a7-14df-4808-971d-ac834d4867e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969382, "uuid": "e9806611-0414-4fed-8fd1-7dc4de4adc15", "value": "6144:ojFAvk0XXSMSZw+S3DKInoOJPN1/kax9fb25BX5qNjz5RIeExdXRcWaYV4oQh+lD:oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969382, "uuid": "804cec25-15e9-43d3-ac76-fdc0bc1946d5", "value": 3858432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969382, "uuid": "e0fd4deb-ec1e-47f4-b7dc-dc0607d4d70c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969382, "uuid": "164149a7-63ad-4cad-a36d-54e6ad60342c", "value": "5400a701c0e533f09652176253856568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b74d35-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017477, "uuid": "fcf63fb2-f7a9-4650-b12c-a3a83396c346", "comment": "Malware payload", "value": "d8223cd47b3c9ca5a8575f4534003b65", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017477, "uuid": "5e2b1e5d-f2e1-4188-a795-106a14c172b2", "comment": "Malware payload", "value": "6dffc0c7cb2c0f4027460da2228ac0423b9504b4f56dbe67ec31dae6fa3e40fa", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017477, "uuid": "bd608590-d731-4a88-a8d0-e1388311597e", "comment": "Malware payload", "value": "269f1b784275ed862fd1e1928a461a113e07482a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017477, "uuid": "d0843945-9b74-49ed-950c-3d89a92cdf23", "comment": "Malware payload", "value": "9675227a746c634b108cf123dc64ab3e679feed8b1991139bc0ecc5c7818f64f35a9fa9d4b9badd0fdcf8f3fd526a196", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017477, "uuid": "6051e0b1-0b7e-4f2f-b4a7-b2bf82e59682", "value": "C224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017477, "uuid": "cc5e2826-2498-4cdb-9b70-b11164ae2afc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017477, "uuid": "09cd36ff-b347-4453-9d58-d8db87cc7ff2", "value": "3072:s9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:s9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017477, "uuid": "74cb88a7-04d8-4d08-b8a8-9b950065f74c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017477, "uuid": "c5b1715c-2a3c-40c0-89fe-cace11ee1ac1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017477, "uuid": "614e2c78-0423-4a7d-a6eb-89cdbcd4d48a", "value": "6dffc0c7cb2c0f4027460da2228ac0423b9504b4f56dbe67ec31dae6fa3e40fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793ce7af-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003949, "uuid": "c2fad1c5-d7ae-4f75-af11-36f05037f32a", "comment": "Malware payload (Dridex)", "value": "e28e191a4acd340526a599f712caf4f3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003949, "uuid": "9fb841db-9de5-45da-a1f2-75628202eedf", "comment": "Malware payload (Dridex)", "value": "6e0813c2a100cd8106797419aa068cd74facd957b2ee151cf72550a2bd85b68e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003949, "uuid": "bc37a988-f8bc-4a5e-8350-dc6abbbe2f04", "comment": "Malware payload (Dridex)", "value": "47f292714754e5f6ef21e2a98f29494a9381f6d6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003949, "uuid": "3438a469-8e61-40bc-8717-6a8a97c114ee", "comment": "Malware payload (Dridex)", "value": "2447aa0c64fc46a643ced7be8c3f50b4f9f88e5d5a667923b79c4f9d451e5ca6979fd88661e970cf8e584b381ecf0a91", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003949, "uuid": "ec1ecc03-6051-4777-bfab-a8b7042c3cd5", "value": "F124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003949, "uuid": "34c5c220-6f89-473b-81a4-cdc1d73dac69", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003949, "uuid": "7f7e1592-3f66-4d2c-b1a8-4c0f0962e831", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003949, "uuid": "30462d36-1918-43b2-a8e2-d5ae2f1a5e4a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003949, "uuid": "d99a2444-ca62-44c8-a860-d647bde6e201", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003949, "uuid": "fa1099e0-1091-491e-a09b-721d91bf83a0", "value": "6e0813c2a100cd8106797419aa068cd74facd957b2ee151cf72550a2bd85b68e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50d3faf-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004049, "uuid": "0bf46e58-7e46-4ad8-b060-a4caf9567b9d", "comment": "Malware payload (Dridex)", "value": "97bd1f62f8f31453fa6512b2ec6d33ee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004049, "uuid": "dd2c6744-70ee-4bc5-9b33-a751222a5c10", "comment": "Malware payload (Dridex)", "value": "6ea707ccf0b86f9cefb3ab43cc40c74b3117e466bac84c2bf84698bf6655a19d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004049, "uuid": "bbb43c15-bbe1-4338-9707-54cd16084e07", "comment": "Malware payload (Dridex)", "value": "3e9816d9e60a42e99afce19ba6c751546a973982", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004049, "uuid": "d714427d-4018-4cad-beae-87f60c29ce14", "comment": "Malware payload (Dridex)", "value": "746a10b63ca262a787afe88afc2a3c737791a68dcf555719aa03d45647287541829d58b8e6a599f63397ee6d6b78ad2b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004049, "uuid": "a09dde05-ce16-42f6-9655-1ae39a8d19af", "value": "0024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004049, "uuid": "fc252ca1-8c74-4ea7-9f95-c871aaccb62d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004049, "uuid": "93540867-155c-4de0-95ea-f52884bb98d2", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004049, "uuid": "ec4b24d4-473e-451b-9b72-b64f2bb0f826", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004049, "uuid": "a7159f04-e738-45e0-9880-30b1da78edb5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004049, "uuid": "9374482e-f474-48e1-ac3c-b6b314e7eef4", "value": "6ea707ccf0b86f9cefb3ab43cc40c74b3117e466bac84c2bf84698bf6655a19d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d45abc1-8768-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016868, "uuid": "ad8665df-d92a-4337-a67f-843d3ce3514d", "comment": "Malware payload", "value": "55acba1491245c91054b158ffccfa47d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016868, "uuid": "daa51caa-c2b2-40dd-a8ac-06abeb8706e1", "comment": "Malware payload", "value": "6eb1de969a38c77ed454964bc43df710a5f7d1a37b7fdfe0b996f57fe4a27a0c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016868, "uuid": "7abb714c-13a5-4ec2-b8b6-b8f84aa01d6c", "comment": "Malware payload", "value": "b6b10614b2789991cb62157e56656b25e806dca4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016868, "uuid": "8dbcd66b-b167-400b-a601-210f88b3a557", "comment": "Malware payload", "value": "6385bfc3dae64d87bf86cd5e2c7534408bfcde560286c99dab9f3a4b54159e58559456cd94b4c35f3aa7ff63cd562f2e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016868, "uuid": "aae45c20-cc7c-4996-b7d4-5ce13f4c9eab", "value": "AB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016868, "uuid": "c32cb5a8-460d-478e-a29e-02a69304d7d5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016868, "uuid": "ec147259-91be-414c-9328-15558a2b024c", "value": "3072:29Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:29Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016868, "uuid": "02955ec8-2254-487d-bcd5-890fec1ff194", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016868, "uuid": "2e04681a-cc74-40cc-9b93-adcdf01336ea", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016868, "uuid": "236035ff-9a3e-469d-8fbe-05b6f60e2c53", "value": "6eb1de969a38c77ed454964bc43df710a5f7d1a37b7fdfe0b996f57fe4a27a0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6376ce84-86f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615966117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966117, "uuid": "b52fb95d-ebb2-45f9-ba73-02f04645aef7", "comment": "Malware payload", "value": "be4309ece0c0f1f15119b8edec5c56aa", "object_relation": "md5", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966117, "uuid": "fc525a1a-dc09-4fba-bce6-ea0fde80cb61", "comment": "Malware payload", "value": "6ebd8de97e693bfd9cb1c21d085e39869ca2c0be0a46b7a389194c7cc6b1ba05", "object_relation": "sha256", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966117, "uuid": "e0f8f459-699b-4e10-9070-29e77ce76759", "comment": "Malware payload", "value": "4a3f877d2d685fd9310b39f62632d6dd40a59b6f", "object_relation": "sha1", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966117, "uuid": "d029be97-bf92-4900-9601-5a89d6ab139f", "comment": "Malware payload", "value": "8f6cc4b8a990529d2a49f202a38b95343ca34f23387ecf68d7d58c7985e2fa83f6af60440c12c51f28260f603eb6e417", "object_relation": "sha3-384", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966117, "uuid": "e96d35f6-611c-4298-bd3e-c7c7dd63fcde", "value": "5AB3010EE2155C99C639B07FE708E8F4690DB365A892F40B1528FA0579E99E70BDF0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966117, "uuid": "3cf8137e-e3b7-455f-8ca7-61dd182f8ca9", "value": "3072:+zOYPvsUtFARPULAZemMA5uAgz3xQGaoRVnfdCW3L3OO:+KMFAeErgzBQGNVnfdXL3OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615966117, "uuid": "1c922045-f4ac-4796-80fa-0f039605e5cd", "value": 116316, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615966117, "uuid": "4a21bacc-2949-44a1-8a42-602fadb227ba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966117, "uuid": "3f3ba350-85f9-4276-8884-b77cba11cf7a", "value": "6ebd8de97e693bfd9cb1c21d085e39869ca2c0be0a46b7a389194c7cc6b1ba05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6c2325-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615965833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965833, "uuid": "efce96f6-1c4b-4653-87d8-0e98d0841127", "comment": "Malware payload (RaccoonStealer)", "value": "7e482e491570380453244a9d6e4744e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965833, "uuid": "2c40fba7-ac20-43fe-82a0-fe9d396850ec", "comment": "Malware payload (RaccoonStealer)", "value": "6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965833, "uuid": "183ee5ad-28c3-41e8-a787-2b158abd1b45", "comment": "Malware payload (RaccoonStealer)", "value": "8d67cae338c2e3ed1211d423551b4707c820f3d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965833, "uuid": "2fcd861a-1f82-46d1-93ca-36ad7ece422e", "comment": "Malware payload (RaccoonStealer)", "value": "b9a241992ccc76f0d0bf339f81db73da9979a19b753006b9a2c731e9082d0673b31f5b85e72a4d7267806d4e0fb699ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965833, "uuid": "c5a2c61e-3532-49f3-a757-cddeacb8bac8", "value": "46C1E7017BE85733DAAE8B3508F2435152BFF71059538FAF74E4030AEC2619586937B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965833, "uuid": "daacfad4-1256-4c54-b786-56c35bef5c5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965833, "uuid": "1b8f110d-ad90-42bf-b809-0cf77d90fca9", "value": "96:NjJcUvjOIqFQTzz3znIhXPg5+kYQfj9cFtk68aezNt:NjdOIqKzDnuHkYQfj9DE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965833, "uuid": "998d475a-ad79-4e6e-9d5c-3856cc1a21e3", "value": 5632, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965833, "uuid": "2f690181-c841-499c-ba06-042d709d3945", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965833, "uuid": "eb8fcc71-0a84-4f95-8ba3-ce530a00bc3c", "value": "7e482e491570380453244a9d6e4744e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32785776-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001683, "uuid": "89558975-7ff6-412c-be11-b4d832d251eb", "comment": "Malware payload (Dridex)", "value": "3da2dbd732855ae6eadd62fd9d07bb92", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001683, "uuid": "20f59d0a-d0ea-4992-8d9a-ba4a513d2b32", "comment": "Malware payload (Dridex)", "value": "6fad0be9695eb607643ba24d3a7cfe54d38e2033a8111106aeff0150db25062a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001683, "uuid": "91fc618d-1649-415f-a8d0-8565456df581", "comment": "Malware payload (Dridex)", "value": "9865a83d61ff978664576e0bdd2c65c6dad95057", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001683, "uuid": "940f5185-137b-459c-a4aa-fbecd985e1e4", "comment": "Malware payload (Dridex)", "value": "ddc1ed166dcf002554824184065bde215d4986a1514398cc5b77b041eb88324b673947399d41041faa4d18c58f2f1822", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001683, "uuid": "1987bf08-bf11-4390-ab4b-d87d58eab678", "value": "8124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001683, "uuid": "bc55e2c0-b485-4a14-93c6-185c9ae09bff", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001683, "uuid": "af03277a-940e-4941-b7d5-3239fb92d49a", "value": "3072:gJ9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:gJ9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001683, "uuid": "1231974c-5a65-4507-a250-b1edb2af2c63", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001683, "uuid": "7663f630-9740-4f62-b955-c371acff0b2a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001683, "uuid": "2d76a89c-5327-448f-b257-d2c13ff5360d", "value": "6fad0be9695eb607643ba24d3a7cfe54d38e2033a8111106aeff0150db25062a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826e573c-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "96f94943-18ce-43db-bf88-b50ccd862f4b", "comment": "Malware payload (Dridex)", "value": "e00ba0a54b5d7e3a3ded51496d4b5c40", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "c2a5ad14-a7d7-4461-a0c0-82eabab5c0d2", "comment": "Malware payload (Dridex)", "value": "700453d270aaf4d0390c3fe1ffce54d26181a2a619f5ae57cf48798b2e93dff9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "f5e4069c-4025-453c-95b0-2f95b7d0b270", "comment": "Malware payload (Dridex)", "value": "2f0b81004939b287b132ba3bab2facc10af3d2cf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003965, "uuid": "72073114-b22a-47be-92d6-692aa2350ae6", "comment": "Malware payload (Dridex)", "value": "b72d31a65608e8bfdccd175644c6928354ed2c54ee69d7fd80324ad3556b20f389415c56090ee3cbf25d7440d8f959d6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "673babd3-7089-4f28-a719-b3165505889a", "value": "CD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "2c0ccfcf-978b-43c5-aac0-dc1a9f60d8d6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "16bf328e-e5ad-4654-9b19-75acc5d65b73", "value": "3072:m9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:m9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003965, "uuid": "70a645cc-1d89-4eea-a26b-5d9b7c783830", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003965, "uuid": "cc5e7b07-f679-46ce-97d6-5fa57b340db3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003965, "uuid": "5f549da5-fcb4-4ba9-90f0-75f953569760", "value": "700453d270aaf4d0390c3fe1ffce54d26181a2a619f5ae57cf48798b2e93dff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928c1a74-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001844, "uuid": "bb1d6508-e56d-4874-a541-cd1bf4884c51", "comment": "Malware payload (Dridex)", "value": "c0697c1c0986da9591342aea2b59f144", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001844, "uuid": "9193c486-f3c4-41b8-8d0c-14ca2cedd43d", "comment": "Malware payload (Dridex)", "value": "7046bde21a1ac619a4ff1b9356a80571c3ac77c7f705f2282adf529d245d7ba6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001844, "uuid": "8a86a7fc-c535-4edf-a40d-7eb9472254a2", "comment": "Malware payload (Dridex)", "value": "c3a3975ae549f5b03cca6cbea7c9670973c8654d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001844, "uuid": "ef7c4684-03aa-4a3a-b240-cf4d47d49bf8", "comment": "Malware payload (Dridex)", "value": "5b3879348980bcc743bf62e345d6b4e64b01df5c9343a78f975d2e822d3d8d342a63820cce1eff9b5d11e996ed99db56", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001844, "uuid": "201e8cda-4d60-4e49-bfc0-553add05af01", "value": "3624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001844, "uuid": "4687959d-33c7-4d4e-868e-9cecfa0e8ce4", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001844, "uuid": "b9d43c94-ea7c-4b56-89fe-b8d3ad5823b5", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001844, "uuid": "75cb47f4-b2aa-48b0-a0f9-043049808068", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001844, "uuid": "22e9f8f4-f34d-456b-ab1c-09afd42f589f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001844, "uuid": "9e808eba-dba0-4cd2-a83e-01709b72fa2e", "value": "7046bde21a1ac619a4ff1b9356a80571c3ac77c7f705f2282adf529d245d7ba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813b57cf-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615969603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969603, "uuid": "af2bb5c1-5d97-4d01-b1d4-9d341a79698b", "comment": "Malware payload (GuLoader)", "value": "3a5873b225a73a371da571b049736769", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969603, "uuid": "a83e634e-dd37-4600-bcac-5a2190edcffc", "comment": "Malware payload (GuLoader)", "value": "7068de816576226b18b18c1f28df595ef562a9e9b5774fc26a3020becfff5a84", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969603, "uuid": "65da10d9-135b-4a9d-a57c-c544ebb0f218", "comment": "Malware payload (GuLoader)", "value": "cef96d754eee38932e9579f2faabd231f516eb80", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969603, "uuid": "fcb7db19-0156-4c02-8570-71d2fa1ae382", "comment": "Malware payload (GuLoader)", "value": "428ae3abc3946c413b2f6adc9da8fb5a695171c0f7bfb13920673509521241da53dd081c3caef216148fab242ffabe88", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969603, "uuid": "f823648c-44b8-44b3-96e9-1f76e1ece4a6", "value": "F7934DA1B59957DEF204CA79C675A76C0791FC63CD008E2338A5AF17923279054FA31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969603, "uuid": "b8c9eaee-325f-4183-a7be-75019a2672b0", "value": "71968742d4a47f5a9aabc0f6892dc307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969603, "uuid": "e61197fd-933e-4dec-992e-91237c28be5b", "value": "1536:6CSQlmL1M08ZlhoilgcwHsMH9+kwti1csZ3:6CJlI1MrhTlgRFHAccsZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969603, "uuid": "f114375d-229d-4cbd-a321-61dc375621a1", "value": 95336, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969603, "uuid": "d836cafb-5a58-4b30-8472-c34274098a21", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969603, "uuid": "79479419-528f-4b96-8479-c9db42166bd9", "value": "ph.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f514052-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001839, "uuid": "ad62831d-1d64-47f8-aace-feccc3c11fec", "comment": "Malware payload (Dridex)", "value": "36e2c49aca067e99229edc1b10e73df2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001839, "uuid": "0d8c5f6d-22a5-42e8-b8d3-ce33c4befef4", "comment": "Malware payload (Dridex)", "value": "707ea2e0b3ce0984f22437a7ad090b0f07a62d3fc5cdf9605cea08049cf1c945", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001839, "uuid": "a8b03d9e-325e-4533-8d3c-0a416215ea68", "comment": "Malware payload (Dridex)", "value": "33ed14a92efa8cf70f2b83184632536ac98d5f5c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001839, "uuid": "0927ad2a-c946-4fe6-8a2f-763ece5898cb", "comment": "Malware payload (Dridex)", "value": "7b4646910ec9438504b786f5a625dc1a03f33a574d7f46df8fd451aa2ceb26e2757bbb8ef8958832aae1b3311cbfd390", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001839, "uuid": "68fe3392-aedb-4b8b-9a71-111088aaf195", "value": "5224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001839, "uuid": "19ad25ff-d8c6-4fe7-afe4-2f4c4e0e0479", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001839, "uuid": "ee60eef7-29f7-4261-8ddb-99496fa72e77", "value": "3072:w9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:w9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001839, "uuid": "ebcaccdb-a74b-416b-97eb-ae123abe9440", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001839, "uuid": "f44a5a77-6876-460c-aefe-cb63a15e3389", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001839, "uuid": "3d5d6418-29ce-4510-a8a5-03615e471814", "value": "707ea2e0b3ce0984f22437a7ad090b0f07a62d3fc5cdf9605cea08049cf1c945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fc2d5e-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010406, "uuid": "4e2c7197-4308-4fff-99cd-7773829360ad", "comment": "Malware payload (Dridex)", "value": "a0da5bd7e40f3741c1b554050734c422", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010406, "uuid": "4abd0fac-5069-4e84-a668-7bfb5108963c", "comment": "Malware payload (Dridex)", "value": "70d456c511deb455b0f12fed6393472b1223c45cfcfce49b65ba177c84c5b455", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010406, "uuid": "e1263c6d-1543-42d4-90c2-0305fdd6beb5", "comment": "Malware payload (Dridex)", "value": "8a70b962baa01cd592554bc336c0c8cf94452c97", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010406, "uuid": "421a588f-91a4-4bd3-b86b-d93ddead6fd8", "comment": "Malware payload (Dridex)", "value": "83893561a76dd0dd111aea572b0e4fcf3cd17eac23fa9809e2c647447fa1382bef2801adc4a5c86829b03e0e2f744b99", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010406, "uuid": "ce102796-ff88-4d2a-b6fa-15a8fa27d738", "value": "F624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010406, "uuid": "9d2c3051-8497-410c-b30e-565e5820b8de", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010406, "uuid": "8ae1d669-25d3-48f8-b32c-4ddb67099b14", "value": "3072:N9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:N9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010406, "uuid": "3c95f999-c419-4c3e-bdc7-c7cabb921e19", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010406, "uuid": "46538740-c927-4178-a92f-3b9440dc2662", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010406, "uuid": "b043ec1f-c263-4b34-95ea-835c01248891", "value": "70d456c511deb455b0f12fed6393472b1223c45cfcfce49b65ba177c84c5b455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979904c5-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615968781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968781, "uuid": "0f1dd0ea-f2b7-4ea6-9669-84c5fedcc1f2", "comment": "Malware payload (AgentTesla)", "value": "5e3158b80f363e8a064c43dfa2982636", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968781, "uuid": "0ac675e7-3fc7-4f08-9bd5-27239da3597e", "comment": "Malware payload (AgentTesla)", "value": "713f6b6d0c3582aab38b69f73ec7b92a68b88b18809f656bc86163089bde37c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968781, "uuid": "5a6637a8-6953-47cb-88c6-ed986bf5ef20", "comment": "Malware payload (AgentTesla)", "value": "775bc15cf88493b1b7df045e8e847fb7b61b858a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968781, "uuid": "19792b6f-1b7a-45c4-b2f3-e014c6b1ec61", "comment": "Malware payload (AgentTesla)", "value": "73446947db8b18ad8264bf7dc969b5f69acf7c2cb3ae187b78a0109803ea45b7db44b2ed16c466d23497a20936493037", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968781, "uuid": "722cfdbc-f8a1-4bc2-ab68-01c3f63c647f", "value": "CAC4028523B47B99E079177A0C784B0027F2F905A2B7D2BAED86B0CE0476744DBF9635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968781, "uuid": "0101b6d2-ae8f-4a13-a42a-6afe68919635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968781, "uuid": "686eeeac-5fc7-4445-8f8a-65735cdd82b0", "value": "12288:G91bxWBSj6LdP/7w4mqoZP+cO/mCexnsm3yhl09izMO2tP:GfwBS+P/7QcmCeu9h29iAOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968781, "uuid": "f9207abd-64bf-45b8-9ee3-f53381d644ad", "value": 574464, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968781, "uuid": "22e5414a-dbfc-4ad7-99b8-44af6a9b4fa4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968781, "uuid": "42c14302-eaa6-469d-b877-7a8f79454e8e", "value": "5e3158b80f363e8a064c43dfa2982636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a44a946-875e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012433, "uuid": "db08db03-24d9-4d64-8326-01c08b2f043f", "comment": "Malware payload (Dridex)", "value": "cb0c589d7e15968cef3619c481d5d84b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012433, "uuid": "59082ac5-2e76-4492-835e-3d8f1dfcfa31", "comment": "Malware payload (Dridex)", "value": "717a4bf822ef6112818c9e990bb4c676039e088dd70947c330809a3271ab1a07", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012433, "uuid": "c3ffd3c8-53c7-4d36-865f-91aa10487bcf", "comment": "Malware payload (Dridex)", "value": "f63de71670b524d9216b2e86c34366a4b2b47dfe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012433, "uuid": "7e21e713-7629-4104-a200-a323bb6e6c29", "comment": "Malware payload (Dridex)", "value": "b269f556a79b51373a1f6c6d392d84eb4bf4b65257c5fcb2994398044c8b4d50b28bb53b8522633c8c7d85e2884657dc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012433, "uuid": "5b6a767b-0dfa-41e9-9a26-9c253f1f9a65", "value": "AE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012433, "uuid": "d16319cd-38d1-4cca-9bce-545ec5018a61", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012433, "uuid": "cb75287e-fce4-404a-9c0b-2e8dac882778", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012433, "uuid": "58feda7d-14c9-4c18-ad92-721efb934baf", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012433, "uuid": "6963ae5d-6389-406e-a830-e8fe496b3511", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012433, "uuid": "b93f7c78-0a60-499c-b300-57bcc702ea8f", "value": "717a4bf822ef6112818c9e990bb4c676039e088dd70947c330809a3271ab1a07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0223380-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "a6f42e9e-25a9-4949-a7e3-fb4694245432", "comment": "Malware payload (Dridex)", "value": "b26defbc4f08a5287295d7c6ea3096c5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "bd593847-fd44-4240-a68e-23d7f136c972", "comment": "Malware payload (Dridex)", "value": "7181e84f6c9e439ea30b1f383452317816e5ce3ce795d743a250330d358cce08", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "41a3c98a-a5ca-4605-b316-276f5d4e24be", "comment": "Malware payload (Dridex)", "value": "f7bd50d54a1dd9e68c86dc4966813ec39733c3f8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "9b343b49-7f18-4326-97c0-5dd9d81292cd", "comment": "Malware payload (Dridex)", "value": "d7304e2213131f4649f047e8664f4642249f9be58d0804a26700b739412af00ac7b298ec4c11f070eea7c9552a763284", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "ff0b2d44-585f-4b21-b0fb-8176d20caddc", "value": "1224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "b8bd0593-a3a1-4a18-96d9-b9061ff2fa5f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "3f3cc46a-9dde-4132-b76e-6f4962bfba84", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003719, "uuid": "72dd9254-b8d5-45ab-ae0e-6757fcf312d2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003719, "uuid": "bfe2cc52-d3db-415c-b883-23e59099a42b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "da758e48-b8c5-43f4-b97e-41a71e520b13", "value": "7181e84f6c9e439ea30b1f383452317816e5ce3ce795d743a250330d358cce08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb9a929-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003685, "uuid": "6b2b810c-db9d-4f54-b2a5-b06a6444f1a8", "comment": "Malware payload (Dridex)", "value": "c916872289e7b114aa4c47e97c0f3cb2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003685, "uuid": "42ab6130-b4f4-4183-a0b6-761e647d78dc", "comment": "Malware payload (Dridex)", "value": "7198a5662d6459284ce7e025fdc9f0ef2cc705f0cde574a2f91af143fde326cc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003685, "uuid": "22ff265f-6070-4eec-b6da-4872df3cd3d4", "comment": "Malware payload (Dridex)", "value": "8392c36c090e244b252bc25474d3fdb91804b26d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003685, "uuid": "3e6b188f-7be9-4e09-87a0-ee50a5d97058", "comment": "Malware payload (Dridex)", "value": "f66f3a86b4215637562dcf4a1d729ce11d927a3496a10865d6e95b7c99bee1a85b404e4ad93166eab1b101420a6f4d81", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003685, "uuid": "867057ec-83c9-4669-b4a1-b7541fd1687c", "value": "1024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003685, "uuid": "6739748e-f33b-402d-b3de-ab5365bd91ad", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003685, "uuid": "483ed8da-4fc9-4eee-a635-a3eada593d01", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003685, "uuid": "3a222a63-7d6b-4323-b880-5051e9a34244", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003685, "uuid": "6b6e3bd7-63b1-409a-8dd1-ccbbf696c3e5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003685, "uuid": "307599e9-675e-4188-86fc-242260334170", "value": "7198a5662d6459284ce7e025fdc9f0ef2cc705f0cde574a2f91af143fde326cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1faa61-870b-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1615976819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976819, "uuid": "d0118938-546f-4a24-bb6e-142cbb45a522", "comment": "Malware payload (NanoCore)", "value": "5a5e2a93f0d6e82af8df0e41346aae7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976819, "uuid": "d410f052-a732-485b-bf7b-20c258acd229", "comment": "Malware payload (NanoCore)", "value": "71d7b07df0da5e590845076580e72f77f82515ef625548bcdb702027b779eded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976819, "uuid": "147aa2e8-0dce-4e08-ac4e-4607a1ec6f53", "comment": "Malware payload (NanoCore)", "value": "94111b6ea5a11f9c63b7ae19539315fc8be7108b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976819, "uuid": "8989b069-e869-48ea-b99a-45831d3ed259", "comment": "Malware payload (NanoCore)", "value": "8d4fd5542059b611f65f7f8e817e961b0cdaf55ffc57b10bf379e0aa4f69d0e3f0fb7c3b81e1a5fef2fa685f367ffa66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976819, "uuid": "f32ca09d-f5cf-493e-9a3e-59c0e600806b", "value": "BB15013907382B0BE52C62348C95A62503F8954536E2E7F2ADC17CD9399D798CBF11FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976819, "uuid": "2a54728e-2bf1-422b-965e-637cd203a000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976819, "uuid": "cbea84f5-7c92-4150-a4cc-5a960ecd0f2a", "value": "24576:vHbnWYXRJcHnSLqfnJF9uxp3sjaKg6k4U2VoI:/aYXMHnSL6F9ub8vxU2VoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976819, "uuid": "c5671a2b-2ff9-4a33-a8a0-5eb2df5a6b4c", "value": 960000, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976819, "uuid": "ff09cb2a-6476-475e-8fc9-b349a677952f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976819, "uuid": "6257cd69-4e27-4899-850c-709356fe1392", "value": "5a5e2a93f0d6e82af8df0e41346aae7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff0eea8-8766-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016201, "uuid": "9524ac2a-3663-4846-9117-bb702ad1a309", "comment": "Malware payload", "value": "3b233e212dc67b1a4588862223bb9454", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016201, "uuid": "9e739937-55e5-4a52-ae9f-e89c30d54eb0", "comment": "Malware payload", "value": "7200073f35cef6669574a901e508fbbff8025c8c71f112cf80829df43a904f2f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016201, "uuid": "026f9438-0225-4c27-94eb-d49feb01027a", "comment": "Malware payload", "value": "abdc0f5d2fa859f4105c1919ac149dd10621d666", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016201, "uuid": "86a23138-0177-49d6-92a0-cab07ae28e46", "comment": "Malware payload", "value": "48daaae391d73fbd5a560c97c1be7f1316e3ea5c146adfb6d4df9e65d978942d85e7b18b3c9d8de5c343c3f8d82264f5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016201, "uuid": "ade027d0-a4f4-44c5-bafa-2597a8663f48", "value": "DF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016201, "uuid": "9f7df6d3-fcc7-4229-9a94-5d988400a064", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016201, "uuid": "3abd1260-af36-48e2-b90c-eaa54181b83c", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016201, "uuid": "5aaa5054-41c0-49df-9839-e86018abc73d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016201, "uuid": "baa7934e-beb2-43a9-9757-76c360f4dfd2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016201, "uuid": "22a61746-e6c8-4e23-a547-b5326b7808cc", "value": "7200073f35cef6669574a901e508fbbff8025c8c71f112cf80829df43a904f2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4172f5d2-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004715, "uuid": "923a1e08-4787-48b2-b681-51b3bee2ca89", "comment": "Malware payload (Dridex)", "value": "e6b0e34e5430580a3d6dd1c6bf5e1df8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004715, "uuid": "d759ff9a-bc80-4f86-9a65-12860aff1cae", "comment": "Malware payload (Dridex)", "value": "7209dcecc66c3ecb037b3de994ad1b40c0df1961cc5b9332967cc4d2ee6a00c0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004715, "uuid": "6e53d99f-b79c-464b-9435-2b276b61c842", "comment": "Malware payload (Dridex)", "value": "fcb998fb8004c8dc59c75756477df6b4f9d11df7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004715, "uuid": "3ff00273-aef9-4907-821e-0f3a2ea198eb", "comment": "Malware payload (Dridex)", "value": "9d576479fd99b5c08d99411106aa34f6df17541da60f8a1dcd0c5f89fe92d510d0a0c0cc6667a19abd1594e53fff0459", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004715, "uuid": "6a710d1a-1e90-4c8c-887b-64e9194ec47b", "value": "6724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004715, "uuid": "8d0bd044-b04d-448d-94bc-576c949231dd", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004715, "uuid": "b7e80916-c544-418f-be61-52e1473af3d7", "value": "3072:k9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:k9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004715, "uuid": "678b7402-82a7-449d-858e-c1bbe8e4b9fb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004715, "uuid": "d078e798-6189-49dd-b869-020c219761e5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004715, "uuid": "c89d23a6-da88-4b1f-995b-ce9bdccd54d6", "value": "7209dcecc66c3ecb037b3de994ad1b40c0df1961cc5b9332967cc4d2ee6a00c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9be34a1-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "4ae15243-8425-4a59-9dd8-2cf462cae608", "comment": "Malware payload (Dridex)", "value": "2608ca8d198b0e103166fef15eaee02c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "cdcf594a-4cf1-4061-9660-fe026dd5585a", "comment": "Malware payload (Dridex)", "value": "720fd07f519925e0376495d66b939ec64be5d3773bcc12a1acdb0ca54b42a5cb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "ea86d5c7-57e9-48e0-a793-e44b4e8d407f", "comment": "Malware payload (Dridex)", "value": "077e656ee7708dca5834fa8205c7d96975321ee0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "e5cabd39-2132-495b-ad6d-3a9fc463ab28", "comment": "Malware payload (Dridex)", "value": "2c39f24361b5b78c17479749f512ac6cf126120789d12f3644fe048951b9e84547e246d2e2a2d39a1bc784726ba9add9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "cf7e47fd-f319-4eaf-a6df-a737bd56a8dd", "value": "3A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "79d21ec9-b1ca-47bb-8895-e16fe0fff587", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "4fb7b556-2043-4d2d-86c7-fbf7ed9d0c86", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003735, "uuid": "97a45d92-7960-4a1c-82bb-e1bbd2d96092", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003735, "uuid": "583d21f3-b373-4a5b-b1ab-b1454a79589a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "ea20a9a4-ef3f-4552-b041-ff3216b1386c", "value": "720fd07f519925e0376495d66b939ec64be5d3773bcc12a1acdb0ca54b42a5cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c36272-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003542, "uuid": "a331bc65-37e3-41bd-8ad0-f840b47a74ad", "comment": "Malware payload (Dridex)", "value": "9587e9e433ecb7283456f734bdf27e6b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003542, "uuid": "0198aa7d-6513-46d1-abdb-9e1fff01f0a0", "comment": "Malware payload (Dridex)", "value": "7216f8115c1ee3a1a531659ee12a68b729e57cd0ce863bcbf2386d0990b71819", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003542, "uuid": "5c6fa5ea-4962-4ced-a240-7adb571e5884", "comment": "Malware payload (Dridex)", "value": "246a92ff269f84de28481fca9b7d14ea95d38dfd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003542, "uuid": "4c3582c4-947d-42b1-8f1a-4cb7b2fbcc98", "comment": "Malware payload (Dridex)", "value": "84eebea2ae1309e1647e710d717797d6397b411945df48d1f349601ecba01d0b5a9993f11b9849dbd90f05c86d595354", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003542, "uuid": "925ff60d-3c98-446e-82a1-6614d0b4af43", "value": "7824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003542, "uuid": "58b3952a-b3f7-4a15-9f64-1130fcb8f225", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003542, "uuid": "ee6b6a7a-719c-419e-b31e-46cdf04e7eee", "value": "3072:C9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:C9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003542, "uuid": "fed546ad-1e02-4657-9dca-ab4b881da602", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003542, "uuid": "1b0754d9-ac1e-461e-95af-d934de93b981", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003542, "uuid": "b4a759b1-6aae-4cfc-9dfe-a4e6188d5ac5", "value": "7216f8115c1ee3a1a531659ee12a68b729e57cd0ce863bcbf2386d0990b71819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82efc9f9-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001818, "uuid": "fecb5f4c-9324-4ac5-b7c2-bae9df92b206", "comment": "Malware payload (Dridex)", "value": "2765538badef2f13e5cd131c406ca40b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001818, "uuid": "7ed1c9fc-64c3-4b93-b00b-1f825e4469b2", "comment": "Malware payload (Dridex)", "value": "725b924b6f286ad38736cb50631ff5b8223f1def52234f7beb64c9329d1c4608", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001818, "uuid": "60eba328-01df-4137-b078-e35b52316517", "comment": "Malware payload (Dridex)", "value": "3a0c1cfc97804342d9a6913cdf020fbb2c508390", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001818, "uuid": "56fefbe2-ef02-457a-bc6a-97c8dd43d022", "comment": "Malware payload (Dridex)", "value": "8e78b64050d9a4594c105fb41bc821c8905a9a68441e295394c3ca19212698e85b57232c0a215a34f662a3044eb2568c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001818, "uuid": "69450d49-9a9a-4fc9-8741-d72a6c985e65", "value": "9124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001818, "uuid": "5350285d-1995-49f0-a51b-a82733511b78", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001818, "uuid": "97894a7b-968e-4afe-95ce-c8b111afec59", "value": "3072:U9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:U9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001818, "uuid": "f69385cd-f8c4-42a1-82ad-2a7835604cfd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001818, "uuid": "f31b2932-680e-4ea4-9453-a77568bdba4d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001818, "uuid": "0c1f28f7-265a-4df8-a291-603a9bf3a085", "value": "725b924b6f286ad38736cb50631ff5b8223f1def52234f7beb64c9329d1c4608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce49f90-86b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615939638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939638, "uuid": "b63c92e2-9a84-4a99-a974-59fb7457e9d3", "comment": "Malware payload (AveMariaRAT)", "value": "b1a70658dfd87befce71413f554fe9c4", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939638, "uuid": "aae85147-ab37-4e51-9925-27af3b976381", "comment": "Malware payload (AveMariaRAT)", "value": "72f55e10eceb6023543cf9d3967bc5acc150728c2b724d3675f595f88b1a6f33", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939638, "uuid": "69c56b3b-47ae-4399-97ea-2e48e2022c6b", "comment": "Malware payload (AveMariaRAT)", "value": "e45e3a1651cf5252ac82537abfe2e27b5acb7082", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939638, "uuid": "02b54f55-28c4-4f17-92e8-e4e33b812188", "comment": "Malware payload (AveMariaRAT)", "value": "02433f36a0a37c5dbe114f62776fb25b1e37e0ccc56117e0b841df0394349f4f966d5a4a1e8dbb781ce5c1802260cad3", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939638, "uuid": "072b44f9-64b4-477e-b209-0565ebbdeb6c", "value": "2D019E37F5E7D6114429C8AFEC6E9F89E87001470F6955D1D0D084D78D4188A577D85D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939638, "uuid": "dbf804c8-af2b-4536-a192-657893085e05", "value": "12:xbIlEcT/yEZgAi3phyc8brdvkPGoXZ2elhyc8brdvkPCEhXtFZJN:1IecuEZgNpYcYrdMPGoJ2elYcYrdMPH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615939638, "uuid": "9ffb8656-1721-49f9-8a6d-910a1f54a2f7", "value": 665, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615939638, "uuid": "3fa9f64c-3fdf-47ce-a2a5-afe315a812b7", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939638, "uuid": "a426d52c-15bb-4e64-842d-a548e797e160", "value": "detect8.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fa17f1-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615962086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962086, "uuid": "d2afb1f6-06a3-469b-9b6a-e136ac9510b3", "comment": "Malware payload (Loki)", "value": "0a45f706215896d4b9aa1fd06059391d", "object_relation": "md5", "Tag": [ { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962086, "uuid": "bc213660-a83a-46b9-b044-b6e9e3b4b504", "comment": "Malware payload (Loki)", "value": "72f6b43d622e6657b63014c061b8971346adb0a318c73948efc9d637d0df4a8e", "object_relation": "sha256", "Tag": [ { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962086, "uuid": "418481f6-5144-475f-aeaf-c0cfb89d2322", "comment": "Malware payload (Loki)", "value": "a13d4aa8882a9567705f4bedcfb224c53bd54789", "object_relation": "sha1", "Tag": [ { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962086, "uuid": "8ba08fdf-cea3-4d0a-8124-43dedb6454e3", "comment": "Malware payload (Loki)", "value": "00744a6deb32a088b5f3bfc08240a55754e2e7d3e9279af1b8d5ddab34436754290e0cbf0402d1fe9b216eca1171e889", "object_relation": "sha3-384", "Tag": [ { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962086, "uuid": "5d021f67-a02b-49ed-8884-0433b788e1b2", "value": "8BC5330F79EA6F03D47F4DF7869B196A582ADC806A550843FB4C36D47433AB022E4B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962086, "uuid": "c013f5ac-28c2-4807-9698-9f66471a686c", "value": "49152:2wjQ/1EckJUTnMj+O4zoKjRQZr5hvUdzF7kpYY7vftxSi9d4gJL7d+8gKD:rQCcGUDo7XqzF7kpY+zLJL8KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962086, "uuid": "be08170e-d70c-4042-a7d1-3ffcacb74d0c", "value": 2744832, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962086, "uuid": "e69c3c8f-9a5a-44cb-a68c-24dec84c384c", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962086, "uuid": "95b5952d-8844-400c-b06d-06e898aaa601", "value": "R34-3-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a633af-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004208, "uuid": "1468538c-6cd0-4a5a-a3ec-3a678ff6aebc", "comment": "Malware payload (Dridex)", "value": "ccaad73e85f15753b017db27db0deaa3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004208, "uuid": "2a67e932-ece2-4eb9-9eba-bedab9f817e0", "comment": "Malware payload (Dridex)", "value": "7303ccefaf105e46252793721f9b6063751945f9958df93e3a68825cdf52baaf", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004208, "uuid": "d79ec39f-f51a-4307-b6b7-17e323f82266", "comment": "Malware payload (Dridex)", "value": "476ad13ebe9f9a9f5ad6b83a85261c3c02994e51", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004208, "uuid": "98b9dc7f-5563-4f3d-87d4-48db5017b4d0", "comment": "Malware payload (Dridex)", "value": "83f81ca4e505a990ae4c482ffcd4298d09ce08f25013aff2e0c010a7b1fb06896f037cf9a1b522e6096b413bedfb059d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004208, "uuid": "cb56d78c-36bb-4187-a164-f5b69ed073ad", "value": "7624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004208, "uuid": "6a304d35-52c7-4c02-ac8f-be9e33bad822", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004208, "uuid": "f3a8ace9-1aac-4e24-91da-a69c5dbcf48e", "value": "3072:/9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:/9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004208, "uuid": "7713479c-d7a6-4641-ad93-9d644f1c905c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004208, "uuid": "97bb77b9-08e2-4f01-9216-9725f94aced1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004208, "uuid": "824de709-0361-4e33-b8e8-3f5e8f3306d5", "value": "7303ccefaf105e46252793721f9b6063751945f9958df93e3a68825cdf52baaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295834c0-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010258, "uuid": "444fcdc2-df69-4cc9-8a4a-af143cfd6903", "comment": "Malware payload (Dridex)", "value": "b7d582f5e6534c0b9db6868c8f8d196e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010258, "uuid": "5e528e93-a6f3-486a-b338-a2f2033ec1b8", "comment": "Malware payload (Dridex)", "value": "7349f5f65c83d1f2a8417cb2abfbd086e6795cf713a09a78e50a9c7ac4c9062c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010258, "uuid": "99545ae9-3dad-4278-b69a-1b1dac12d61f", "comment": "Malware payload (Dridex)", "value": "2e925bfc677144de34f8ef3024a75ce47dc3a925", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010258, "uuid": "57231889-060e-460d-a63b-c05585c00900", "comment": "Malware payload (Dridex)", "value": "08f2c46b6b4bcb23991698f7ce5a3e2031453e1cf70de51564e800605c9e369127fdef26612ecb86f20c7056a3608c29", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010258, "uuid": "feb874dd-2ec4-4d24-859d-57795b0e7138", "value": "4824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010258, "uuid": "6bff226e-2ef3-4f93-92d9-608707b819c9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010258, "uuid": "899c6bfd-77bd-4434-8f48-bdeade5d6fb2", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010258, "uuid": "003dc932-dbd2-4694-8f4f-78f3d2d10862", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010258, "uuid": "5ae72cae-5c9c-47b9-869b-1b8f91b1c72c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010258, "uuid": "262e7647-1479-4032-ade7-02899b17e976", "value": "7349f5f65c83d1f2a8417cb2abfbd086e6795cf713a09a78e50a9c7ac4c9062c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e93341-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004511, "uuid": "3e4c6352-8a14-4850-886d-6250398651dd", "comment": "Malware payload (Dridex)", "value": "27540e1dcb9a1e25fe0625a5d9173c2c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004511, "uuid": "6005e1ca-0b0b-4f3b-b6d1-dc31ffba96e3", "comment": "Malware payload (Dridex)", "value": "7384314357c1cb9dbb7fdea3f177c4563cd3a5261aee4ea3b31e2c40dc26c351", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004511, "uuid": "e9ae6151-c23b-4395-9381-9efab1a8d54e", "comment": "Malware payload (Dridex)", "value": "93369ff5c0332b4afea05c0121be1777ac07a6f3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004511, "uuid": "cb829fb7-7946-4915-896c-96435917e41f", "comment": "Malware payload (Dridex)", "value": "4692db62a66858afe296461981b0f7f77d696ed43f5c2a1ffa9998cf62f1e1525858cd0620f571ff1f6124c1b16cfbc7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004511, "uuid": "c7896cbb-7bb5-48d0-995b-facff8ad9e1a", "value": "0724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004511, "uuid": "6bfb4ff4-ce02-4d1e-9e5e-6cbc1e2c2054", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004511, "uuid": "a341a3c4-03d7-4287-941f-24753c426e62", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004511, "uuid": "11511895-9df2-4fbf-b83d-8309935f2d65", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004511, "uuid": "e9685830-a119-48ab-bdbd-53162433338a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004511, "uuid": "929a018a-a49b-40b2-9733-9918ba262436", "value": "7384314357c1cb9dbb7fdea3f177c4563cd3a5261aee4ea3b31e2c40dc26c351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e40d38-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616002927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002927, "uuid": "179cfbb7-4438-4869-b96c-a1102c546641", "comment": "Malware payload (Dridex)", "value": "3c56dd3eae33d8b4182744327dffd67c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002927, "uuid": "5fc2fe16-0f5b-4540-9c61-4fceee2ef3ba", "comment": "Malware payload (Dridex)", "value": "7399ada0c638e76e82c47009b0bb492ec0983debef0b1cc8f87a41bdf9c43af7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002927, "uuid": "7f6100e8-3de9-4cbf-ae27-347ebb1b462c", "comment": "Malware payload (Dridex)", "value": "7db24f6ea717f84a1a48ea4f7ec1aa53e72580cb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002927, "uuid": "3de42e1c-04b4-40be-a68f-35541e37ffd4", "comment": "Malware payload (Dridex)", "value": "3b341129ec2ea89fc0d933acace4eed4314530cd98cf2f06f621d7b42c7155a5b1f38155c8ffcc6b4e563a4059ace4db", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002927, "uuid": "58ead1f8-fcce-4d6e-912d-5a23918dda58", "value": "3C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002927, "uuid": "68f50b3d-8969-4138-b2c6-29a40e85cfe4", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002927, "uuid": "87f8b52f-cf49-4eff-bcec-a2d51e91be53", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002927, "uuid": "5a8285fa-d8cf-4b26-99fd-e321f01234c8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002927, "uuid": "183a8f3b-e919-4a59-99d0-a047e654adbe", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002927, "uuid": "dcd359d7-bcee-462e-ad96-48e5929b1a44", "value": "7399ada0c638e76e82c47009b0bb492ec0983debef0b1cc8f87a41bdf9c43af7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b96f0fe-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001806, "uuid": "6c08345d-78af-4191-b3df-9d374d4bda71", "comment": "Malware payload (Dridex)", "value": "30929e6be2d698c6a5487b696e77235a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001806, "uuid": "5c863f6a-e4e6-4820-b2c8-4d1eebbbde14", "comment": "Malware payload (Dridex)", "value": "73b7580e24224ec4ea8d066a1819a763c740fb75ad719d789bfd4748ce9c0502", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001806, "uuid": "4c27f4fb-e237-452e-8dd3-a616c5ef2d1a", "comment": "Malware payload (Dridex)", "value": "4e1f2927b7c1954e89e0a8a3e9d5f19bab501e6e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001806, "uuid": "83ad5223-5151-446d-b217-ce41a57261c7", "comment": "Malware payload (Dridex)", "value": "174eefd6f976403af1f7819cbe6fa41c95b734116b4cb9d396737524e3b807af772ffa2b3f7aded58f93abe56b3898d7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001806, "uuid": "7b436e0f-9bb9-4fe5-9855-9622737cc11d", "value": "3B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001806, "uuid": "b42c3259-671e-448f-aaff-5b05c819bc13", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001806, "uuid": "73880e9f-969d-447a-bcef-fc8c42bf556b", "value": "3072:o9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:o9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001806, "uuid": "ccdecc8c-6acb-4563-a6fe-e837efe083f6", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001806, "uuid": "f969ab2a-16cf-4f65-9407-e13be13ade9f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001806, "uuid": "bb635663-e572-4953-a39b-d3891fbb0bd0", "value": "73b7580e24224ec4ea8d066a1819a763c740fb75ad719d789bfd4748ce9c0502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2e4f6f-8750-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006724, "uuid": "1627e903-a1b5-4144-bfe9-c7cd05c887dd", "comment": "Malware payload (Dridex)", "value": "62dba669d9c650bd08e9e526fa1ac94f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006724, "uuid": "1785c7d0-927d-4c26-a349-14532f830a27", "comment": "Malware payload (Dridex)", "value": "73e79153b1ab5e3c815d5a82dcdcc1739f9b69df5d9c4f92e2f45b4e93ff1a90", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006724, "uuid": "f4bf097b-f19d-4d62-89d2-60747c2e4acd", "comment": "Malware payload (Dridex)", "value": "36e2cba14df102109c722c61bddc995420cb6c28", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006724, "uuid": "78beba1f-74c9-4372-a0b0-9b6789f6b2b9", "comment": "Malware payload (Dridex)", "value": "632bf4895e4f4bc59f4073c7d4081320c0b1a00cb5d8b9e7b9047f837574f4b11bb33eb419632089a1152c3b457021cb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006724, "uuid": "18fe4417-3b3a-4d38-a3f2-0d286309f2f2", "value": "CB24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006724, "uuid": "3b39a21a-fefe-41d3-ab26-9fe3d05aed0e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006724, "uuid": "50b39f2a-0098-4d23-89ef-822fca48e74b", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006724, "uuid": "d5a9c3c9-2b4f-4738-8a0d-9be81dae400e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006724, "uuid": "2f338310-772c-4e42-a0fe-2a02bf52597f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006724, "uuid": "18dab430-7fa9-4bd0-8541-d0a5d34bf39e", "value": "73e79153b1ab5e3c815d5a82dcdcc1739f9b69df5d9c4f92e2f45b4e93ff1a90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d394b45e-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "ab5f00e5-9152-45d6-bdeb-602f5d65656f", "comment": "Malware payload (Dridex)", "value": "56b6781813254320b9f9d5f8ea9a2b93", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "74407a8d-8ce8-4da0-be74-5b6dfc3803b8", "comment": "Malware payload (Dridex)", "value": "73edc9b50c7a90f59234e29f09a146bdfe19a6cb934352d68a1be1ad92a71e81", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "578a97b1-09dd-4f3a-8b7a-94e50ecde8de", "comment": "Malware payload (Dridex)", "value": "37e02857a22cdffa6c8c4276a9e710dedb1aebf1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004530, "uuid": "b3875188-c1cf-4c36-9161-ca224c860098", "comment": "Malware payload (Dridex)", "value": "3bd986100a72802c1d46e241830498143217f5ed96edf6276316c37ea300ae9fbb978c0bbd63fec94f7934c4fa9f8fb3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "c24f9bb6-d456-4de4-b78f-cbade0196b60", "value": "C124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "31378988-9f12-4b75-9e91-b950ad15ab5a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "d88f5c18-9d52-4d49-ba9e-95fb14ed8bae", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004530, "uuid": "5c76d0dd-6567-495a-b154-8099540f5506", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004530, "uuid": "5e1aa5f8-170b-4ef5-b43e-6abfb2955403", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004530, "uuid": "3f343afd-5c72-466f-9c5e-134b8d834c49", "value": "73edc9b50c7a90f59234e29f09a146bdfe19a6cb934352d68a1be1ad92a71e81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aece5fce-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969250, "uuid": "4d58385a-dbdb-407b-8b04-7757f11e0041", "comment": "Malware payload", "value": "53f6085a88b29018218521fc53bfe959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969250, "uuid": "77cf5882-2bb3-4007-a0f7-5713cf1abfb5", "comment": "Malware payload", "value": "7416875c44dab7adebe7e6809228adabe17c38abae4bf9c6d49c72fd967621e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969250, "uuid": "9c3d1aea-d659-4db0-9e67-527b40518774", "comment": "Malware payload", "value": "12431511010c77e08129ed808e507c5c761ab8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969250, "uuid": "6685294d-479f-4fc8-bc89-05b4026a48a5", "comment": "Malware payload", "value": "5d70e6c52fadcc649ad65efa655ece2ee13c83437ac3b0ed63ae8dde35d65ab131f50563295f40779b1ae60f1b5fd61e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969250, "uuid": "f931c853-9459-496c-9798-cb8c0f1c019e", "value": "0DE4F202FAC195B2C5721D325938AB60687DBD201F248EEFA3E4592EDA701C1DB357B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969250, "uuid": "52cb9e8b-7c6e-4131-8a7a-97811672684a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969250, "uuid": "c734e058-78fe-4378-b556-0008a3c222c9", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbU82JP/ZvTelU1Xsbt/Y33/jLRp8c:U2G/nvxW3Ww0tUlRTCQWt/A/jLDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969250, "uuid": "e888d9f7-2a78-4886-b1e2-62929e1c48bb", "value": 657635, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969250, "uuid": "f24b47c7-047c-4cfb-89dd-dd5bcd61e4cc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969250, "uuid": "534637cf-73e2-4a42-bc53-e12c239a318d", "value": "53f6085a88b29018218521fc53bfe959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fce0a9-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004085, "uuid": "b97eafac-910f-43a0-9248-23312ec82649", "comment": "Malware payload (Dridex)", "value": "1b9e0c120c20353159ed9ef9e2242428", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004085, "uuid": "244505fa-a447-4795-9e51-cc388b8dc609", "comment": "Malware payload (Dridex)", "value": "7467fea494c6f2a0c19e1a7373740369411cb4fb5b278edd678eb7b0df9eb205", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004085, "uuid": "20622df5-036c-4509-87cf-c4fab9bc48ad", "comment": "Malware payload (Dridex)", "value": "ace5ab67a88d3c8de325a8f04593b9f0d9b7dabe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004085, "uuid": "61e1e24a-2431-48c9-b6e4-b2594f9fd22b", "comment": "Malware payload (Dridex)", "value": "17c54a27d2bf5568c1f3bbf636b09d0c9f511f02133121e6628e86d1a91b857697acfa191aba134beabb6ee131f373e4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004085, "uuid": "31154377-31f6-467e-9ad2-5a58605c9352", "value": "9B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004085, "uuid": "8d1655c7-0640-4275-a392-896fd431d354", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004085, "uuid": "ccc191fd-b2a8-425e-9a3d-d405f47fdb8d", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004085, "uuid": "5238c443-44a4-4ef5-908b-5b82e335149f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004085, "uuid": "6ce0cbe8-449f-432a-a5b8-14975eaa8bc4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004085, "uuid": "0da7385d-1b7a-4d28-bac0-699882fb3e7d", "value": "7467fea494c6f2a0c19e1a7373740369411cb4fb5b278edd678eb7b0df9eb205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f7be17-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009047, "uuid": "cac08a7f-9987-45d8-a293-e22b4336bda5", "comment": "Malware payload (Dridex)", "value": "aa6055a067d20e9b8419d9c0f67df65f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009047, "uuid": "d2d7af08-cb61-49c0-9f59-347413418298", "comment": "Malware payload (Dridex)", "value": "749738bf4bad65a438e369273977c83599c059f101a80119142510f53fb4c424", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009047, "uuid": "76478731-86d3-4c91-b330-6ec24d608a07", "comment": "Malware payload (Dridex)", "value": "0fe006efc07872b89c694b550b3f1a94fa771d96", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009047, "uuid": "341920f0-b86d-4d59-8a03-f2b5eee226f8", "comment": "Malware payload (Dridex)", "value": "e24341ae356116c01512844c8fb83f0b06698389e6b08afd9d70bde08a7db29af4ec0a4dff45f9f3d41ca9654b20de99", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009047, "uuid": "d8c2a5bb-8193-4f3a-8eb6-486ecc08b888", "value": "F824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009047, "uuid": "5238948b-f495-4a4c-9d50-245cfa822d1e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009047, "uuid": "a5dc9cae-d4bf-43f4-96ec-d57d591b0d05", "value": "3072:59Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:59Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009047, "uuid": "0ff47fd8-e4b7-4136-b933-0f2c6724d5d2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009047, "uuid": "370ab7c6-6625-48c3-9336-dc816cd4cffc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009047, "uuid": "a28e2df4-a42d-4c4e-85aa-9bbf1f007e06", "value": "749738bf4bad65a438e369273977c83599c059f101a80119142510f53fb4c424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7ad1d5-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003824, "uuid": "f869f2d7-6fd7-40cb-890d-d21e8647a950", "comment": "Malware payload (Dridex)", "value": "9e4ed96b7b1645b6e7f9ffbcb69afb8d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003824, "uuid": "2dfe3bcd-c12c-4218-bb77-9aa387b3160f", "comment": "Malware payload (Dridex)", "value": "74d6930b32e663f1809cfeb88b934a717a4aa8390a17fd37b3a85626ccc9fa62", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003824, "uuid": "f4226562-704f-41f3-8c50-6677844ded64", "comment": "Malware payload (Dridex)", "value": "107207dc937467aabdf83ccfef0ea018f7d72af5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003824, "uuid": "85047104-59e9-4663-af2c-c1a773d870cc", "comment": "Malware payload (Dridex)", "value": "2342446269e97865fcfc39339a79ea8d27e68c2c90cdc518ee9beb9b7574a40f132a0e172aecb2d98844978e932b4b7e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003824, "uuid": "d6ae3bdb-064d-4ae3-aab8-71704d28a653", "value": "5824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003824, "uuid": "2d6b503c-3a00-4af1-9789-534bca94cf63", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003824, "uuid": "00fd721c-c958-4a9f-a7ae-9216a466650c", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003824, "uuid": "3d362622-3a31-4f77-9a06-6879ae6433a8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003824, "uuid": "a0b73a5f-6230-41cf-af1c-d255bb6b1619", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003824, "uuid": "735ff3d1-52c3-4058-8568-fe58e58059c4", "value": "74d6930b32e663f1809cfeb88b934a717a4aa8390a17fd37b3a85626ccc9fa62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f4a662-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001801, "uuid": "7a0c7abd-530e-4ab6-8610-815073f3af31", "comment": "Malware payload (Dridex)", "value": "9e9be3cb97baf06b9c4aadcf2e7998a1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001801, "uuid": "3e378aab-4cb9-4fad-b73d-b8518b135e61", "comment": "Malware payload (Dridex)", "value": "74e07264d7ca8dc7cc6bd4bb9e1fa300542f9f35478a5234b4cd983522f85d65", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001801, "uuid": "5cc8489e-a508-4223-8e36-defe5881c331", "comment": "Malware payload (Dridex)", "value": "067927cef5d0dbdd82bc295c689b87ee8e0bb456", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001801, "uuid": "78db71bc-fc74-4a02-b853-fdd9ebc481b8", "comment": "Malware payload (Dridex)", "value": "2e934c3fc4fa9a8e0906e3b62fb7e504cb05abf7bf43432a5e0c9b7144a1f2b796f1e8c01cbe93eab2f375171a15e118", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001801, "uuid": "c593b688-c399-47e4-8e02-cf61870aea55", "value": "4B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001801, "uuid": "66bca379-beb4-4bff-a0c8-4d7254e40f91", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001801, "uuid": "1f624748-0d73-44f3-9e52-b1d6d8ac7e2a", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001801, "uuid": "068226ac-9961-4c1e-9fea-32967e93818a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001801, "uuid": "15920eac-9521-42f2-b974-152bb5731996", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001801, "uuid": "3eabc8ae-b256-445f-b038-3767c73cf16d", "value": "74e07264d7ca8dc7cc6bd4bb9e1fa300542f9f35478a5234b4cd983522f85d65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d694dc3f-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615969746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969746, "uuid": "6a3899d5-2b5e-4ba2-8cd8-94131f69dd7b", "comment": "Malware payload (AgentTesla)", "value": "d255849f709a1f0ad7919d8922ec6cf0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969746, "uuid": "4c8ec2d3-6ad2-4ba1-9645-69cd8ed63d17", "comment": "Malware payload (AgentTesla)", "value": "750104bbbb782e4f9e466e3ba31882d4bc9446b9cdcb0cf5ad4f624df894952d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969746, "uuid": "8dd054d0-5be8-4316-b120-fd28b3ed1166", "comment": "Malware payload (AgentTesla)", "value": "3f73f8a61272014567a8c256243d00f4be346792", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969746, "uuid": "5c545fa8-8668-490c-bc5f-2de8808a1688", "comment": "Malware payload (AgentTesla)", "value": "fe126a4fc3679646bec8f5b36145784fc0c9ea364e4cb770995e739b743029556ba17e5f7d81c15f46ce97ef37773766", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969746, "uuid": "4546459b-9d52-41c5-8b95-f01ff13a5a0e", "value": "4975831316F4FE24D17D32718C7B5419C5ECA5329338F069796A338ACA6F9104FA26EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969746, "uuid": "c73bbaa0-00c5-4d80-9492-b2ae33a934de", "value": "24576:ygsRYud0v6kAIVncKuxvE/NxJPopH2brP:ygsRYI0v6scxvyVopH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969746, "uuid": "d8f4f339-7fa1-45b6-bae5-b8dc4ff593c3", "value": 1611776, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969746, "uuid": "dbd391d8-6dd8-478b-9588-f02ff8d1c7c4", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969746, "uuid": "96a89eab-1807-4232-b574-facc85acb4e5", "value": "Payment Adivce.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a15b3f-873c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615997744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615997744, "uuid": "e1edc035-ef90-42b7-b94b-8db3141d66d1", "comment": "Malware payload (Formbook)", "value": "f60c31cc1f4e3842b080f368b117e4fd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615997744, "uuid": "c4ede8fb-4895-43a6-acb1-4597674773e8", "comment": "Malware payload (Formbook)", "value": "7518302278bb1c2e1a4caa72c7adae61238c8b4f0553f47f1bb656a7064182e7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615997744, "uuid": "6b16a932-1f22-41e4-b704-97cbbf430a6d", "comment": "Malware payload (Formbook)", "value": "eca68bc6eab5aba2ecc522a4406fa7ea43d26dc6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615997744, "uuid": "a15b59df-b4eb-4b14-9876-edfcf3c0cfb5", "comment": "Malware payload (Formbook)", "value": "4849076efb7d1c949c68f6abd0cadd4a3afbb360d62fc8454435d1d4009de224fdb2ebcb76589b765c2c2663830671de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615997744, "uuid": "f06d8094-67ea-4d82-adad-1a4ff6b660c5", "value": "7FE423B45C6CC25F270B3708FF991FA08A55806270D38C7949BDAB1FE1052AF6CE68D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615997744, "uuid": "52cf758b-2150-4c69-ae34-b9142e3c0a1c", "value": "12288:nCjdwlCtGLk+zV2D4/l1RxWXn8zIK66pr3p3iWVvuquPu+Eha/:nq+lC1+w4/GZKxpQ/quj6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615997744, "uuid": "f7e8e873-438e-4f11-8a6e-c1e8674733f3", "value": 669846, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615997744, "uuid": "9a530178-46d5-43c8-98e5-e5f654347cc9", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615997744, "uuid": "f2d0e402-81b9-4681-b98b-fe331e3c21e0", "value": "708469737489630001.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce65a494-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011393, "uuid": "1772ee8a-9796-4a6a-a77f-bf8451abb56b", "comment": "Malware payload (Dridex)", "value": "ceb425203630860335da5a4bfddc0a54", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011393, "uuid": "9fa48a31-df62-46f9-a750-fb017a8c4c92", "comment": "Malware payload (Dridex)", "value": "759278259f96624e6d02c9cee0d3afed55b64cedcdfc629354df4f11521fbc0d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011393, "uuid": "b94e53b6-bd5a-4765-9deb-ab8dccc96608", "comment": "Malware payload (Dridex)", "value": "26359768b6fefe654c113b56b13b4313383fb7eb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011393, "uuid": "bd2dc76f-5241-47fb-96ef-e71ce6711a12", "comment": "Malware payload (Dridex)", "value": "45b092cd87f6be0071a756c44dd3788ba146ddc0adbbae149c678d60a94b58b73d40bbbaf58d63666a37871b9a8aaecd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011393, "uuid": "ab6e9542-9537-45a3-bec4-f6f6ae71ada5", "value": "F324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011393, "uuid": "f8304f4c-b0f6-421a-adde-630a629bc1db", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011393, "uuid": "a360ddeb-afab-4b54-b8f0-17bf15a46af0", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011393, "uuid": "01b493fc-667e-4779-987f-a5b777d6ddf4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011393, "uuid": "19070fa2-9a43-4b78-925d-688ed0d92d59", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011393, "uuid": "67a6e069-9048-45b8-b706-6469e00cf075", "value": "759278259f96624e6d02c9cee0d3afed55b64cedcdfc629354df4f11521fbc0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacab320-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1615968384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968384, "uuid": "bcd5bb93-41f7-4844-ae34-95955f561264", "comment": "Malware payload (RaccoonStealer)", "value": "49d844e250e60546e57bee90ba57b0b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968384, "uuid": "cad11547-b131-40ac-be11-5dd51cfc11de", "comment": "Malware payload (RaccoonStealer)", "value": "7682aa460bd69a320a371d9f8b5a1d8445c4ed0b6f2d2bfaf809ba12f0d17433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968384, "uuid": "e50808fd-350a-4c0d-832a-b0937516f548", "comment": "Malware payload (RaccoonStealer)", "value": "68d5a4748dcd4c019504a43d08eb43e6d1e58399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968384, "uuid": "a6a25948-0d49-463e-81ea-e5af69002c8d", "comment": "Malware payload (RaccoonStealer)", "value": "ac3274a4cf0a8b51945d9ed3c93f6e2e76f7b11e2ece3821defd5c53b56e2db4e08584ed6d26a045b6a7ea3a52311be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968384, "uuid": "c13f0934-06bc-4209-8857-4d4995c2d6f8", "value": "84C4D000ABA0C034F1B722F4857692AC79397E619F3490FF52E52AEA5774AF4AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968384, "uuid": "cb149118-c046-4dbf-9bc0-961cc04d0f6f", "value": "83ff340a453ef764a77566842c792976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968384, "uuid": "8d91dbbd-7fff-4691-abe2-8d793e234d32", "value": "12288:MgApsD1GhCErSfS1N2QwjYq7ttaEzDkeePEHsyAEcR7KJN:MgUfhCEy0Pq7tMEzojPi1AEcR7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968384, "uuid": "49427124-05cb-4363-af50-735c79cf61b2", "value": 547328, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968384, "uuid": "b417f08f-41a1-4f6f-88c6-f24c12c33ed6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968384, "uuid": "24250101-2894-4975-bf61-a4931ec38b21", "value": "49d844e250e60546e57bee90ba57b0b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7598f2d9-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001796, "uuid": "d094b4ea-a4da-467b-afc0-ba602696fe39", "comment": "Malware payload (Dridex)", "value": "0faf0f194a9666cb32e6e956943290e2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001796, "uuid": "a3f4e3b9-1284-4517-ae96-39dee77ce803", "comment": "Malware payload (Dridex)", "value": "7690968d247568991cfbb5c2e35b129c327bdd2e51e38bd067804a1c3a401716", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001796, "uuid": "1c5427bf-76fe-433d-88df-9e3e3de884f9", "comment": "Malware payload (Dridex)", "value": "9bfbce5767f7421473fc1a61681a3b585c755d25", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001796, "uuid": "03267a12-ce83-4298-8090-2a39c3b51f93", "comment": "Malware payload (Dridex)", "value": "2e3908e02b6696ee96fd6b1e3ad1f39051b74fb234a3d467aa8329925703ae65b24aae2357de9bdee1062687ed03878b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001796, "uuid": "59257aa1-2d01-4e55-9a1d-afa4863d24c9", "value": "A224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001796, "uuid": "4741c990-0f37-4706-b646-6ddf4a97820c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001796, "uuid": "f05419a2-ece4-446b-8ac2-f5e6d667514f", "value": "3072:59Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:59Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001796, "uuid": "5c68c047-3844-4c84-8176-16601b15b4d5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001796, "uuid": "715283e7-9cfe-480b-a8a7-6c02b2967fd7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001796, "uuid": "b08b9a15-ea96-429c-bd36-67b8f32d23ab", "value": "7690968d247568991cfbb5c2e35b129c327bdd2e51e38bd067804a1c3a401716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6620f92c-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004347, "uuid": "c30b1a17-46d1-4ee2-aeea-1848b544dcf7", "comment": "Malware payload (Dridex)", "value": "e273939c212db275cf14f45681a37e9c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004347, "uuid": "70893b06-8f5a-4bf8-a436-2ef58cb1723c", "comment": "Malware payload (Dridex)", "value": "77770e670e1ca1169b5f41f329fc19ee8fbacc57763873a39541b78a5e80fcce", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004347, "uuid": "04202ca0-9ceb-4e46-94bf-d747921260ad", "comment": "Malware payload (Dridex)", "value": "a9197c198a3b3052875f223f3d964133bae1f9e0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004347, "uuid": "7097bbfb-dbf1-4ec8-93a7-fac8ac7850c9", "comment": "Malware payload (Dridex)", "value": "bb7322148e69af9c149fdef55f75febad565df00b33b9ddf07935fbf8587deccf4073003521307ff83c6d09f85d75cf0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004347, "uuid": "f834c68d-9b40-4bdf-97f9-5ff0fad91925", "value": "6824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004347, "uuid": "7563e319-f962-4972-9671-04d25b91223d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004347, "uuid": "83fa1804-02fe-4696-adaa-a104439d0e16", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004347, "uuid": "df554a08-4ca7-4c6e-954a-07191acb68f1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004347, "uuid": "bb3e3db8-d577-421c-b841-50d9d8b74edc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004347, "uuid": "e64984ea-e643-4fd5-8298-cdbb8eb4d806", "value": "77770e670e1ca1169b5f41f329fc19ee8fbacc57763873a39541b78a5e80fcce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7704443c-870e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615978176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615978176, "uuid": "c01200a1-cf8f-4fe1-bbac-2f996d4a886e", "comment": "Malware payload (Gozi)", "value": "a74762ec27dd6e265b87381ba43383c7", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615978176, "uuid": "f2e61611-afcd-4439-a45b-481a7d2a89a8", "comment": "Malware payload (Gozi)", "value": "77e906815875cda2b12ec08917f0ae09dbfb979fefb737cb3d5557c67d575dc9", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615978176, "uuid": "8e9f82bd-2b34-408e-8d84-895e2edab5bd", "comment": "Malware payload (Gozi)", "value": "65d8291f45aca9a4267535b9699a5f1dfcbb8e30", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615978176, "uuid": "e51fc0bd-ad9d-402b-8d65-ca82b3b6b8ea", "comment": "Malware payload (Gozi)", "value": "dd73637c66d68f2977bce216f0bbdd9783b15b697ed637193f33f84e665399b4d09e2945b77e05b1b5f83cac3985012a", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615978176, "uuid": "0c0d4f88-2d45-437b-a121-1e345a66b0d6", "value": "E674453B62D0D005CADF41B35A766E67B7DFD1E12BA8541CBB06211EC83CDB235AB942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615978176, "uuid": "013b28c4-c0db-4669-841c-ca0275cfdf20", "value": "1536:PzvCzbyiGmLjKVTb8LC2Ec8wK4144OgQRH:m3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615978176, "uuid": "46d05417-be39-44e5-b0b3-15423432ca64", "value": 359162, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615978176, "uuid": "dc9ed144-8cbe-4f71-8d39-8d1391f1ee39", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615978176, "uuid": "6ab89b0c-0926-476e-ac21-5bbec2e023ec", "value": "gozi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5defdec-86c9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615948753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948753, "uuid": "2fcd56f6-c054-4dec-81f3-c03a7c8d3691", "comment": "Malware payload", "value": "4bf70ea92979dd88c9761ee848370050", "object_relation": "md5", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948753, "uuid": "f6112f53-1daf-4f05-b0bc-d35a4caec3ee", "comment": "Malware payload", "value": "77f5e4a86ba682c490a53ee2b170e74692d6539bde00971f4d6dd2b90e557340", "object_relation": "sha256", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948753, "uuid": "12dc19be-ae02-43c5-886e-4146c96979f9", "comment": "Malware payload", "value": "8dda500425814a8ce6ebb7bfcfc6f9619d10230c", "object_relation": "sha1", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948753, "uuid": "0eb6d7bf-ec8a-4897-b7c0-50f799a0feee", "comment": "Malware payload", "value": "a526301a5ca859ccccbb944cd5c4e3a38a2d2832ce6e3836b9be18a958894fa96a1c17ef66c1bd52e43f0f184653c77e", "object_relation": "sha3-384", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948753, "uuid": "176d8088-971c-4419-a884-4f6ad288eacd", "value": "C72302A6E9B76ECE17E33B081AD7008ED87F974AC12C17482FDC9F6D2546A19681B0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948753, "uuid": "b7e2afd0-2435-4d65-93bc-73980de95186", "value": "1536:oB5tU/bvMXLmtDbdqAVeVugrHWjo2GLbs4hezH:olUTvEmJYAVeVugrHWM2OhezH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615948753, "uuid": "db48c855-d35e-4870-afd9-3975b275f34f", "value": 49605, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615948753, "uuid": "3b747432-e3e2-4457-b225-a2c104445140", "value": "application/zlib", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948753, "uuid": "5d3275af-b9e4-4184-8831-bd0559cd1c14", "value": "FIN8-BadHatch-Shellcode-64bit.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1673228e-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004642, "uuid": "0413098b-5f48-49d8-b26a-4b8f46fd31ee", "comment": "Malware payload (Dridex)", "value": "1db1c68f1fc44bbda09125e1eca7515f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004642, "uuid": "72f7d2a4-7795-4015-bea6-b42b896f9131", "comment": "Malware payload (Dridex)", "value": "78a976dcb749f441c164643b415293c7f79420607590f7d4ccb579de7d4e3148", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004642, "uuid": "da6292c5-6356-469d-b486-c4cb049652e1", "comment": "Malware payload (Dridex)", "value": "42ee581dd9f336698219e364e4f3098c828b0ec3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004642, "uuid": "64cf87e2-3455-47c0-8ce2-c737fa68ec7c", "comment": "Malware payload (Dridex)", "value": "f99abecf6c1a556f10bf9aeb01566e664145428a0c6d0feb3ac0c491be9843016932248387c928f5652a9eb0ec4d7214", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004642, "uuid": "2b0823fa-9c09-4037-9e7d-67165861301d", "value": "0124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004642, "uuid": "84d2a09c-e1a8-4b9f-8276-6805506aadfd", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004642, "uuid": "3d96cbff-20e8-4a74-a5fd-7dce91bcbc2b", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004642, "uuid": "43a8964d-a940-442f-8a9f-1ab2a839bab5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004642, "uuid": "3fee52bc-9ea8-4e8b-8446-e147a6981944", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004642, "uuid": "10f6ec5d-34ed-4401-a041-ff57575325b4", "value": "78a976dcb749f441c164643b415293c7f79420607590f7d4ccb579de7d4e3148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af64f504-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005328, "uuid": "bb8b487c-67e0-40e8-bb05-034b7650b8d0", "comment": "Malware payload (Dridex)", "value": "e19eee051fbde33e537f0e7b47aaa927", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005328, "uuid": "9fcc9927-8674-46c8-8ad4-892b64559f43", "comment": "Malware payload (Dridex)", "value": "7944e582a1b2fbe85cff1cdee416b37dd65208b66dc90c6bbc4add9c4d31daf2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005328, "uuid": "b6b3ba9f-9211-444c-adc9-501a932a4ba8", "comment": "Malware payload (Dridex)", "value": "1d50588a91440bd9609763d5661123a1351f8379", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005328, "uuid": "292bee05-fa6f-4e52-89d6-868a4eda30eb", "comment": "Malware payload (Dridex)", "value": "4cae6914cb5e6758b988b605dc1ce87e1c460af264fa02b4513259063d80a8142c5c574ef7444b070bc5e9fa7ec4e74d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005328, "uuid": "8c0a6cbf-4715-4171-8551-1ef7e2eea069", "value": "E424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005328, "uuid": "32f5f7f0-9b7b-4b8e-9f20-a8763845e506", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005328, "uuid": "ce615beb-c2a4-46d9-a719-ce04ba29032a", "value": "3072:t9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:t9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005328, "uuid": "a2587aa0-26dc-48f6-8e2f-44f7a7af061a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005328, "uuid": "3718c474-dda1-4db1-810f-91a0b8d0ea32", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005328, "uuid": "cbc34777-ada9-4149-a6d1-1eef1c429906", "value": "7944e582a1b2fbe85cff1cdee416b37dd65208b66dc90c6bbc4add9c4d31daf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f33b6ca-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004228, "uuid": "41928974-65c1-4099-be6d-a709b0b98a74", "comment": "Malware payload (Dridex)", "value": "626eb70754869eeda1fefa7ca996c0f4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004228, "uuid": "f7e77e0e-3586-4ed9-92eb-adaa77054a8c", "comment": "Malware payload (Dridex)", "value": "797cd9afb837f5bc5945d037d7d116f2005de76e76b418d4e91711de496b90c7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004228, "uuid": "120cba07-f78e-4a68-8a04-78fc00e8dbd0", "comment": "Malware payload (Dridex)", "value": "6a15cfeb2b65118c1a05bc3712f2fab8e3372b6a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004228, "uuid": "01cac2c2-f46b-497d-bc3a-2608023b732f", "comment": "Malware payload (Dridex)", "value": "054b69743a5a65e93e9a74084bba9f92b66a4f4687424c0a93c24493cc78a7c2d96c0d9bfe871ce6c13b8c73f86d6ab2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004228, "uuid": "80d2cd8a-f08e-4e0a-97bd-71d5c3c53d83", "value": "A524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004228, "uuid": "e056ad66-24b1-4b96-968b-4fe2460b95f3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004228, "uuid": "fa7c68c2-38dd-45dc-bbf2-bf76a9558bb8", "value": "3072:H9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:H9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004228, "uuid": "eadad696-22d3-436c-9dd2-6e2bbc67e3d9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004228, "uuid": "aab0eed4-91b7-4a04-a156-b41f46b9a6d2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004228, "uuid": "f0b9d2a1-93a2-4178-ab22-20f716c617fc", "value": "797cd9afb837f5bc5945d037d7d116f2005de76e76b418d4e91711de496b90c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7681a8-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003824, "uuid": "95a4f45a-fd65-424c-87ac-eff6195623d9", "comment": "Malware payload (Dridex)", "value": "3265be8e8c2e79ff4b56f79945912868", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003824, "uuid": "faa91f91-6f37-4c75-ac19-2291bd7562d7", "comment": "Malware payload (Dridex)", "value": "79a0af3140468dc2b09fb786ac81944e06f4e680c611321b774107318f5a3870", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003824, "uuid": "0e1dcbb5-2e18-41d2-a0db-580eb53e1a8f", "comment": "Malware payload (Dridex)", "value": "123abd19e541bf97aa2edec490b87bee56aff614", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003824, "uuid": "9a1b5bef-0762-492e-9edb-d2c365fbfb6e", "comment": "Malware payload (Dridex)", "value": "8c6600b268800d963111ab4369c60850b10c3a8c7e748f06eb40f7e1491502d3d4f1e407900c8d27b1aafd60b3bba8e1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003824, "uuid": "285c6b0d-5659-4f95-b439-1160c3573979", "value": "5924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003824, "uuid": "1cfefcf1-2f80-4cdb-8dd0-b61d05c2819b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003824, "uuid": "202fbd1e-f38c-4fd5-b076-842a6f81e2e7", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003824, "uuid": "318a0c88-2ea8-4df1-af08-e3ee4cf86b42", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003824, "uuid": "496b0281-5e71-453f-b9ba-3f4f7ec1df16", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003824, "uuid": "2a4096ae-419a-4606-924e-208261147b1b", "value": "79a0af3140468dc2b09fb786ac81944e06f4e680c611321b774107318f5a3870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27e70c1-86fe-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615971377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971377, "uuid": "f0403877-1b02-4617-968e-3f3dc99324fb", "comment": "Malware payload (AgentTesla)", "value": "a0cfbc0ab50ae4fafc03c74d503fccc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971377, "uuid": "8343eb65-34bf-4882-9143-501186b91169", "comment": "Malware payload (AgentTesla)", "value": "79d68212bb5ee8852ec0d7c6c8ab8b045ae22a8d247343f51d2defdd297d33de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971377, "uuid": "265f9934-0c17-4710-a3f0-a542436487bc", "comment": "Malware payload (AgentTesla)", "value": "764720dea57418b25ef3dec8aa97dcd31994c64e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971377, "uuid": "644d7bd4-da14-429b-995a-17360e7223fe", "comment": "Malware payload (AgentTesla)", "value": "aa4111c062a97a29bae46108613f62892c4d758eeb1ac949b6f66f43a066360c3d0524c1c8d51f777a4d08dd0a72f1e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971377, "uuid": "9c80b1a7-5f75-450c-a433-7d0b96efdb61", "value": "7BF36DE8E8D1CDE4CB8FC5DA460D7A951063F979C6C36C8A4428F3F40B9267F5A5AC60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971377, "uuid": "410ce44e-671c-4916-b73a-ccd55b0cd4b7", "value": "3072:okZAvFTnx1//kUWwyJi7eLbkrMrN6EetrKYWZ6gq6AVKlG5hEBYRPd:ZKFvkeeLbyA6EeNXvgGVKlchEBgPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615971377, "uuid": "2ad5c9a4-0ed9-4b7d-93ff-2a4a8ac7a466", "value": 163939, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615971377, "uuid": "ecec7a4d-387d-48c9-8469-0541a18e0103", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971377, "uuid": "7bb39e5f-1c01-4e9a-b3a8-1fb5ccdeb777", "value": "2021 16 03 weekly Report.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adf29f7-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017293, "uuid": "b11c5754-071d-4fd7-8560-fdf51db0413d", "comment": "Malware payload", "value": "61df2898f5a51d0911aa53e9234baa10", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017293, "uuid": "5a860e2c-ede6-40b6-9c42-70b342a609d4", "comment": "Malware payload", "value": "79e7e202cfc0d47ed597c4cf982e5a407c4bb540be86b948f44a16749aa00985", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017293, "uuid": "67682f05-d969-429d-82d7-04aeae47a6f6", "comment": "Malware payload", "value": "10361a352c650830f22e68b23872dba990fad01c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017293, "uuid": "7c2001ab-5a51-44ec-a409-6b3d43c55f5a", "comment": "Malware payload", "value": "36a8861ec8ca8a3e552cd230c59da0ca8a454e9b94a3b0b08dedbb01e5b6d5bfd165e9c11ee2c3005c3fa234c96b8aef", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017293, "uuid": "dea14f50-38f9-4421-8bff-6dc27af4dbc4", "value": "A524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017293, "uuid": "4daf9ea8-92a4-41bd-aed3-14c84b19fc6a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017293, "uuid": "80d97b3b-31a6-4ece-903b-5d3d8a170e70", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017293, "uuid": "760b667d-fe47-43d6-9c2e-ed95f00bb2bc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017293, "uuid": "9b3048f9-6f7a-4de1-8a3e-2aa4fba407ce", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017293, "uuid": "0a67a048-12b5-4d4f-95a6-22ec950550ad", "value": "79e7e202cfc0d47ed597c4cf982e5a407c4bb540be86b948f44a16749aa00985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dfac63-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615984754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984754, "uuid": "cf0bd680-61f1-4004-975e-0048567eed7e", "comment": "Malware payload (Loki)", "value": "dec9fc3787af20923c44cc4effe91f2c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984754, "uuid": "512f39cc-c31b-4602-b5f0-551caa0e4dd5", "comment": "Malware payload (Loki)", "value": "79f4c2c7fe0df040a4ac0217b93bc2dae6e41db4204597cb66a0f57b76234b25", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984754, "uuid": "0172c8e0-d5b2-4c55-baad-b391d83b1b54", "comment": "Malware payload (Loki)", "value": "fac01da154a26a89c37f60402cb27155e618a22d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984754, "uuid": "08e19ab3-9605-4353-8b1e-76161de33e2f", "comment": "Malware payload (Loki)", "value": "c539092f8b65c80ec4214fc9ef0bf8c69942c1975a5bee29b430df229d4ca800811b17416b55cc29aa1c59b7d0eef667", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984754, "uuid": "42a34b41-2513-4254-a977-66773181e9f5", "value": "94E3133F77300B271351C7A9AA70985FF0C1896970979D7682EA950484FBDB8EDE9072", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984754, "uuid": "58f7dbb2-7a54-49f3-b2d8-ad30c1630e43", "value": "3072:Kzitw6MjR9rzLxyGWFc2+MRG9u1UgUjMC1+4gGloLGXfvUh:ltw6MVZ5yRJGg1APRDXfvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984754, "uuid": "4eea6b27-a288-456d-90fb-a0bd7e80c3c4", "value": 146301, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984754, "uuid": "a624eac4-eff0-4bdf-bb7d-3e70dd74114d", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984754, "uuid": "006e8703-c9d1-4be4-af29-e22e600d9eee", "value": "Angebotsanfrage17\u00b703\u00b72021\u00b7pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735b244a-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004369, "uuid": "204c9c92-ba77-46fe-b3b1-c9a5eb162f83", "comment": "Malware payload (Dridex)", "value": "37a373e5308beeb1c3984599841a3c03", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004369, "uuid": "acdbf5d3-fe5a-4796-bd24-a795bf3b9265", "comment": "Malware payload (Dridex)", "value": "7a09518095ea9cf5debd27b1f2dcac8cbe96ff14ae2ab5718d3bb4d461bd4a88", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004369, "uuid": "9631de2b-ebad-4147-aa17-6634a25a1748", "comment": "Malware payload (Dridex)", "value": "f4d4877453c1c36aaff964f1c803e422d09b3b46", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004369, "uuid": "00bd4a44-99af-4ab8-a197-afaa17c02058", "comment": "Malware payload (Dridex)", "value": "a4e7cd53240399a3376c8de1264f6f5023841e765dd96e2947b5695fac1422891fd4a88b3e66c513af81c8867d29575c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004369, "uuid": "2a324c53-3585-4142-80d0-a9a5ad0c176f", "value": "9024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004369, "uuid": "5dc6ae10-25b6-4307-9e59-58eaf9f228dd", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004369, "uuid": "fe18d60b-ccd7-4fb3-93a7-b9f522996a21", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004369, "uuid": "aded412b-78d6-4765-9d73-0ce65aacba62", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004369, "uuid": "81162d35-d770-43e9-a7dc-6822cf4e7747", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004369, "uuid": "2db872ac-ac94-42e1-8b83-7c31957e1568", "value": "7a09518095ea9cf5debd27b1f2dcac8cbe96ff14ae2ab5718d3bb4d461bd4a88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a4d739-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616004230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004230, "uuid": "8e9b0fa2-f544-4d8b-b917-2ef70eadf582", "comment": "Malware payload", "value": "22c295dcdd0098a61934c8a87c54d2e5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004230, "uuid": "9d338e48-3902-4b87-af21-8897dc719ea8", "comment": "Malware payload", "value": "7a436e83b6356e84fbc479061292953e3d2e31365fc37f94742a7e8499fda416", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004230, "uuid": "333ff63d-a612-476c-b74c-a8fd38ece738", "comment": "Malware payload", "value": "1d820a2a111e17533832d2c8631eb84829cf6a90", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004230, "uuid": "bf15d714-7f05-4bfd-b0e9-baa1a7696f9b", "comment": "Malware payload", "value": "e1630a04f1f871950f83f333502bd00e13586c73bf151de08b6d6312c619971ab6f9f72b9cafeecc7e50ca484db620c3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004230, "uuid": "301ee356-7789-4e89-92e5-d292ea1d4e62", "value": "9624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004230, "uuid": "d4b99d5e-f3b4-4c35-84bb-ed139f3b7466", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004230, "uuid": "bb9613e6-11f9-4202-9c69-d1e1bc2ae310", "value": "3072:Z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004230, "uuid": "266427c0-16b3-4823-962d-5bb833b23a34", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004230, "uuid": "3df3531f-2978-4c0d-9c8d-e1081954d9a6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004230, "uuid": "c196487c-608e-4198-b431-8e754d964ca9", "value": "7a436e83b6356e84fbc479061292953e3d2e31365fc37f94742a7e8499fda416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f13146-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "fffa22b2-305c-405d-8fa1-9768ecdfdb96", "comment": "Malware payload (Dridex)", "value": "819964fccdf27cc4ae40bb956e78509c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "d81863ce-3e6d-476e-a122-990c8f131f5e", "comment": "Malware payload (Dridex)", "value": "7a487610da788673b71b32ddec781f79ce81672fc05f8999c86114b641c6a0f5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "a90fb30f-cb0f-4a06-8864-ddaace07b789", "comment": "Malware payload (Dridex)", "value": "519639d69ddd3ff4ed388c67e181f799f62da4eb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001816, "uuid": "19a8f27e-a390-43c3-b1db-739902f0ad46", "comment": "Malware payload (Dridex)", "value": "8c2ad3a06a9f9d5da3915452bea7a2ed5968bdd40c0895f7d9f1b5b0d7ccdbc3dff38c3aa369355c8f8185461e9c2a36", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "997a0754-c54f-4cdc-bc27-afd0fe8388de", "value": "6B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "e31bf7e0-e34a-45f5-890f-076171272212", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "0afd32b6-338a-43b9-a297-3cfec6024364", "value": "3072:i9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:i9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001816, "uuid": "b17642da-53bf-46e9-ba83-79d5afdc83b1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001816, "uuid": "cc1c853d-fb11-4862-a34f-e577bede2ba3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001816, "uuid": "83ccb231-45fb-48cc-9ef3-d48951bf073e", "value": "7a487610da788673b71b32ddec781f79ce81672fc05f8999c86114b641c6a0f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bfddb9-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615984611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984611, "uuid": "b9892707-07ca-4b73-97da-f6045c9c33de", "comment": "Malware payload (AgentTesla)", "value": "81a6ef6ed498d0e33a31e97bc1f8f4be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984611, "uuid": "31555d42-5e60-4b64-988d-ac2820d433c9", "comment": "Malware payload (AgentTesla)", "value": "7a8acbd9b81d038d9de50405ef1a0e2be8dcf06913af8e9af0f68e14b2c85fed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984611, "uuid": "1f133214-5748-4e8b-9403-0dd793585dc1", "comment": "Malware payload (AgentTesla)", "value": "1137f54a1f495effbfc3a1b5d1d9be384d0c8586", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984611, "uuid": "15f9bce2-ab9d-480f-b4cc-d2d845f93dcd", "comment": "Malware payload (AgentTesla)", "value": "0d925405c18a95bd41514c614b0886487e50293d775024dfe263ddadd47511e6c3f491d4d099bf3f5d38a750f8a4d40f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984611, "uuid": "7b954fe7-d482-4e49-8e59-278b24780d08", "value": "DE54237CAC264AF486E0F687B954825DC713E9F84ECAEEC7824A20DD8DE5F4971C9C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984611, "uuid": "05e2a928-5dc7-4ab9-a431-70cdd8aed689", "value": "6144:g0liQ22aU+gK7ACwBCoVGyuyZsuu+ytqSB1d1qx2+EeFHbXnTSbX3uB3:g0B2c+gKsCwMoVGwslPtdSx2+E6HrnSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984611, "uuid": "8daebd23-c31c-4114-8294-07e8a769d24b", "value": 281374, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984611, "uuid": "aa1c3e8b-2f0d-4c27-bcab-8397ccf272b5", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984611, "uuid": "b5dab650-4235-428b-aad4-7975f9d3c121", "value": "DOC_#NV44120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3928b82-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004101, "uuid": "ec504406-942a-4675-b214-735b4641aaaf", "comment": "Malware payload (Dridex)", "value": "2bc3e6c5d40ab1651b587d00ad1acd42", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004101, "uuid": "b26e388a-7f85-4aae-ac62-a0d72c523463", "comment": "Malware payload (Dridex)", "value": "7aeaec4c344eb7911a5d6e5fc1d4fac53ad9f4669855bc03fda2f6956d9660b8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004101, "uuid": "4e16c7ea-da9f-4623-9410-4660b8fb3d7d", "comment": "Malware payload (Dridex)", "value": "0239c81b4da64cad19589dc958b8043f4f267fd6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004101, "uuid": "a643c6f8-a5ce-46c0-95d6-7df12129c701", "comment": "Malware payload (Dridex)", "value": "32d83bd0b0712e6447eaaf93209e93c34904e1a73c163d5f0884eefc68cdd2e84a387629c0fca94a31bbe48dbe44f094", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004101, "uuid": "6d16237b-dc1a-4219-9091-75bd8d4d4ad5", "value": "F524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004101, "uuid": "94918d10-035e-4b8d-a3a5-40bed6664b1b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004101, "uuid": "847bb146-f27f-49f7-bbeb-afdb3da03cab", "value": "3072:y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004101, "uuid": "5b7d24cf-a41e-4d05-bb05-d700a76ad485", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004101, "uuid": "7c3f1613-d8fb-4bb4-a3d2-e2904769df6f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004101, "uuid": "9ceaeee8-12e6-4476-9fde-d0b6195ee95b", "value": "7aeaec4c344eb7911a5d6e5fc1d4fac53ad9f4669855bc03fda2f6956d9660b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec37b942-86e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615962051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962051, "uuid": "c1bd88a2-f571-4057-9280-225986cb0e65", "comment": "Malware payload", "value": "217287b40215856d67088493bb4fa83d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962051, "uuid": "1a43dfd9-bd09-4fc2-9a10-d6af38eb2168", "comment": "Malware payload", "value": "7bb7aca06751209ac152fc715d6813fbcb45c88aea0ef06b71e5dfe31133fe00", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962051, "uuid": "39b9b080-9fa7-4c72-88b4-c8a18efda884", "comment": "Malware payload", "value": "0185a4d3f029bd831fd45453a2bf1dbfbd4ca0c2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962051, "uuid": "dfe4aa8f-c6ac-400e-a977-1b76c5eed9d4", "comment": "Malware payload", "value": "e5741cacfbcc4cab13c3090ef9ab3febe86acb8b4be9c1026488816fdcf1256d88d9c3db33bae4c24215c03f887207ef", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962051, "uuid": "56a621b0-7010-426b-8fd2-c648246074c4", "value": "C2B5F2E0914AD8E3E7794E282555780E0617F7BA7AE12888F00DFFF5275E38B460ED49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962051, "uuid": "7410a885-74c4-420a-a8e7-a0da8453a688", "value": "49152:rAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOAy:rAOAOAOAOAOAOAOAOAOAOAOAOAOAOAOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962051, "uuid": "603aa5b0-44e0-40ea-b776-615692e71243", "value": 2434793, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962051, "uuid": "6fa56e74-7c19-460e-bf45-c83791c90e54", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962051, "uuid": "58c434df-93c7-4295-aacb-3b8c601cf84f", "value": "anchet\u0103 pre-comand\u0103 16.3.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd13ed6-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003558, "uuid": "87343eaa-3dd2-4553-a0a2-6d13c8d7c632", "comment": "Malware payload (Dridex)", "value": "fe9f76abd0b05e3806f2028f830ac148", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003558, "uuid": "1afa0754-f5f2-43d3-a0d9-8b90dffb2337", "comment": "Malware payload (Dridex)", "value": "7bd1b973c0a43b2b2b208da9d9c69f4463ebe51c92ee61b8d89808e6f5aeb889", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003558, "uuid": "8b834275-c17a-4c97-8c15-475e88f2c20e", "comment": "Malware payload (Dridex)", "value": "e8ac48f32d849746e05fc928f4ea26a0aef6870f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003558, "uuid": "914e2f2e-0a91-4f2c-ae20-1496efd971d7", "comment": "Malware payload (Dridex)", "value": "5f77ab63840103b02fe8171c7bd3875ac9077ba025f17f7da19f71f0e2f74fe34b364e54a23e785d6248d5c9e4cd8a26", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003558, "uuid": "406517cd-d94a-4b8f-9fc6-ff953e303e6a", "value": "FF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003558, "uuid": "328a82c2-eebc-4710-8f24-49ba60b0f7f3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003558, "uuid": "81ad72cc-5b4c-4702-a3dd-d7e6e0439d57", "value": "3072:w9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:w9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003558, "uuid": "44a02f19-233b-4248-bf5f-7035a5467091", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003558, "uuid": "1ea4f07f-707a-4be4-af76-aff3dafffd42", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003558, "uuid": "2949e3de-688e-4334-8b15-486a51657ee8", "value": "7bd1b973c0a43b2b2b208da9d9c69f4463ebe51c92ee61b8d89808e6f5aeb889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a75bbff-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001831, "uuid": "aa440507-8e9d-4944-853b-a48734c09899", "comment": "Malware payload (Dridex)", "value": "44d6fb9a183c497f49d25b817eeb2373", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001831, "uuid": "c1169376-06cd-470d-8c42-dadaf7eb9fa6", "comment": "Malware payload (Dridex)", "value": "7c2ecf16ecb8093b0b926c8253795a66239a12db05525ab7015128680cf3cf6a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001831, "uuid": "e34c67ec-a316-4c69-aaec-f72f945356c4", "comment": "Malware payload (Dridex)", "value": "439a7e5b542cbbda6cb2282be0394cc471c7bccd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001831, "uuid": "456dbe92-347d-4d30-9fd8-bdaaed087305", "comment": "Malware payload (Dridex)", "value": "fc3ed23f57b219ff97df47869c716dac4c640ab31ae4c7f3c3ff482ace53862cad85cc632d0ae355a986ed376acb526c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001831, "uuid": "c9595224-8019-408c-931d-7bfd070a4b91", "value": "6724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001831, "uuid": "b1336cb0-e36e-424b-9c4e-5cec910c36b6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001831, "uuid": "caa09bf2-60b0-4c4f-b3f6-1737188a9d02", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001831, "uuid": "ba2eba21-6716-4ef5-be29-e05ae0c2664d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001831, "uuid": "a0687c6a-c3a3-4f0e-85b9-58380684ea8d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001831, "uuid": "bf69f98a-bde9-452e-8962-294bf79cfbe7", "value": "7c2ecf16ecb8093b0b926c8253795a66239a12db05525ab7015128680cf3cf6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5f2204-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615962191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962191, "uuid": "97cc3c7c-0d1e-4c0d-9996-ee44fec787d3", "comment": "Malware payload (Loki)", "value": "4eb3093e94bcd05f2b2224b6c1eae4c0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962191, "uuid": "057329c1-2a16-4d12-b07e-efc014352dbd", "comment": "Malware payload (Loki)", "value": "7ce1940b848099c9faad57d4883ccccb9ef851855077cdd7644d725af083a1f7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962191, "uuid": "287f1467-0c6a-45c9-b577-dbe256fdc7f7", "comment": "Malware payload (Loki)", "value": "679cffceeb9bb43260ad8acb58c9ce0a510590b1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962191, "uuid": "7e47a5ed-073b-431c-90fb-9c35104e504a", "comment": "Malware payload (Loki)", "value": "dd3654016701a587771a3a0167cff012e5b0f91acf8c4e9cd0fcf1abb6ee852389357d5610944fcdce2bd0184d4edde4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962191, "uuid": "93e511e9-c3e2-439e-b9f1-73c865a9f67b", "value": "57B53363B4DA8332D1EE293D44EAC0EA0A0C9CD66D9D705BF79D72B0743097826D534E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962191, "uuid": "d062d808-d753-4b24-8f0d-6c461c41c12d", "value": "49152:C5nYGkVcLRRXZLHJD54y2AS9tQWVIT53DGnwlZ2XIsgA2XO9wCVkbyK:CpYFa9RpLN54yASTBWGzsgAlwCKbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962191, "uuid": "f3de7f18-adae-4230-8115-661dea8ad3e8", "value": 2433024, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962191, "uuid": "c6ef55f2-3c78-41b7-a469-d71a4a14f182", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962191, "uuid": "428ffbbc-af9e-467b-9ecc-26c346b67540", "value": "Remittance Advice -PI-DA-000000008-3FTP-190014-1190014.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8405b6e-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "6366d7b1-b889-4159-a6af-592d7c9d8b36", "comment": "Malware payload (Dridex)", "value": "0237e5d4a457c375c20ca1cc747877d7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "5e6141f3-32b0-442a-8002-5a286efc8043", "comment": "Malware payload (Dridex)", "value": "7d0b7afc3668ea75d49f4bae9086d793dd5f4b8b713fe35a237ad3f237d30cc4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "d2c45b7c-63dc-4210-87f4-f12265197771", "comment": "Malware payload (Dridex)", "value": "43ae16365091299c8f65b9d314989add39871474", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "85adf743-8cc6-453a-bc6a-30825092e8f5", "comment": "Malware payload (Dridex)", "value": "f412b6e59514a50d8359297202fba05a9d960002b22471a57ce03d25d75ebdea7fdd13058c1e74ae190d9e2e3cb199d6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "e1842a11-c46a-4236-a111-7b845a07c3af", "value": "8F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "856f7c4e-f24c-42d0-a560-ea9b9316cc60", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "56130a5c-4748-43c6-a080-317041a58635", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003733, "uuid": "2d55eef4-a52e-4d27-9a6f-0917f93acc72", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003733, "uuid": "cc7ca49d-c039-4eed-8a80-20381b44ec74", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "133d6f1b-5ce7-47c3-98e6-09a08c5a736e", "value": "7d0b7afc3668ea75d49f4bae9086d793dd5f4b8b713fe35a237ad3f237d30cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4db35da-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003646, "uuid": "35723539-55c7-4f96-bbac-542f9c64b520", "comment": "Malware payload (Dridex)", "value": "a9689b951d3dc344f96f640f8d1757ee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003646, "uuid": "d59accc8-5e2c-41c0-9ea1-e87a1afe341d", "comment": "Malware payload (Dridex)", "value": "7db0a09b650c5826149cf1e8a146d2ae67f7523af796498d188e5344e2bc973b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003646, "uuid": "ba6aa69f-ee62-4471-8a0c-0c4b0191325f", "comment": "Malware payload (Dridex)", "value": "be7db8798d7b304e3481c1cd07fe1d94f7cde0e7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003646, "uuid": "a471ea6a-5871-4baa-8e80-ea51c23d6d7f", "comment": "Malware payload (Dridex)", "value": "af3f3fe7ca028886f587366ecb6b0ff062873d69c08090e5f988022b57fa796ccb03faa1b81108d05575aa959d097be1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003646, "uuid": "957d5a36-7258-4228-b4d9-ef8d586b2a62", "value": "6224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003646, "uuid": "6fe9ad8c-9f0e-4403-a674-f37b3835f2cd", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003646, "uuid": "be93472c-91a7-4671-8364-b84e674d00dc", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003646, "uuid": "4e0ff6b1-0896-4826-a820-b43b766b9207", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003646, "uuid": "5c6a00bc-c59f-499e-8461-4609b5198a9c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003646, "uuid": "ab773038-5394-4fc3-93bf-030473513bb8", "value": "7db0a09b650c5826149cf1e8a146d2ae67f7523af796498d188e5344e2bc973b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe405ea-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "23fbd721-b32d-448c-b21c-b5a256b863c8", "comment": "Malware payload (Dridex)", "value": "a7d94f37b2fec8740f190673e8004376", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "d6ea98d0-6bf0-4496-97a1-2d96adde2cf2", "comment": "Malware payload (Dridex)", "value": "7de9719b1348e2aaae1a5bb7fcb73a940fc405b60f6248a6c5e1536d8c5d24c3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "73daf766-9cc3-41e8-8073-3a2857f002e3", "comment": "Malware payload (Dridex)", "value": "b7f90998b955cbe0834156095c675d1f32019c61", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003719, "uuid": "e072c043-62a8-4a98-ac36-74bb4fb6adc0", "comment": "Malware payload (Dridex)", "value": "a68588c5fcf73362fe5d35f3ca0df1d30b12b70636743e7a24c4b35c8b5fd1d6c9074cbc03ae2c8b93111885cdcc2d3d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "f9b43e33-9343-477c-898c-e9faa4b5b2da", "value": "0024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "5b4405c4-12cd-43e6-a06f-d877f3cd125d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "962d9de4-8bbe-4489-bf65-61cfee02eded", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003719, "uuid": "b77ffcb9-a4fd-4d8c-9e5a-24af1890c8a1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003719, "uuid": "de373850-8e2e-4fa5-a2ec-91c0d10295c0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003719, "uuid": "54d66fe6-362c-4a75-a32b-c7a3cf9ffab7", "value": "7de9719b1348e2aaae1a5bb7fcb73a940fc405b60f6248a6c5e1536d8c5d24c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f24a26-86f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615968356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968356, "uuid": "a07e5afb-7409-401c-baa7-55c69eae9802", "comment": "Malware payload (Gozi)", "value": "29f9bbdf746ab3660ceb6023b890b576", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968356, "uuid": "112f1f59-86c3-43a4-880f-ece506f83c86", "comment": "Malware payload (Gozi)", "value": "7e0e394cd085d162aa83daad67f4f66e35981e5b696d0a1b140dbf6db437f2d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968356, "uuid": "1601a51b-fe08-4655-bc56-365929f62df8", "comment": "Malware payload (Gozi)", "value": "deaab1f121dc7dfbf154fb5f0bc545ce0ff4095b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968356, "uuid": "66dff67b-e6de-478d-ab7b-73e89f743525", "comment": "Malware payload (Gozi)", "value": "2b5a125d02fa00d8601bb5dc2850e8f73b948ce73e89cccc9a7620eab1f1c5d0436a428993cca771951f54d2ea29cd54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968356, "uuid": "11a40088-6cf1-44c3-ab75-ecfa67368152", "value": "B4A4D021B5C282B2C133823A4878EA65DF78BC710B3858CB379D12774F796D1563BE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968356, "uuid": "2f90b2e0-642a-4436-b0c4-67f3f8e27292", "value": "25f2108c27a9983e93c5c39e2411e7ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968356, "uuid": "0d607387-fab3-494d-99dd-c005ff018928", "value": "6144:qvBZP3Kj73uoS2azm/TE35zCOcNKnu6Caa9aZR0Ndasyv4KgvRw/vP983wiYA:qD3ArBKuM1CRuEv9Ndbyv4u/X9awih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968356, "uuid": "bed3cfed-7c5b-44a3-ba5e-1873a675feb1", "value": 466432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968356, "uuid": "80ff457a-2ddf-4900-8893-1342b561b0f7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968356, "uuid": "19198cc2-92a8-4c77-8ea6-89de7b86b467", "value": "29f9bbdf746ab3660ceb6023b890b576.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895c3b26-870b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615976918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976918, "uuid": "a59ab664-f90a-4b0e-b957-2521b9783369", "comment": "Malware payload (Formbook)", "value": "df235a9e8ee343e450eb35319054b704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976918, "uuid": "a5022ca4-c1a0-4b4c-9245-b259fdf5af4f", "comment": "Malware payload (Formbook)", "value": "7e88f1c425154e6fff6d031aaaa4d8bb4c8ff131e429f44310fd936bfc08b357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976918, "uuid": "2438acfe-a3a2-4b26-92c3-4858d70bf6a0", "comment": "Malware payload (Formbook)", "value": "ac1e6b9070071411482dea9a732ccb19b07e1071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976918, "uuid": "2e21ac64-2aae-41c7-be23-47e973a643fb", "comment": "Malware payload (Formbook)", "value": "327bd9416b10fc1c84bd270209adf749e6dc26adece00ddbae601d00ca68f8f2dfa524379622e884975749e91041aa10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976918, "uuid": "9bd3f132-3960-4f05-8878-c12c3910acb4", "value": "0824125133E5C8F3D197437008E6ABB8E37AD1790510228B6FA46F7B6A22FE5D612742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976918, "uuid": "4e14df72-b07a-43a8-b7eb-61924bed1420", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976918, "uuid": "3f778771-2841-4f5a-8f22-d225cafbc20c", "value": "6144:JhjmWteX2F7o/55URkUSNmL51uQpe4FuUneFw:BIUo/5aoW5Uke4FuKaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976918, "uuid": "525b9cfa-3b72-402c-97de-53a936eef85e", "value": 216990, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976918, "uuid": "77015685-91f0-44a7-b646-7e8b33b6206e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976918, "uuid": "e2028d7e-6a39-4354-9156-c05eabdcd95a", "value": "df235a9e8ee343e450eb35319054b704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5947c1-8747-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616002587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002587, "uuid": "2c206c01-f0e4-445f-af1c-9174f83be5d2", "comment": "Malware payload (Dridex)", "value": "508c75fcea6ac553ea45bef541d66eaa", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002587, "uuid": "3c181eb9-31e8-4c53-a47d-f8392e60089c", "comment": "Malware payload (Dridex)", "value": "7ed7be3cab6b6b829ec721161a1db2b1a8e57e7b93f81e50081a2f21e68e1755", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002587, "uuid": "0b8853ff-8726-487c-8bac-79efc3b45bf0", "comment": "Malware payload (Dridex)", "value": "bbe1d3f2f428348986b984c08b2e8e72fbfb23b9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002587, "uuid": "120db4db-21e4-43e2-aa00-692fa1aa4559", "comment": "Malware payload (Dridex)", "value": "e93a59ac4d21052b653ab77b9446338ed716aa1c868ada949f06e4bee3fa6fd950bb5a0a145041e9b381ad74bcaf6565", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002587, "uuid": "06486c40-34ae-4438-8483-2fa27bdba4c8", "value": "9D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002587, "uuid": "ae89f045-50cf-4c32-bfbb-d177ccdbdfbd", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002587, "uuid": "ea7806f4-3055-4752-b4aa-d7fb68b531b0", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002587, "uuid": "083f92ba-9d49-4a90-b765-6373abc31c24", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002587, "uuid": "bb91f056-d571-4a69-8ab9-f7b4b63cb8a4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002587, "uuid": "c5eb80eb-aa4a-4873-8a20-4f90c063eab9", "value": "7ed7be3cab6b6b829ec721161a1db2b1a8e57e7b93f81e50081a2f21e68e1755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351d2b8f-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003835, "uuid": "cb176381-b45d-400e-904b-ca02a4f82a40", "comment": "Malware payload (Dridex)", "value": "ca4082c4b1179538752da92609873858", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003835, "uuid": "9de9d38d-ddb1-4b5f-9e86-78e07c500855", "comment": "Malware payload (Dridex)", "value": "7faf826db36e907d2097543bdc5c65e64a1ba2125afd9e8e35fe448fdd4a4645", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003835, "uuid": "2e9e6f6a-ddf4-48cf-855f-b41e9d2bab15", "comment": "Malware payload (Dridex)", "value": "5a1b9f4b40db147516ee8ad33a2eabfd1e98e5ea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003835, "uuid": "af4343d6-c7d5-4a21-b375-9ebb2d37344c", "comment": "Malware payload (Dridex)", "value": "6f2de9b0e36196397e9901b19fd72a57fd1080bbeb50c9f0c0a61b8fbe8c0de87e2085bc8b33077197bc37b8b514863d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003835, "uuid": "8f304061-8a62-448b-8941-3a34361abffc", "value": "8924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003835, "uuid": "403a0ed8-13c2-429c-9f44-1dc2a5684019", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003835, "uuid": "f039a159-5b30-47ba-85c5-38f96174db83", "value": "3072:b9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:b9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003835, "uuid": "fe312251-b185-4012-9db4-5ebc417f0d3a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003835, "uuid": "f4fe2835-312e-4a1b-b4ee-b9872d1b6816", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003835, "uuid": "cdefe5ff-f6f3-4843-a049-8ec4d0f0dfa3", "value": "7faf826db36e907d2097543bdc5c65e64a1ba2125afd9e8e35fe448fdd4a4645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82020ce1-8703-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615973470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973470, "uuid": "4c5c69c9-3c3c-462d-b8e3-ea1f3f56551a", "comment": "Malware payload", "value": "60f20f8e0352112139cc7c1f3917d099", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973470, "uuid": "56801cd6-e883-40f7-b417-a3ff8a0e1ca4", "comment": "Malware payload", "value": "7fb23ba556be1f76a7659722a13ab4c2c76457cda06e7f6cbf7e2495c14bce48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973470, "uuid": "c7239252-b72a-4ab9-848b-84bd4bf4d3f4", "comment": "Malware payload", "value": "1a5513a8213d0050669c3dc57f25543eb760f4f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973470, "uuid": "1add16d2-fcc6-4798-8b76-70da327a1757", "comment": "Malware payload", "value": "90ef511080e434b944e7709b25d1d4cecd01def3e409c6ace535ed399db36ad8f4fdc2bebd38ffb5bcd81a84c46de61d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973470, "uuid": "c385e8c6-8262-4b05-80fb-a8504b3f9952", "value": "4DC5E98ADFD76589D415276E932187E6B329063ACB6CF4406537F12E7C8730A26CBC39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973470, "uuid": "2372a67f-3a88-455b-880f-922a3189adb1", "value": "6144:qEvaYlFt2R69NYi3gn0qkBR4Sotx55fuwJiF1hn2sW8/EE4gKSvC/9lGgS1bAGqf:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615973470, "uuid": "a4d2347f-df46-481b-b6d5-9ac65dff53a9", "value": 2572288, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615973470, "uuid": "d2e008f5-bbae-4cd9-b82d-c479eeadf38f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973470, "uuid": "b775a1c5-4dab-443d-a6f6-e838e2ef4ead", "value": "SecuriteInfo.com.ML.PE-A.19612.14130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e77fbe-870d-11eb-abe1-42010a9c0039", "comment": "Malware payload (TaurusStealer)", "timestamp": 1615977848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977848, "uuid": "19a24263-fb1f-4e0d-b6fa-33e9e7329701", "comment": "Malware payload (TaurusStealer)", "value": "602c4fc857abdc65397927df41fc638d", "object_relation": "md5", "Tag": [ { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977848, "uuid": "60695f8a-61eb-4b7c-82b9-4ac359f8c23f", "comment": "Malware payload (TaurusStealer)", "value": "7fc9d4a00d0a1482b4b320feb5bed172f354c48705caae9d52db720ce7d98d84", "object_relation": "sha256", "Tag": [ { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977848, "uuid": "eda366f3-ab10-47f9-ade2-afacd4907468", "comment": "Malware payload (TaurusStealer)", "value": "57dd28ad57e53751dbf68959a5a8fc4012d905a4", "object_relation": "sha1", "Tag": [ { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977848, "uuid": "5c3bf5b0-f221-499c-a3e1-06af61d29198", "comment": "Malware payload (TaurusStealer)", "value": "95d3ff3f868d40cc4828f4a5e5db90380a24885216c0ca0f4b9caf7f61c481550d7d064022613d66c8753304a3d3afc0", "object_relation": "sha3-384", "Tag": [ { "name": "TaurusStealer", "colour": "#FC255E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977848, "uuid": "8619400e-ff82-4a82-9ea7-a9ed2d77d9c2", "value": "8EA50612EDE3A5ADC221871D46E04DBDDABE7224505F9C7F95360B8B17AB3500BA4F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977848, "uuid": "dd4e2e47-44e2-416b-8474-e3bc8be3a310", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977848, "uuid": "b5b242b0-528b-441e-b2ac-3be9d237f5a7", "value": "768:vJb3qdvuTqezgLYjQxcWAmFLazOgWdeCc8/ljP7mSUV3BeORJCmgjlUr+ZvTcqTm:hb3q+rBzZVekAWxS34UfNS34Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615977848, "uuid": "f38e6576-a400-456b-ab96-22143c1417b1", "value": 2100528, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615977848, "uuid": "2a839eeb-3ae1-4697-8975-7b91ef3ba6eb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977848, "uuid": "b645f120-8ddc-4d4e-94f7-c4d2bac9dad6", "value": "SecuriteInfo.com.Trojan.Carberp.2692.29914.12750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e63e7f8-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004414, "uuid": "b6d717cd-116f-4f3f-ad91-4239d80fb06b", "comment": "Malware payload (Dridex)", "value": "7ad789c4a36e9465666ad91b009616fc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004414, "uuid": "a18b979f-dd88-47a8-b3a4-9f5b8e83985e", "comment": "Malware payload (Dridex)", "value": "8031503be820d867c9a944227436f65b8962acfdf508b5f11b1f77fd699bc97f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004414, "uuid": "ae72eaac-c3a9-4e97-a7ad-e0d274584568", "comment": "Malware payload (Dridex)", "value": "cd5e2de5a12e5156c1b8f26697acfca9b31940c8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004414, "uuid": "d8ec928c-d5b9-4522-a7ae-5b5da6894753", "comment": "Malware payload (Dridex)", "value": "146b2bfaa3c30ea3dcfcea77d15b9048b6af4ddd057ef92d6f2aebac6e4c6d83f9ee6cb2aecb9aab72fb6483b01b0a18", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004414, "uuid": "cf6c893f-4700-42cf-8ad9-ab2ea15d34e6", "value": "B024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004414, "uuid": "afcf6d7a-3888-40e7-a917-47d32e799614", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004414, "uuid": "8bf3dc50-546c-4981-af0d-c5fdc7c51b65", "value": "3072:W9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:W9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004414, "uuid": "ee1c8aa7-7f5f-41cc-af0c-ae0dac589f52", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004414, "uuid": "0ab9da19-d324-4128-80dc-899c3858a4ca", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004414, "uuid": "0fce08b2-975b-4c1a-a183-5496f28efa07", "value": "8031503be820d867c9a944227436f65b8962acfdf508b5f11b1f77fd699bc97f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6fc200-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615968684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968684, "uuid": "7af653e2-affb-4cf6-8061-d851d6218502", "comment": "Malware payload", "value": "eb39c3a8f12a353ca9a0f64a2d2b9966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968684, "uuid": "38f2f194-7053-49c3-8b4f-8144a79eeee6", "comment": "Malware payload", "value": "8060ecf4c1dc957aefdbfc835361541af83a9e5d6433f5abb073477c59f16e4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968684, "uuid": "3e94b643-c538-4e03-a7c9-bfc2ca053ad1", "comment": "Malware payload", "value": "8eca1c63a7110d2cc432e8e8e753462b26306fc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968684, "uuid": "50cd33d2-65ca-491f-be44-236055372360", "comment": "Malware payload", "value": "aa37c53f0a606e927d06e1a4e2e4a3866c422c690906eb3c4c405ed799b54c074d194f25aa9515b91c012c336c2bdee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968684, "uuid": "da63d2fe-a3e9-4366-93a1-8823793cc88d", "value": "6BF40101BDE195B2D6711D321979A720683C7D201F2CCADFA3E45A5EDA342D0EB34BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968684, "uuid": "727b2ecc-a459-4423-b060-c9cd3b66b52e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968684, "uuid": "ea50bdd5-cfc7-42f1-96df-21b19c2deca6", "value": "24576:U2G/nvxW3Ww0tOLz3NbQYwkadPFxcJqGhH3:UbA30oz9bQYraJCH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968684, "uuid": "4ede34d1-ca55-4155-b792-3fc77b2eb6d1", "value": 788533, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968684, "uuid": "c24e2112-caca-4bf1-92c0-39150c668a76", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968684, "uuid": "b57170d9-dff5-4798-995f-c8535fd062fe", "value": "eb39c3a8f12a353ca9a0f64a2d2b9966.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bb662d-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001814, "uuid": "254d7a6f-ea7a-4c0b-9949-0e75f821441b", "comment": "Malware payload (Dridex)", "value": "2657aef522f77b5dd4fbcac54ca20d15", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001814, "uuid": "76226008-c27e-428d-9438-8e898ce0c308", "comment": "Malware payload (Dridex)", "value": "807a77af78725f5d208dec14534b047f7cd2055c8953ba930502a0860d6badc3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001814, "uuid": "a7326c7e-2e7f-4e9d-97ca-4dfad77da55f", "comment": "Malware payload (Dridex)", "value": "a62d52cb28309b968ebe76b73c47c73ca6ef731e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001814, "uuid": "f4c477a5-8f44-4dd0-b39a-559ecb160cf4", "comment": "Malware payload (Dridex)", "value": "1ae1e995c08e314bbd3132543ae0d593dec780b6d692800876a64e9d76784c313d8a618d3127fe15c77504b5365e1af6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001814, "uuid": "0bc22d24-016c-4b89-8bef-56b2d30bb654", "value": "5724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001814, "uuid": "709f1b6e-43f9-4477-8cac-660b19dbc5df", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001814, "uuid": "09614336-d7de-41b0-a68b-9e8d60a9c002", "value": "3072:19Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:19Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001814, "uuid": "8602b04f-efae-4203-8f69-bc0ec52b095d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001814, "uuid": "b7a5c257-2dd8-4251-8e69-6f3371d90bea", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001814, "uuid": "7a3cec4a-b5b7-4092-b174-1f4f5839ae18", "value": "807a77af78725f5d208dec14534b047f7cd2055c8953ba930502a0860d6badc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901730b8-8743-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616000981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000981, "uuid": "e951914a-2651-4c9f-b923-57700c7a4317", "comment": "Malware payload (AgentTesla)", "value": "c0e8f801c50b1e9bec6944358b14e9ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000981, "uuid": "3d62ad61-7169-4f6c-b892-6851a97fa76f", "comment": "Malware payload (AgentTesla)", "value": "8198b25c1ecae80819efdb80290c0f2f77deaef6beccc8fb035e8e603c7808ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000981, "uuid": "0993b12b-5134-4bca-9f5c-6a4f68cf6f6f", "comment": "Malware payload (AgentTesla)", "value": "0a0ed15a43c49f2d241667f5a5f2d00b0496b5ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000981, "uuid": "3dd9bf74-46e4-49ef-88f4-7c74435547f7", "comment": "Malware payload (AgentTesla)", "value": "2e0d0ed77e26857e0e32bd7e56a163dbee3af495206b8e21ab126fae0418963e8c678dd91e8aaad0a0c66a686ba1e14a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000981, "uuid": "76fe957b-e1df-49f4-98ab-dfc9fbe3795f", "value": "93F4F1A037B85F55E9B8B7F2156351882BB97A3BE266C31CDCCA60CD1D35F50A241B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000981, "uuid": "6afb2d26-6e78-4923-9a1f-c5ecde3040d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000981, "uuid": "3723d586-bbd4-41ef-bd8b-479468448032", "value": "12288:xN4r582Ne6vAO0XboRGnt9R/ZJTu4XvDT0zzQFjkAnTWPgUddddd:KvAxcRw9JK4kyPqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616000981, "uuid": "6c88f86c-092a-4e56-9726-84fff8bae383", "value": 749056, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616000981, "uuid": "e9206cbd-a1e6-4205-9755-904936d8bab9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000981, "uuid": "ff8be963-3769-4753-9fa6-ce39c3fbdf53", "value": "Payment Slip.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee019305-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003716, "uuid": "4e653e44-2c41-4297-854a-4caaaf216bde", "comment": "Malware payload (Dridex)", "value": "4f53323c94e9c562b61cf1f52a132a83", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003716, "uuid": "ae1fb664-f230-42a9-81e2-e423476b831c", "comment": "Malware payload (Dridex)", "value": "81aa22513794ccd67cbbef27e29033e59bc32f510ecddc28d104e9207f385fe0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003716, "uuid": "6e1e96f9-6ad2-4c9f-9eff-f7bc5a57cb3d", "comment": "Malware payload (Dridex)", "value": "01708fda29cf499f9a6aa9a5fac6aef18e43125d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003716, "uuid": "cef2d0ff-a10c-4c7a-b1a6-0b9e1b90fd5b", "comment": "Malware payload (Dridex)", "value": "9c93506cdca3c7e7b34aea41c8a8d42a7f95678dc0c2b6f4f197d4ccd0c5e68a7d69faafbd407c29ce42b7650bcef006", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003716, "uuid": "93343876-9e49-486e-8e43-bbdbba634ca4", "value": "7724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003716, "uuid": "499e85cd-b7d4-4b22-bc39-e2eae06ff8d4", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003716, "uuid": "f5249aaa-34e8-4aaa-bfd4-4f8c53b2173a", "value": "3072:u9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:u9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003716, "uuid": "858c2f4a-c0d7-43c4-b167-b65490e5a988", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003716, "uuid": "ff1a26c2-80e4-4ff4-921c-664baa1a6452", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003716, "uuid": "17a927ec-c99f-4a1b-9d0d-80834e43f30a", "value": "81aa22513794ccd67cbbef27e29033e59bc32f510ecddc28d104e9207f385fe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f16842-86b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Redosdru)", "timestamp": 1615939675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939675, "uuid": "4c6eca60-3b86-45fd-a4e5-20e8879730d5", "comment": "Malware payload (Redosdru)", "value": "22f4f84a54b8de13384ea8e47aa63c95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939675, "uuid": "0dbd7931-850f-4911-aaaa-901d784521ef", "comment": "Malware payload (Redosdru)", "value": "81d6978af7320d1e0631ffaa3b976b16f3475b235a9c072b88fb82dae0ad6b14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939675, "uuid": "8a6a3423-e287-4725-9047-f5a78b36e72e", "comment": "Malware payload (Redosdru)", "value": "7a762c618babae452cfd614dcd141d65a6c6baf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939675, "uuid": "432578ac-6ab4-4219-b8c4-c7ef215a28b8", "comment": "Malware payload (Redosdru)", "value": "68db0b3e1ce716c50f326b126d182ea31a48e8d1d67fafcea2b7537f10d418f159aec0fd1ea7e5ad7ea7dccf7fbe2573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939675, "uuid": "0ce6d2b4-8b30-40fd-808e-257fdf9fdbe0", "value": "B1A3F123B9A8D0D6D538017FDC8AE269D13FB362DF569D83BBD8234F28614C5D0550EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939675, "uuid": "3517c9ab-cece-4704-8b82-48088f9f0a24", "value": "73ec795c6c369c6ce2c3b4c3f6477daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939675, "uuid": "870598d7-61b2-4f46-9557-a735292ccf23", "value": "1536:1LySvNVtEFvcEUjR3kuh/o3fr1LCF/lc5AyDd7ARfypevpwST92O0kCM:PPtEFEES0uhg1LCNlcdG7pwI0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615939675, "uuid": "1e26dcd9-e93f-44ec-acec-a9252cae9f22", "value": 102818, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615939675, "uuid": "181cf8d8-8c70-46d6-b842-68b1b6d9551a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939675, "uuid": "554d599f-f340-49ad-ab40-ca5f3720fcf4", "value": "Dh2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa99bf4-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1615965842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965842, "uuid": "11af8061-16cc-4e0e-ac4c-614bb92af908", "comment": "Malware payload (Loki)", "value": "ec3b00481d0089d815a4a09e969ee8b3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965842, "uuid": "7e79fd08-d39c-4a1a-a0e2-f91e86b18309", "comment": "Malware payload (Loki)", "value": "81f0390adb960fa137af169d8304d5d149a31aec2ccfaee262bae2c9aa3a1e88", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965842, "uuid": "2a6c62e3-3e05-4406-86eb-53dc74c3a426", "comment": "Malware payload (Loki)", "value": "e760798b267fac4ff4fdb9d05559b989db6a05e6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965842, "uuid": "f408e154-e949-46ba-8543-d1af75634475", "comment": "Malware payload (Loki)", "value": "3d908f2a35e943a874421c3d3c96131c159a779ebf9583cb499f8dbbf29b2df203c1c89344f2c2cf488494d29cf3d14f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965842, "uuid": "7af639d5-1c16-41ff-b9a0-b7e78976d81a", "value": "8A8423D1BC0FF69447A873D937BA4C237AC2C9F2681441C0A59F454152E76286BF8C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965842, "uuid": "c5a49b93-099f-4d08-9b9d-5e3fa97b18e7", "value": "6144:jG7qGfRXfBNBv3B49KlqVdhS5AFKYfcPwUs142WWjpWCTNGZvPKjc9TE:SH48lqVdhS5A8wZ4VWjMCMZHKOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965842, "uuid": "22edcfbf-7b40-4f3f-871a-9b89cb481f7a", "value": 385391, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965842, "uuid": "b595bfec-0722-41c7-b5ba-7f6fa07e05d9", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965842, "uuid": "f60ab069-4e9e-4b32-a48e-e6f26076bbef", "value": "TNT Receipt_AWB87993766478..ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0452e4-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003848, "uuid": "08ff3762-1113-401a-9e17-23ba432497ba", "comment": "Malware payload (Dridex)", "value": "e6092d376c30facc059f6dc92118f855", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003848, "uuid": "1e72e07c-1f28-4e16-9f0f-dec8cd578448", "comment": "Malware payload (Dridex)", "value": "828676ca0165c96048e0be25175dea712327063e0f96939f4d851f3c6506c10b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003848, "uuid": "5ff5380e-76e8-447f-8bae-a9d9a2ab9b81", "comment": "Malware payload (Dridex)", "value": "dffb94b6814cb18cec78db0319074781c6123458", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003848, "uuid": "181c4831-b14a-44c4-bae7-5be5c7348baa", "comment": "Malware payload (Dridex)", "value": "26c6974cb3858cdbdb89ecec084909a4a36726339192e069fbf3c8e1ffed55e9387082ac31e48fd9a4f9c37c155301a7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003848, "uuid": "787a8a5a-96f9-4115-8f15-7d2d636b9a8f", "value": "C424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003848, "uuid": "2e6f6577-08aa-4292-91d1-e44ccf4635a3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003848, "uuid": "24f867a6-f1d6-43c1-ade3-cfff49ccec69", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003848, "uuid": "fb3ea4d0-139e-4a6c-91da-8817773c30d5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003848, "uuid": "da50de35-f14d-4356-a7d1-2803424dfc72", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003848, "uuid": "e28d6eee-46fb-40cd-94d6-6dc43c192a72", "value": "828676ca0165c96048e0be25175dea712327063e0f96939f4d851f3c6506c10b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed33a615-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616008439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008439, "uuid": "35fe29cf-c693-453a-a615-640477e7a87c", "comment": "Malware payload (AgentTesla)", "value": "965bfe87539532f79067a9fdf7b67a61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008439, "uuid": "222814fe-557a-4fd4-9b34-c81f12f63169", "comment": "Malware payload (AgentTesla)", "value": "82aaa2be9712c513dc78ebab36b41fe2848e23a6b60f13023c92024af0726943", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008439, "uuid": "e8d56103-7610-4c32-a818-ec88c8a5790d", "comment": "Malware payload (AgentTesla)", "value": "14323d900c165dd4956eb2bb962df5a537c7b90e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008439, "uuid": "30581485-009b-490f-9002-e4ae6b160db7", "comment": "Malware payload (AgentTesla)", "value": "ab1f0c4642f0a6d127f4a1d7a2a7d3b2a5e2b26f7b6f936230e614d71476fc4b1564424ca863e8d9dbb2784b5292ec19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008439, "uuid": "82843183-4526-4afc-900f-1ae56c4097bf", "value": "263381E9492844F7D73EF634D0931406B6B0BBB764249A1B85CF86C3CC0EB9729C566E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008439, "uuid": "71d3ad06-ae5a-4826-ad3e-07d92dfbd1f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008439, "uuid": "88c5340c-bab5-412e-80d4-fd58afc9a7e1", "value": "768:GfYlL0D859Ai4WBtFLOGY7/jTBGflvxoGflvx/FIwJGun51d1LDhHYphE:GfYlCgP4wg/Y1LDhHYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008439, "uuid": "52bba043-31af-4532-a1e8-42a294d86b4b", "value": 54288, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008439, "uuid": "dad65aaa-b8d6-42e2-bcf0-9a90ea7f6ba0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008439, "uuid": "4588f6f4-d13e-4a25-89fc-c6ec62bb2854", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8389ee0-8765-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616015759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015759, "uuid": "9995e0b7-31fe-472d-8cfc-4ac4b8e61be0", "comment": "Malware payload", "value": "0f97b47897ea029b309f48757f4ce439", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015759, "uuid": "0bf8a46c-d522-4b7a-9a9e-7b218b58f41d", "comment": "Malware payload", "value": "82f94824269d55e741308bae65bf5662204cc014930cfbf99c4c10773c8b3364", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015759, "uuid": "63d63d79-8f0b-47e4-8d04-2b4066297e55", "comment": "Malware payload", "value": "c31f852ff3395faadfe50a9c6834fadb68efac36", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015759, "uuid": "5928ecbe-49b3-4f2b-b41f-f07d4073ffd9", "comment": "Malware payload", "value": "2fd5e196f383876676d83551f5d527512afb3b9bf8bdfcef5dee865cba83251b9fe65f1768bcb3bd6bee7cfa9302fb64", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015759, "uuid": "0d20ebd8-6dc5-41d2-ba9a-e84558ddb022", "value": "8A24CE5CDBB6D865FBE3EBF20016932A95336D41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015759, "uuid": "5a7104b0-ed68-4799-9e9f-e39a8b472e67", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015759, "uuid": "239881a3-86be-4b6c-9cd1-0ffbb4536663", "value": "3072:G9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:G9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015759, "uuid": "f123bf49-5793-4583-8d80-1eeadb80bb45", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015759, "uuid": "5500e555-5eca-462a-8cc8-ea6e23b7cb0a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015759, "uuid": "63b5e6ac-17e9-48b6-aee4-3ed107f851b2", "value": "82f94824269d55e741308bae65bf5662204cc014930cfbf99c4c10773c8b3364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db56a38-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615965651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965651, "uuid": "0b21a9b6-e71a-477c-8f4d-5a851dfefda0", "comment": "Malware payload (Dridex)", "value": "46d40ab48a6a491a157b83b356c05dc5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965651, "uuid": "6c8d096d-2968-4ac0-b421-d76f816407aa", "comment": "Malware payload (Dridex)", "value": "830c9fe24d7c7b5545dd04972f7f2f5b91b82467d5cbc0f6de7f221ad3c790a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965651, "uuid": "663bdb0c-1989-4d8d-861a-cc584381ecfc", "comment": "Malware payload (Dridex)", "value": "f8ffaca039beb004d0132463659e194f1d8d74e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965651, "uuid": "44ac2916-e172-4e2b-b29b-561d415a2d6b", "comment": "Malware payload (Dridex)", "value": "5ac1f0d739109743c802a94b40403941e5a3b05aacfe06ed40b062601c5ca06de4ff09a3eb1b5996a3b9e67777046e14", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965651, "uuid": "edca38eb-076e-4bd9-ac27-ffdb14102583", "value": "65C4AE01B9538075D49722F882DED27CB91C7E66875821D777D0FEFBF9AA2E4687000A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965651, "uuid": "ee2d1018-2ca2-4bcc-ad37-b802570399a8", "value": "12288:q/AUurTn3fk/Px/mdq8xs53Cly1hq/bOwD7FPvewaEr9OAU:wOv3fAx+dZsdCE1ybr489VU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965651, "uuid": "5ec4d3a8-af68-4027-aabb-1b4a54100000", "value": 576071, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965651, "uuid": "d6f3f637-2c75-498a-a180-08ea6acb40b3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965651, "uuid": "6221f784-8360-45da-b9b2-59bcb82672e7", "value": "46d40ab48a6a491a157b83b356c05dc5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3296a652-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004260, "uuid": "f921327d-100d-4659-9ddc-f690b90e9a8d", "comment": "Malware payload (Dridex)", "value": "1c877d1ddbc0e298030d43808c37af32", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004260, "uuid": "a3e6cd06-1b15-4cf9-9171-da9d00562145", "comment": "Malware payload (Dridex)", "value": "8332484ad1fd68253fc4c189dbd7a38b96160f3f2cbcd508bfaec558fe7ad04a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004260, "uuid": "d5e59557-eb53-4da0-8c42-85bdf2d7d164", "comment": "Malware payload (Dridex)", "value": "53f641bea71c7f61f3113574d06f7400cdf2754a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004260, "uuid": "d6910593-f232-4614-a32c-b3aef5345c9f", "comment": "Malware payload (Dridex)", "value": "d23c540180d8c8351cedbbdae4f392b301f2f570a9f4fb8f0fca253189c5b8383e270b0449e45ec180ee8aa137eefbe3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004260, "uuid": "b9a99c99-0cc7-4c6e-ba42-12e73ed6a35c", "value": "A624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004260, "uuid": "09fbaa5c-2631-448c-b8a8-8d42624f6b1b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004260, "uuid": "ac178fe2-a0d7-4879-88b8-ab75927ef20f", "value": "3072:i9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:i9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004260, "uuid": "2809e215-6728-4e8b-bcf6-4fd741d0349d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004260, "uuid": "2fbfd815-7b99-4836-b774-7c03885730da", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004260, "uuid": "c0c2ce24-6aca-4286-8e0c-ca8caf6c4f05", "value": "8332484ad1fd68253fc4c189dbd7a38b96160f3f2cbcd508bfaec558fe7ad04a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d0a1af-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013359, "uuid": "cdf49439-18c7-44ae-8644-28c084464805", "comment": "Malware payload (Dridex)", "value": "5c63bb681ec644179faf6480e92004d8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013359, "uuid": "8f341143-1b71-4372-925d-d94fef19ed02", "comment": "Malware payload (Dridex)", "value": "837449a4ec5a75405a00421a001a2b65730f68bafb5f10c0daded0a1336dd070", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013359, "uuid": "e06f11dd-0085-4702-b1da-5af828f27be0", "comment": "Malware payload (Dridex)", "value": "4eb6ccc45364f442aea52d7ef993c2b2b13e9e6e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013359, "uuid": "3cade939-7f5f-495a-b5a2-7bd1a0fc7d6c", "comment": "Malware payload (Dridex)", "value": "b37d987cbb1f10f96ef925e8c3fdcf390ad285f734b3931ea925290a77d77f33c0fc4a5c70ce652b7f457bdb06f94cf2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013359, "uuid": "c905bf32-e213-4f1e-a367-af8eafac3fe4", "value": "8E24CE5CDBB6D865FBE3EBF20016932A9433AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013359, "uuid": "b232dfe9-8566-479b-917a-12ddc3b1b332", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013359, "uuid": "806b7f25-d66e-4acb-a9c5-c511d797b47b", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013359, "uuid": "ac3636d8-1ce8-4149-9e65-fc0b7be332e8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013359, "uuid": "44f11c60-d57a-4b80-b882-d7cba59ec76b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013359, "uuid": "db007801-68c3-4977-ab77-4c4ead6c5baa", "value": "837449a4ec5a75405a00421a001a2b65730f68bafb5f10c0daded0a1336dd070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a20c78-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003782, "uuid": "a1d3ca3a-07d9-48fa-b57d-d6e7366f7e2a", "comment": "Malware payload (Dridex)", "value": "cc609e034e77813fa3bd9267df9e8e13", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003782, "uuid": "a2d28da5-d895-4008-8a02-cb7d3c8d7efb", "comment": "Malware payload (Dridex)", "value": "83cf94657d1981590742def0f0fe5c31ca4297ecb2a531c3bce7935aa3865e5d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003782, "uuid": "7de34df5-1c23-488c-8ab9-d6e2136d4f22", "comment": "Malware payload (Dridex)", "value": "c810da90a28050731051c46108fedc07967d8b1a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003782, "uuid": "813c2caa-3ba8-4691-bae7-daa10baea983", "comment": "Malware payload (Dridex)", "value": "9a7b7deac501c69f542e354adc033f1f0a9384c6b96e30377494385c8bd02193e00f00fd1b156d2d67f9a59b7886bf32", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003782, "uuid": "3ca13272-56ab-413d-859e-eeee9f5646c8", "value": "7624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003782, "uuid": "7d0ce0a1-9afc-416c-b9b3-f2f2d18a35fe", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003782, "uuid": "ba55746e-8463-48dc-a584-858948b5485a", "value": "3072:69Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:69Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003782, "uuid": "4f6a6d35-1035-4c7b-a106-9ad2eee74cfd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003782, "uuid": "6fe8d2ac-49a7-4d38-b88f-fb1306906ffe", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003782, "uuid": "cd4b217c-662f-47b3-b140-67fa43d5d747", "value": "83cf94657d1981590742def0f0fe5c31ca4297ecb2a531c3bce7935aa3865e5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3356d3ec-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616012851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012851, "uuid": "e8e7ac98-e1f9-4467-a05c-109a076823a1", "comment": "Malware payload", "value": "e9c321b60450615fe2bb1567fab4729a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012851, "uuid": "8b116892-6472-425c-aba4-a1021c426ada", "comment": "Malware payload", "value": "83e875324c8ea1900046ae729b73406c07d641f7d8bfc9b4423d75ec7f93a000", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012851, "uuid": "73eb196c-c79b-4074-9a03-1646a714922d", "comment": "Malware payload", "value": "babbdd9f8750a9631445046ae69c52f132b06cb2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012851, "uuid": "7e65671f-86a2-451c-93b5-1f0ccdd46c36", "comment": "Malware payload", "value": "fb6c8dce9ab26ff0868b87057c451aa7bb1c24ad3e4a4635fd270377f6eb4b7523b0824f27b463ece1b26260e3598f9d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012851, "uuid": "e7c6a6ad-c667-444b-aa5c-bfdbc405f92e", "value": "DA24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012851, "uuid": "41f28d9b-0a27-4e4e-a8c9-7b2af4d357a7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012851, "uuid": "29541275-07bc-47ad-b4c4-b670dfa333c3", "value": "3072:U9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:U9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012851, "uuid": "15564864-a9a0-4c11-82a2-eedefca6eb9f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012851, "uuid": "34105504-0563-4846-ba5e-864bffec4b11", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012851, "uuid": "e473ca1c-f9c0-4203-be3f-9180dd553533", "value": "83e875324c8ea1900046ae729b73406c07d641f7d8bfc9b4423d75ec7f93a000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb413b1-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "b0827f36-673c-4d20-9ea7-e1c9fec89c65", "comment": "Malware payload (Dridex)", "value": "2c0539b948e09eb528b40670043e1217", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "5a175fcb-efb0-4846-b8c9-0f12d8ce7998", "comment": "Malware payload (Dridex)", "value": "84443bb1f8353905160d5fcb63862780eea64053432743d7a2289f19ca5db415", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "02caf3e7-0ba2-4ef9-a7c7-de8cde9640ba", "comment": "Malware payload (Dridex)", "value": "02289b325e3b18a2c8e1e15eb748dc218153216f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004336, "uuid": "c3058f6f-cca3-4659-9650-ebfa8e6ba42b", "comment": "Malware payload (Dridex)", "value": "abf1bddefe95b1b747c848b4bc0ea4cabd2d39bb506798b841741378dbdfab34ab29b1ba87be9cac8b3e66ff8767e0d5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "678baccf-4ab6-4069-b845-f254067deb67", "value": "4724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "ef78ea2c-ae98-4ee2-bb3e-c53c2caf9b01", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "b3e7fc7f-36ff-4424-8c16-7bd779d69f70", "value": "3072:H9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:H9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004336, "uuid": "06c81462-83c9-4469-9c4e-d983422db124", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004336, "uuid": "bb1492a9-a0d0-4856-9584-13e04a88cd71", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004336, "uuid": "47e3b0a8-4792-48d6-b53a-031a274b969d", "value": "84443bb1f8353905160d5fcb63862780eea64053432743d7a2289f19ca5db415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7061aaf1-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (DCRat)", "timestamp": 1615968716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968716, "uuid": "ec840896-c0dd-452b-a974-0ef3cee6225b", "comment": "Malware payload (DCRat)", "value": "9943818246b54e3acfea6ad7433c7f96", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968716, "uuid": "6d9b6b95-6312-4ba0-8d9c-954d41ea9450", "comment": "Malware payload (DCRat)", "value": "84ae6fe4cd4f1357409af9eeea51b0ceb8385242c1e67b1f22a51a9475f3ce01", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968716, "uuid": "32bde74c-0ed1-47b4-9c00-d690074ed64a", "comment": "Malware payload (DCRat)", "value": "59c614e5b6df1ad7e8eda4570f2ca779102a6e56", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968716, "uuid": "3693a464-04f3-42d3-bf6f-a8c28c3a1334", "comment": "Malware payload (DCRat)", "value": "03fff7bc55f67bd3da86555f37c3333d4700d9e2bd990ff6cc8a13f93342076e98d9a6ada0d370c1c2ff585f09c03ecf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968716, "uuid": "aafab99f-34c7-44e6-bdf0-c1116507b45c", "value": "6345334018C11A52C770EBB8938651BA0F3E987067FD0998DF361351FE4AE57A468FEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968716, "uuid": "ed8552e0-d929-4f5f-81f5-c576e111057b", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968716, "uuid": "afcd377d-2859-4275-a06e-f4a2041d4506", "value": "24576:5BpqnxTsBkc8KYwtg/UiJo58ej3ZOhd4vsl/pBpVgdAYYUrQQ:5XqxTWtV81e8ebZ0a0lXpVxxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968716, "uuid": "309359eb-1ab5-450c-ad34-bec1a0e794c2", "value": 1245184, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968716, "uuid": "38cf5bac-3d40-4925-a0d9-bd4d244d9903", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968716, "uuid": "ca6fe50c-1c86-481f-a5ad-7e345425e0c0", "value": "9943818246b54e3acfea6ad7433c7f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4a5dfd-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013031, "uuid": "9f122a54-5826-45a8-b0fb-b213cb910435", "comment": "Malware payload (Dridex)", "value": "e8bd9f12d09127d04eb4c0827eaca79a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013031, "uuid": "d7235c32-88d3-47d9-9fc5-11f562e94e42", "comment": "Malware payload (Dridex)", "value": "84e423f8e7fde9eaba3347ed5022f808bb167a4fa6c2d418dc729be89ad0ddfd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013031, "uuid": "4b60f298-3b39-4a37-b0bb-11d924fbfc8e", "comment": "Malware payload (Dridex)", "value": "17a9eed170e3dd2e0450ada7f1a8dee3a8b0adde", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013031, "uuid": "040787f6-1499-4863-bfa1-a2e11cfd7418", "comment": "Malware payload (Dridex)", "value": "73bdef2484efa47db83ac0090cc2f9a8e41d58536a77927b12112bf4cfdfb4dbf80b1320f551f98e1891d51578fdb0b1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013031, "uuid": "631115f9-66cc-4191-b260-1438bc56b669", "value": "9F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013031, "uuid": "457267ea-33f8-429e-91d0-590729619a8f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013031, "uuid": "08897848-3f14-4670-a6aa-5ab83004108c", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013031, "uuid": "48463f5d-be93-4c32-8244-970fd272c42e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013031, "uuid": "594d4d11-b455-4913-bc12-eb41c96e1c2f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013031, "uuid": "c38350db-380f-4224-a81a-de1626e13cb1", "value": "84e423f8e7fde9eaba3347ed5022f808bb167a4fa6c2d418dc729be89ad0ddfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875504e5-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003543, "uuid": "29d6f9dd-fb82-4603-9f26-498aabeb6214", "comment": "Malware payload (Dridex)", "value": "79a81078e4900093cf294993d3fd7202", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003543, "uuid": "ec5b5fa4-e3f3-4d89-9d22-aa9c9747069e", "comment": "Malware payload (Dridex)", "value": "853977eda56cf590a584cb4cc69da32da6b135600fb30249a704d9c0c2fcf630", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003543, "uuid": "82bb3266-87e6-4551-bfd0-dcc3c6e365ca", "comment": "Malware payload (Dridex)", "value": "4731afd1e0298a083b72cef0d8e77b9aafba3be1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003543, "uuid": "75ca95a8-37aa-4fa6-a13b-523349caad0a", "comment": "Malware payload (Dridex)", "value": "3691ad559ddbf4a2fee84ed13d4f677d2ce38670f9ae3ebd400b903eaa0ff09bc41785e7c7d5c1571d5db1fab9af4821", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003543, "uuid": "52bd0e73-2cb4-4d27-bd3f-191e15462a5a", "value": "9724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003543, "uuid": "8aa4bb44-4c07-48e9-b596-f793c99f22cf", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003543, "uuid": "f1780e66-0175-4378-992a-e5945ca2c40e", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003543, "uuid": "345e1a29-4027-4031-81f8-88afbd329314", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003543, "uuid": "482868f6-f8ac-4439-b84e-3cae8373abf8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003543, "uuid": "8b857dc3-4b06-40af-ae13-ec0611631817", "value": "853977eda56cf590a584cb4cc69da32da6b135600fb30249a704d9c0c2fcf630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8198639-86c9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615948703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948703, "uuid": "c7f60599-57a5-4915-8fa1-93a50a37620d", "comment": "Malware payload", "value": "b43fca5283bfc7022553eff663683834", "object_relation": "md5", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948703, "uuid": "6b1ff706-97b9-4037-93a6-3c0d04f5e19c", "comment": "Malware payload", "value": "8572470dc6ecd6d6d9c6068004421802adc7ff14826335b607c42901836475a8", "object_relation": "sha256", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948703, "uuid": "d9c39d08-bbde-4faa-a9ce-a48eb331cf1d", "comment": "Malware payload", "value": "f004386122eb4e287cffdd1cf4930f966525e5b1", "object_relation": "sha1", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948703, "uuid": "31e5464e-7747-4457-9c72-366f29902d3c", "comment": "Malware payload", "value": "e37c260a9addc38837ff7b099c460d1993ac586edff688f16001892491cab697227106ad9ca6eb739b093deaba91d7e0", "object_relation": "sha3-384", "Tag": [ { "name": "BadHatch", "colour": "#1C37B9", "exportable": true, "hide_tag": false }, { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948703, "uuid": "4422b6e4-c0bb-4126-a710-e0538070f4ec", "value": "9503F142C621A26F817474199CF175AC33E98EE66390DD836BE3D496F73F02D1B6A04E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948703, "uuid": "b25abe3a-417e-4991-8a3a-b6de5292691b", "value": "768:kN6HZrvVfamqGmOmq5BGbxs2MIeNwmhiRsd3S611UBU0rj7KgLxEPQr:k+Zrhy05BgsVZaEag33erz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615948703, "uuid": "81f974f4-4566-4ed2-a2d2-603f6520e33f", "value": 39878, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615948703, "uuid": "c6b1d10b-ab6e-47e8-b5d3-744d80da7ec9", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948703, "uuid": "f5352083-deb2-49b6-9bea-43361fae3cea", "value": "FIN8-BadHatch-Shellcode-32bit.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e337a476-8750-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006704, "uuid": "0905dd0e-0d29-4ed6-884c-dbd93497c251", "comment": "Malware payload (Dridex)", "value": "7901a4e2733c4cf7edbb6c45b03af99a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006704, "uuid": "9aeecfd9-04c9-43d4-b0bd-258cf94481b8", "comment": "Malware payload (Dridex)", "value": "857a6a6466bd49b529f2235036b582693c41f955caccb1de8aa585de3117a9ba", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006704, "uuid": "bf2df0cb-8661-4b9f-890b-d574d8fcfe9a", "comment": "Malware payload (Dridex)", "value": "862a2957d3599d4fc4c8214232dfe1f7a7f2ff04", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006704, "uuid": "fc8d6d2b-efaf-4867-afe3-57c5becd2771", "comment": "Malware payload (Dridex)", "value": "4f8992b3c86975bd60a329286da77bd0bbef5aacb5fd0d7df107d93f0d4f4ec6d66430b9e4eba56456aa052810b68f1c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006704, "uuid": "59452c96-bff6-4b2f-9295-e81bbaf8d04d", "value": "E624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006704, "uuid": "eb30a5dd-d2d0-4890-9858-51b10427a221", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006704, "uuid": "bc6aeb50-8533-4e76-bdd1-6c501780ab68", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006704, "uuid": "940421a3-69b5-40c1-a829-d4d5e29bdd47", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006704, "uuid": "69453133-f001-47c8-870f-4717383f8183", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006704, "uuid": "99aa8776-6c3f-43c5-90fd-50e00a77d7d3", "value": "857a6a6466bd49b529f2235036b582693c41f955caccb1de8aa585de3117a9ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97e7976-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "180212bf-c2a6-4759-a314-7cf4d63535d6", "comment": "Malware payload (Dridex)", "value": "029700e221b5ffaf17ed930ac61885f5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "4f904cbf-7122-454a-a8a2-c47afa7b780f", "comment": "Malware payload (Dridex)", "value": "85c24485b9eb3ddd70315bc5a89826d753dfa4ca3eedda9c486f21fb65c1e0cf", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "7f106e48-accd-4970-b072-0379ea3b7f42", "comment": "Malware payload (Dridex)", "value": "24f949345d11e7daee98f46ad7eabac58c2b9e57", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003735, "uuid": "a8c76ec0-e5c6-4fce-a701-9a22882c29c7", "comment": "Malware payload (Dridex)", "value": "eaa3b8b30096664cfb214811ad0967110a15286d7049469576830809d33ce0c841f677c5d46f0fca5eda75605c772c7f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "76dfcc5d-5a4d-432a-8a73-88f3b1a2ffa1", "value": "0A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "6986338c-87d1-4069-bf27-39b0591f6de3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "b767a4c9-dad1-4210-a200-84fd6d0289a5", "value": "3072:Q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003735, "uuid": "fcb30b7b-4761-4b14-9553-2d0f0f5fe2fb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003735, "uuid": "b3a70c2b-dd6d-4362-b1f0-d2ef801680ca", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003735, "uuid": "dbb74d06-ccd3-4085-b7bd-6b56eb43554c", "value": "85c24485b9eb3ddd70315bc5a89826d753dfa4ca3eedda9c486f21fb65c1e0cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce5b08a-8768-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016894, "uuid": "b8d8bc64-a73e-499b-ba0a-82c8d9b6a6e5", "comment": "Malware payload", "value": "cfcac6cc35a997e586f83a42808c7ac5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016894, "uuid": "2cfb5198-0ef2-46b1-ac9c-06d7125ace9b", "comment": "Malware payload", "value": "85fc7d4052d91ae0b2752dd802a179352007a1333301f05e70941d8d8c4b8c6f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016894, "uuid": "5cbc30f9-2b54-4431-8b44-6e8d93b4f10f", "comment": "Malware payload", "value": "4f088fe77135696bb3236c4300388985b2f78789", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016894, "uuid": "e13f2ba0-c958-4250-bd01-f9643d51c1a4", "comment": "Malware payload", "value": "b07c4b8e31263dee0af9a32659e1ff2175eb628054c9f8b680b8fec8fd376141f486653c4d97147af48cc579ed6ec92f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016894, "uuid": "e1ece2c4-6a44-4229-a0e9-95a232dae761", "value": "A724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016894, "uuid": "6520cb2e-0715-4a9e-87fb-5722f5506bf7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016894, "uuid": "ac3bf367-692a-48a7-9a5f-45d3e750322e", "value": "3072:I9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:I9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016894, "uuid": "0516dcb6-05b1-4598-a683-3392df8701cd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016894, "uuid": "3cec9b57-3aaf-4319-bc71-748fb068ac5b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016894, "uuid": "82d06b87-feb4-49cf-8180-2800ac33da67", "value": "85fc7d4052d91ae0b2752dd802a179352007a1333301f05e70941d8d8c4b8c6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7059f8ca-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003934, "uuid": "6af5821c-8163-4056-9080-b90b7d2bad2c", "comment": "Malware payload (Dridex)", "value": "9999797e176230385dbb1d31ec612b7c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003934, "uuid": "bc73fb6d-7a8d-447a-ae63-d23f2173a21e", "comment": "Malware payload (Dridex)", "value": "86307878ce85f0c0c92d3ab4be075de7931f6dd691ab44097a179de5e423322b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003934, "uuid": "26f1677a-1236-41c5-8751-1bfa46b98863", "comment": "Malware payload (Dridex)", "value": "d99a2aa05730a3dfc13ee50fbd291b565ca299f2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003934, "uuid": "1204b1b1-f1fb-4876-adb2-326d89205815", "comment": "Malware payload (Dridex)", "value": "d8651283f4f365c6d060d8288b7600084f7c64629e1a5cd3e930c88dd5364877454686f2147d818cc075ab216c0202e6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003934, "uuid": "48b6f766-dd21-4378-bacd-2a2881249857", "value": "0D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003934, "uuid": "28e40bb7-e60b-4e65-b763-5f56e4030320", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003934, "uuid": "1ca59263-257f-4a69-8e4b-ca2bf2143aeb", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003934, "uuid": "67d11f02-a0cd-4d31-a4f1-0b9f33053b7f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003934, "uuid": "75800c25-890f-41a0-9edc-91802937258b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003934, "uuid": "bd421bd8-a5ca-4bd9-95f9-11ad02b4a2d8", "value": "86307878ce85f0c0c92d3ab4be075de7931f6dd691ab44097a179de5e423322b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105f6cce-871d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615984446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984446, "uuid": "2b39fba0-a93f-486a-ac79-ff55c4669f81", "comment": "Malware payload (Formbook)", "value": "bd4eccb7a2f94edfd67a8dccd922ce69", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984446, "uuid": "7d93e4db-3329-4961-9238-a03003155ed6", "comment": "Malware payload (Formbook)", "value": "863feaaa09f8203f6818ebc09e4f6a5511d4b838a16d862a0c0183fd87d1ae45", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984446, "uuid": "4a44acbb-f86a-405d-a9f2-9148680533d1", "comment": "Malware payload (Formbook)", "value": "7a1da4e4bbf96a10e711a343fcaf772031da5e02", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615984446, "uuid": "5dac2b14-7fa3-4735-8c06-be6febc01955", "comment": "Malware payload (Formbook)", "value": "b8bf92464d7b6df27acd08a70cbf316aa6a920f3bd9839d0a86a57b469c9ec2d0afd7fb325e9d3e9cea810487398f073", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984446, "uuid": "e0d5a723-2c16-44ed-ac3c-072883d5426c", "value": "0C5533D674F61B9213716E0B67853B2B6FCB8EB2A042937ED42135F86237A0973B4C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984446, "uuid": "1adead25-e290-4059-957e-1db8b5e9b2de", "value": "24576:ZWut31gky5zpFPBxuaKXJajlqJnnYz35RzmhXW9hHEms:0ut31gBlFZxunAxCniLzmhXYJps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615984446, "uuid": "f52dbf28-7b53-40c0-a2ab-fdf4826a444c", "value": 1300883, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615984446, "uuid": "65fb47da-46b0-4cda-957f-57461cec3c4d", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615984446, "uuid": "c5680fec-e55f-40eb-8b79-182bd1dcbb6f", "value": "PROJ3144534685007.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d639f84-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "e5a3dfb5-1aa7-4c86-9b3a-4cacf22822d5", "comment": "Malware payload (Dridex)", "value": "adbaebbf65ae4efe73c9da25bc95e162", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "f2716f73-4f5f-47cd-86d7-0e9fc4046b30", "comment": "Malware payload (Dridex)", "value": "867230adeebc45b0a2441d6952ec4d664c5fd679420de4eab61a5c3b010afbc0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "bbc8bed7-bb4d-4f4a-b345-79e3f3dc17ef", "comment": "Malware payload (Dridex)", "value": "b09b8fec6c3a28846b08a3d72942c277ab4de237", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003956, "uuid": "3d0f94ee-e9a8-4f3e-9cf8-c1189ac7b56d", "comment": "Malware payload (Dridex)", "value": "1d9be3c832feed26b4479e5d033fc01ee9cea67da3712f932715219904c6a171e842d161ac5d9886dc6ff95d98c32c15", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "59227f5e-561e-4dc2-ac0b-4773b0289364", "value": "2224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "cc9a26fd-35bc-43c1-a8e3-9bbc7a9c888d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "5f95ba45-a5e5-40a6-8747-1a01d4d8a9bb", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003956, "uuid": "f4f2804b-9377-4b85-ac0e-4451f2721d88", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003956, "uuid": "aa354bdd-1c23-4f96-bc16-7e3751b39444", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003956, "uuid": "1db1a0f7-9357-4b66-b40b-e9e6cff93f8d", "value": "867230adeebc45b0a2441d6952ec4d664c5fd679420de4eab61a5c3b010afbc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778059be-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001799, "uuid": "4b702e6d-e353-4088-9613-dafceb99b5b0", "comment": "Malware payload (Dridex)", "value": "cf78a79ef3e68f417c31d5163018b172", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001799, "uuid": "0ce49f61-6c60-41e9-82b8-ff09a49cdfb1", "comment": "Malware payload (Dridex)", "value": "8672bf9c47a84dca27d394aaee03ff8263dfc99015bbb57d878d5d9b2fbf1c45", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001799, "uuid": "d7798b26-3835-4038-a648-1c5f8e5fd94c", "comment": "Malware payload (Dridex)", "value": "21b870bbf4c03f3ae3174a3f0972772ab1c7f501", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001799, "uuid": "d113ffd5-d356-4b40-8648-870d3b2eccbf", "comment": "Malware payload (Dridex)", "value": "3fe66d495ebc302cfcec8f76fddc79c28930a34635c62bcb63db5d3e863dba1e90a89eef5a19f385e2af64bd2c06c1d4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001799, "uuid": "683a0423-09cb-4c8a-bfaa-6459ae529ce4", "value": "ED24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001799, "uuid": "4af61b01-3dca-48aa-b12f-1946c84827f1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001799, "uuid": "51e1ebfa-c7f6-42ef-8ef5-8e6e75166eaa", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001799, "uuid": "8d862013-c320-406a-a459-c7366cfe01b9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001799, "uuid": "5cc14e3f-2338-4b02-88d2-eb75bd094853", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001799, "uuid": "430748fb-4bf6-41b8-ba35-2d7186a3b354", "value": "8672bf9c47a84dca27d394aaee03ff8263dfc99015bbb57d878d5d9b2fbf1c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b9a3cb-8770-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616020158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616020158, "uuid": "4b429da5-3bc9-4f4a-b081-2ec246bb66ba", "comment": "Malware payload", "value": "06d87438c15d9ab1ed6531ea0ec5c999", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616020158, "uuid": "b997064e-24d2-4efd-969d-7c38af87eba9", "comment": "Malware payload", "value": "86850eb287e65eff3602bc7d7a3fccac9b77e7c29ef0e1e9643c89d927ecf49e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616020158, "uuid": "ed869bb2-24be-4e19-9ee9-8bce2b135dae", "comment": "Malware payload", "value": "52ccdf91e5ae194e06450d184f5ae83491031e09", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616020158, "uuid": "f07a7181-e89c-4d7a-ab11-cd09012bcec5", "comment": "Malware payload", "value": "da181948b0691970b13ccd61c426277063de3113a0e32cdbd54801558a20bc57ca2f477c7ce236916b3ccdcdd32154ae", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616020158, "uuid": "849607ec-f10d-4380-b432-6bc2c5f76045", "value": "D024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616020158, "uuid": "fe8ca3d1-c15a-4da6-9b88-03825f2f0c2d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616020158, "uuid": "29700df4-63f2-4b4e-a297-1f97b82d2e3e", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616020158, "uuid": "74cde09b-ff9f-4c01-85e0-1fcbb16642a0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616020158, "uuid": "bb60282e-c378-4520-a40d-d6609032f98e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616020158, "uuid": "cac37a59-9afe-4133-b741-796b61348322", "value": "86850eb287e65eff3602bc7d7a3fccac9b77e7c29ef0e1e9643c89d927ecf49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7820aab2-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011249, "uuid": "84a69fc2-59de-4ff6-a38c-21cc7c8e862c", "comment": "Malware payload (Dridex)", "value": "46c2dc97600fc814bee16b4d0d6bf3d9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011249, "uuid": "ba0b7d17-ebf9-4c19-8e9c-430d5c1f6ad4", "comment": "Malware payload (Dridex)", "value": "869a279f2df2613bc8015ab1e025feaf75dba5ea59a686ddf3ba3b083d446f74", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011249, "uuid": "27f66d2e-4a87-4579-a4d9-f279ffc51c1b", "comment": "Malware payload (Dridex)", "value": "b53b772ce4c5d57a7091d680477af71b8427e989", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011249, "uuid": "13be4202-cbaf-4fac-abb2-d53ea3a8e964", "comment": "Malware payload (Dridex)", "value": "730213d6c3e251cc111edcb6d514e7bc6ab63e22a6ff4d8a308d931f4d4dae35d8bf3d4c505b0a4f69e1fc8f4f7dcd01", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011249, "uuid": "d52a99ed-5978-4572-8982-ff8a26dd7470", "value": "3C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011249, "uuid": "600c6e43-fda4-493c-b44e-8503fca02ab3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011249, "uuid": "3ace6e4f-f9e8-4583-a06a-f9f60b4b1ea6", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011249, "uuid": "30c10e95-4a37-480c-b97d-35f5b13b8415", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011249, "uuid": "39797414-2cb5-4e1f-bac9-8e714fe062ab", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011249, "uuid": "803e8a6f-ac7b-4224-ad29-bccbcd7e5710", "value": "869a279f2df2613bc8015ab1e025feaf75dba5ea59a686ddf3ba3b083d446f74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86366ff4-8742-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616000535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000535, "uuid": "2cfd90d1-2e9f-49fd-aa57-63d7a665578c", "comment": "Malware payload (AgentTesla)", "value": "49ef8e9c9bf1d4a9325b7e0a838c95b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000535, "uuid": "4852ecdd-2906-4709-86d3-4b2fe535a285", "comment": "Malware payload (AgentTesla)", "value": "86bae0f75e1ed0d968378df8eb278a548df3ffb315638cc9ac2eb29b826d2237", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000535, "uuid": "7cfd94fd-76c1-4fe5-a769-04528bfebf42", "comment": "Malware payload (AgentTesla)", "value": "e2b3e2d2f7432c18e3f7f60072a1c77ae247c23c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616000535, "uuid": "23a7ad80-55e6-460b-a028-e8f3564b8e02", "comment": "Malware payload (AgentTesla)", "value": "891b1011dde6ea8948d822a200dd5ff231762c932faa4a47c176a7c997478175ab4ec3b508fe92ee928758c65e591529", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000535, "uuid": "f14b60ae-aae4-484d-87b3-f60d9cc1b8c0", "value": "63C423F7F6434050CC49A9316658B4C7F7BF2526FEB598EF1B313E84829865214A0FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000535, "uuid": "b4e6194f-12fe-4ca5-922a-87a51a3a65bf", "value": "12288:xTJrusVrspewyOGGGvfG0GGG7jpP7OGGGTU5dUGofHn1Wm8nbbJCCXjf+Gc60MmE:FJrr6ewyOGGGnG0GGG7jpP7OGGGTU5dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616000535, "uuid": "66438bca-fd48-49eb-9b4d-9e0d54365114", "value": 592314, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616000535, "uuid": "23973c26-7d71-4323-a4f5-9517fc6ffaa4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616000535, "uuid": "ba36374c-d688-43cb-8956-e72f8f15fc6e", "value": "orderspecification013#9000#.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b70160-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003945, "uuid": "a86aa285-96c6-4bd7-9c37-2d3b79f53687", "comment": "Malware payload (Dridex)", "value": "56f4bd6f164c1129e47ae8cf1cd12652", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003945, "uuid": "965756c1-9c6b-4648-b9e3-0b2a71e28036", "comment": "Malware payload (Dridex)", "value": "86bfba229d1bee4cf977b68e68c7cb8b924e7e0bed29bdec48a55b88657c48dd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003945, "uuid": "9d25115d-3e37-4cc5-a555-92f9de4261d0", "comment": "Malware payload (Dridex)", "value": "9accd8d44f35fbc40a771d9c63a0734b9ab06753", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003945, "uuid": "08577c23-7312-4ad8-9d63-00f30b0e80fb", "comment": "Malware payload (Dridex)", "value": "d68f5f958165448b25b8c94a32628753837fb8ab7da886c44a4c2982f74497cf3b17f6e56eb0c75dc650dac2d7d25c02", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003945, "uuid": "2c61c1b7-630d-443d-bafb-d596e0d8deba", "value": "C024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003945, "uuid": "f9a439ac-815f-4a9d-b4c8-00c5757112f2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003945, "uuid": "1b103cb9-3d5d-4de0-9959-1e9f30745c88", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003945, "uuid": "b5d621e7-88b0-43f4-afca-ee920368fe71", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003945, "uuid": "22cba8c5-b263-4244-b337-4b71b2044a60", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003945, "uuid": "f662c449-88db-43cb-87c6-6facd310237c", "value": "86bfba229d1bee4cf977b68e68c7cb8b924e7e0bed29bdec48a55b88657c48dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9e8c47-86ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1615962861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962861, "uuid": "84ca6c84-aa79-48f9-a1d8-187b299c563a", "comment": "Malware payload (NetWire)", "value": "71b8fa2a3648f02cbc42345764c87dd3", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962861, "uuid": "54f6db8e-79ad-43de-a4b7-75dc17c580fe", "comment": "Malware payload (NetWire)", "value": "8703189c4daa93f00f2df754ec0c15a99a5de04aae76d95f38befb3285302981", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962861, "uuid": "fa96c4a6-0a54-4928-a162-a3ce5aee2dfa", "comment": "Malware payload (NetWire)", "value": "8609fff66c77f08a8fe28336a0c97444500aad80", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962861, "uuid": "34fa7fb3-5c45-4b3c-825b-bb27dc1f6408", "comment": "Malware payload (NetWire)", "value": "5b7ff69b8f8ac9fa291dad2cc78b9ba1b37a21dc6fbb65aa93c5941015949bce8f20d2b638bf6250a243bb627d102db1", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962861, "uuid": "e1882140-b22d-4f79-adcb-440632026ac9", "value": "16450122A5808473F9B65BB512369A98F3B58DCA2DF14D0BBB4C3B563BF20C3481655F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962861, "uuid": "f6c19254-b6a1-4cb7-93c6-792cb102d730", "value": "6144:uhjmmejORX37kOr+XaPZAZMj6A1CVVUpjEduX1Lb48dfXuOT:6ejgwfqKMj6AqipjEd2ts8dfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962861, "uuid": "ade81f80-ed85-41b2-bba3-d4b748bd611a", "value": 1245184, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962861, "uuid": "c9c3c668-361e-44bd-bf83-c4de03439f29", "value": "application/x-iso9660-image", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962861, "uuid": "91c18a3c-5aec-482d-8788-5ac0c4e6011c", "value": "Scan_Quote 16 Mar 2020 at 1.85_Bz5543_PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dde2c18-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003554, "uuid": "6231e24a-3261-49b8-a599-d0b576ff599b", "comment": "Malware payload (Dridex)", "value": "2d8690ad29cd22e78a4b064395cdca91", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003554, "uuid": "5c4d9001-c9ab-4127-acac-6563c35d3f24", "comment": "Malware payload (Dridex)", "value": "87b68d6ede81c880bdda11d2249f9703770e54b67ce190f01182190f2b4ff277", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003554, "uuid": "c460314e-01e8-4b9a-8c0f-b026a826670a", "comment": "Malware payload (Dridex)", "value": "a1e85857a82e4c01760153dcae365aaaaa2a4216", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003554, "uuid": "c1addb5c-4305-4cac-93c7-06195b0ba84b", "comment": "Malware payload (Dridex)", "value": "1292f5154e85ffd44797fc24f8d89770f81869ea2bfb7c8c0738ef1e157a71ac8fb50ffad4de7f93e786c10d25efbbf2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003554, "uuid": "5346b88a-fa1a-4d39-a440-87e59738f2da", "value": "2224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003554, "uuid": "46553dc5-e504-4fa0-bce4-c58541e808f6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003554, "uuid": "0e7f6899-01f9-4ebe-82ac-d8c73510377c", "value": "3072:79Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:79Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003554, "uuid": "10f17650-890e-4f7a-874d-0cea2e3b2e4c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003554, "uuid": "06e1ef32-a886-4881-967d-00c76e64591c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003554, "uuid": "77cc3fe3-2962-469a-b22f-7c08e1a0212e", "value": "87b68d6ede81c880bdda11d2249f9703770e54b67ce190f01182190f2b4ff277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad7f564-86ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615971579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971579, "uuid": "94c546b3-a277-4479-8c69-98b984482eac", "comment": "Malware payload (AgentTesla)", "value": "c7daae359ccf3eb80dad4207dd0e375a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971579, "uuid": "307a24cb-7f34-40f5-ae72-b8ff9aa58a6c", "comment": "Malware payload (AgentTesla)", "value": "87c5b44f252965fb3a2c033ad66de6e4e11219439610e288eaef26832314838e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971579, "uuid": "f2701a10-d6f7-4eac-bc7f-1f8c10585fb4", "comment": "Malware payload (AgentTesla)", "value": "3c0af1334879595500e970995f65cfe4b8d6f509", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615971579, "uuid": "044bb4a9-3246-4e1b-bdc2-2fad93173a6d", "comment": "Malware payload (AgentTesla)", "value": "efababc83464d890d15d2640aeed1756ad2676357dc92cb8f13010f29ac68e3d5e34bf72769291eb4e591b0813958b74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971579, "uuid": "af20d2a1-6cfe-43ad-beb2-b0ca974653b5", "value": "F6B42295F5CA4F12F0470777AA97362C621CDED607CEE54B0798BEA92C34BA1E10972C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971579, "uuid": "314c886d-541a-44e1-8149-5349a82afb64", "value": "12288:ZpxSlXpWB9w5EZvFStexRdCQ8Ogfo3PzzvuNScYhP:ZpslXpaw2ZvDRCQ8PgawP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615971579, "uuid": "4e616aa8-80f4-4190-9f84-3ec757443333", "value": 508928, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615971579, "uuid": "3cddfc3f-03f3-43a5-9f48-e5a345d30aaf", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615971579, "uuid": "f643fc0c-8d69-4149-9c47-8ef1a8fd8bcc", "value": "New Order-PO08337.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ceb31fc-8703-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615973488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973488, "uuid": "79445a62-746c-4d27-a487-7d4931d0f48e", "comment": "Malware payload", "value": "a16225aa2cb7f0c1c4f975bb7a9eede0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973488, "uuid": "435a92a7-d03d-439b-ab44-3263eee256b9", "comment": "Malware payload", "value": "88056d251eaa713c922d375e82c3ac2f1daccff6dc13f1a5b02e091bf698bbbd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973488, "uuid": "1478acdd-87ab-4096-ba1f-458b5b2aa120", "comment": "Malware payload", "value": "b3b536166ffa3993a0ea16464fa41e3fa9db9cb9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973488, "uuid": "c5d1af57-2078-463b-9556-87c886b21a74", "comment": "Malware payload", "value": "538bd08cfe17b8f1d8ca02fda9ff3d3b1af63a49ba1c1d7f810fc6ea86b749de813684a2fb5e7b0c699c8a64338dde4f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973488, "uuid": "5f0374c3-b919-4e8d-b7ef-16b6e92591e0", "value": "3E356BD369ACCD83D5397ABEC9E27CF6132D9D3FE19891C41452738A1A75380ADC21E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973488, "uuid": "5fc8c46e-1d28-4a84-b12f-8f52330e4168", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973488, "uuid": "810b52e9-407b-4e0b-ad40-0d8090be01fa", "value": "12288:5dmgyyU6Syny3y7c1WqMbaONry5UbXYoNe8gKzUjc1bdQHEQp:2gysLGyCWqMbde5IXg2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615973488, "uuid": "d93014de-a1df-4b44-b7eb-e066a45c3eee", "value": 1088512, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615973488, "uuid": "cf86d065-1b37-45c8-a8d2-74aaf313b110", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973488, "uuid": "d87d82ec-2dbe-44c8-802c-f1ce16eb3f38", "value": "SecuriteInfo.com.Trojan.Packed2.42850.8622.24363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83aa1a2-8746-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1616002364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002364, "uuid": "e24c347c-1c49-450b-837e-52702fb4205f", "comment": "Malware payload (FormBook)", "value": "e82c6030a8689e35ffe4438c566f0e00", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002364, "uuid": "e53100ab-dee3-4364-b3f0-c62e24e43e3b", "comment": "Malware payload (FormBook)", "value": "88301dd513baa3801843eeb31a572ac54d4de4698fb24e68fab0584c6b8cbea6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002364, "uuid": "4ae0469a-bb29-4e21-a4cf-8267048682e2", "comment": "Malware payload (FormBook)", "value": "4b54cc70ccedac6e9ab44a986487b13e33d01220", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616002364, "uuid": "4d65909b-ec74-4e54-861c-7d3752df6af4", "comment": "Malware payload (FormBook)", "value": "b2e7680ff7381c20500629d427a29007d9aa50abc638683e2a635c20d56a5427a5cb0ced2488cef26e52097cef58d6e3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002364, "uuid": "05151dc7-50aa-4d38-9802-fb37e7bfa905", "value": "9D25F12E17387B15E16823368CA1B52452B89C0532A2D3F6ADC0BCDE3D9D79895F12F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002364, "uuid": "d467ee36-eba9-4394-b0c7-7ed01a1b19f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002364, "uuid": "09a4f92b-63c0-4ca5-ad22-a1a9b6216fda", "value": "24576:5EzZRIIcKmaYG1u51Ke7c1uyp3sjaKgXa4U22o:afdcraidc1u68vUU22o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616002364, "uuid": "dc9050ae-fbb6-4abc-aa64-d2cc7e967e24", "value": 973824, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616002364, "uuid": "c721b749-a06d-4ce9-b36e-335aa9074d15", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616002364, "uuid": "7ff59ee1-076a-4b56-be3f-d481d18e3f2d", "value": "TT COPY.png.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c7bc8b-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "58312701-420c-4014-a1d8-e0a39254afbb", "comment": "Malware payload (Dridex)", "value": "8435bcf7e6f7f7c8b9a8b89a35460934", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "32414c95-fc49-4106-ac02-57e72940be28", "comment": "Malware payload (Dridex)", "value": "884292eac7b625bc34c7c15f9009429c0834d574572deb89f21badb2e8663683", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "d17275e9-d20d-465d-b1b0-f7cbb2c12f24", "comment": "Malware payload (Dridex)", "value": "6bed5291c47b4bb370c16001fca1ae8f3b903913", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "8964b09a-f1ac-4cae-9699-214cd782a115", "comment": "Malware payload (Dridex)", "value": "ce842bf7189736be13be537bd0dcd5e5abd2264bf1138f2923e5a7f9bf1184ec7ec2c902f354ea91d02f589629e6554e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "3a2e9b02-c8ab-47c5-abf0-1d8146f8e016", "value": "3524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "e4ec74b0-39a0-4e09-a668-b98dfea101a3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "20630e3f-87b2-4820-bff0-24574dcb98ae", "value": "3072:59Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:59Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003839, "uuid": "9d8e6659-277a-4a69-a834-0b7a0106b23e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003839, "uuid": "7831dceb-d0d0-4d79-b341-28e53df20695", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "72ff3099-b5f3-450b-8c61-59c498975224", "value": "884292eac7b625bc34c7c15f9009429c0834d574572deb89f21badb2e8663683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9521595e-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615969636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969636, "uuid": "d133e16c-b65e-4856-a158-acff5c8b1124", "comment": "Malware payload (GuLoader)", "value": "7c0eadad1e8fb4759ff466cd54b90fb6", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969636, "uuid": "87d445f9-7d52-413b-a9b3-b28528a246be", "comment": "Malware payload (GuLoader)", "value": "88724f5f9b8b595662f0f3dbd9115eaef4cf1c64d16f54669e5241a0e0b7b6a0", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969636, "uuid": "782e1fc6-0b0e-4713-8183-2e24a81a992c", "comment": "Malware payload (GuLoader)", "value": "41f2c652a5acea98da8bbb1bc1636a1e106f89f1", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969636, "uuid": "477ed272-2883-4c9a-80ea-3d1d0be6268c", "comment": "Malware payload (GuLoader)", "value": "3423972aa3b904534a0389638d4e33f6fb8f848026135a04d854cceb449ae9b0a290e9996ca5be32cf26ebd5badab238", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969636, "uuid": "7fd2b5c5-91c5-413b-9bb0-3f42a60dd5f6", "value": "B9E2F1A5B257C19AC722A53EFB9DD713D980048073A53BB5EB80CD6778F0819E343A4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969636, "uuid": "c9c8e8a0-1259-4d8a-b546-79c2316e6e36", "value": "768:Quw2yl2d3DbCsAOVMAuaTz6JVSgid285sad/44yn2T:Qu39BbC3Ausz6XHO28sH2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969636, "uuid": "add96fee-b246-4259-80a8-5c1b0e8aa5f5", "value": 34031, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969636, "uuid": "0a2c2238-5e08-4843-b5ec-1aee5fc20efa", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969636, "uuid": "c0f7983b-30cb-4660-ab2c-225c4e9385d6", "value": "ph.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c230f76-876b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616018020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616018020, "uuid": "d92097fc-4c85-493d-96b0-d3c4145cd917", "comment": "Malware payload", "value": "3e5f60b817e4de237cd27d67b010d499", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616018020, "uuid": "478b86eb-5f00-4d4a-923e-9ddd558b9eb5", "comment": "Malware payload", "value": "88e26b3baa3256cf27cec12a2e3de3df4ab01bffedf5ddcc50c73632e7425491", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616018020, "uuid": "c572a8b6-80cc-473d-b4cc-7aa10b1fc549", "comment": "Malware payload", "value": "fa5dfb2a5b532cf0f2a168e33fc41e987209777d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616018020, "uuid": "ea749b05-4222-4ac7-bba5-439473db7271", "comment": "Malware payload", "value": "d4a1979e17e0d659fbde9a0b7f987b889ca45263121a64f76881e88677219ccf62ea08394b78bdc0aa9e0304051ca173", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616018020, "uuid": "742534f8-740a-41d9-a1d6-de3656bcdb34", "value": "5224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616018020, "uuid": "7a7c4909-347a-481e-8a93-72eb83073322", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616018020, "uuid": "118dda94-9c63-4633-ba56-282e4d526afd", "value": "3072:99Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:99Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616018020, "uuid": "27c4a521-ccf0-42ba-a1d4-5e847ec38a86", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616018020, "uuid": "f2360655-b04b-4f72-8912-7504a0091dd6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616018020, "uuid": "015a19ec-191f-459a-b069-9dc92c61c02a", "value": "88e26b3baa3256cf27cec12a2e3de3df4ab01bffedf5ddcc50c73632e7425491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad12676-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001697, "uuid": "4fba76a2-4aa5-4a32-99e4-c78cb3bb53d1", "comment": "Malware payload (Dridex)", "value": "9fa7a532eceb309765949ba476de803d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001697, "uuid": "915c151d-1363-4633-8109-a82aab428213", "comment": "Malware payload (Dridex)", "value": "88e5993fa71c0a5a8ae709a34b887180d85b98a55523bf5ef757f92da0172612", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001697, "uuid": "cf51335a-6413-4730-9c52-9b35c99fdecb", "comment": "Malware payload (Dridex)", "value": "95fd64ee29fe20f75a6c385ceba11737657a01c5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001697, "uuid": "0a1dd935-99b8-43e6-a979-727993f08b00", "comment": "Malware payload (Dridex)", "value": "3518dc7d539c2c523539a55b6149a9ed740c2a666ef68892d5cdf466345785580f617e624c3b35ccba8d1524b23af29f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001697, "uuid": "911c5da4-4f0d-4a72-94b4-4c26dd599ba5", "value": "8724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001697, "uuid": "1790c478-738a-4769-b1bc-286575a03c39", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001697, "uuid": "10522bc5-545b-4287-a122-d86c0c3317e9", "value": "3072:D9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:D9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001697, "uuid": "3b227b9c-0165-4fa5-ae0e-224532960c90", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001697, "uuid": "91e76270-d8fb-4bad-9e10-2ef52ee31c67", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001697, "uuid": "208a9c0c-be8b-4610-8c8f-6b4aecbfb0f6", "value": "88e5993fa71c0a5a8ae709a34b887180d85b98a55523bf5ef757f92da0172612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ae4045-8743-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1616001014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001014, "uuid": "d50ae7f1-c21e-438a-8bad-1ac04b6df55a", "comment": "Malware payload (IcedID)", "value": "5a4c98e12ca3da692f71b20643e71c18", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001014, "uuid": "d7e4cf94-e294-4704-9922-3952edb1dc52", "comment": "Malware payload (IcedID)", "value": "89252ad15ed6fccbb3988b41cc1a2ad7dc5a0baf5613e95ccfa38197fc681099", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001014, "uuid": "ac66f860-a6f8-4c1c-871c-657383ae4cac", "comment": "Malware payload (IcedID)", "value": "af94deb35af44e66b8649ee1f24a29e862a19769", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001014, "uuid": "b24508f8-bf13-47b9-a975-eb607aed9632", "comment": "Malware payload (IcedID)", "value": "42b7b4996d494b510d64b89949dfc32f1249c30b804ebb0eed4bf8ce7bfb87fab3cecbfe6a87d0b7f843bf33050c64bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001014, "uuid": "789a4aa2-06ba-48ec-9486-53d6b898d46f", "value": "78F39AE47A874B5EC6A3533E4E5F222C8B6B3FF478991667D449B4B2230C9C493E7109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001014, "uuid": "1a3104e3-395f-4186-98bd-ff1d31ec1420", "value": "cec9cd6065aa966074cb2cc2f20d8461", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001014, "uuid": "5430ab15-cd95-49d2-a31c-54374b5c1a23", "value": "1536:VGDeooC7AZPzQm2r2bTGFeTkeeyt9QjxXerQhwXP:IDeooC7AZPzQm2r2bTGFel9YXWXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001014, "uuid": "a524b20a-1214-44ea-a17f-dfea87b74ab3", "value": 163328, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001014, "uuid": "bbafb471-e616-42d5-9a10-8cbb71ea54a2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001014, "uuid": "d789dd2e-03f7-474b-b346-5dcdb3c820ab", "value": "5a4c98e12ca3da692f71b20643e71c18.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f16f217-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010321, "uuid": "2dbef26f-4185-47a1-a690-63e844f6b7b1", "comment": "Malware payload (Dridex)", "value": "46a00f98b8dd855615dff0f551d21aa8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010321, "uuid": "6bcb72ec-f4eb-4b97-a387-cdc2530294bf", "comment": "Malware payload (Dridex)", "value": "8927347c34f44be049b12b66a0edeeb1f1c520c1f32ad9dd2784132e12aaae9e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010321, "uuid": "7e2f617e-4682-4f7b-9a49-9dd390923197", "comment": "Malware payload (Dridex)", "value": "eaec41e90f57418a43943ffcdb18350273d80ded", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010321, "uuid": "b7592afc-4140-4683-b0d4-3f1064eaaa34", "comment": "Malware payload (Dridex)", "value": "285691588a7a940c34e4fac7b48f7b62b0e2cb402fed5b9892f37cef0b826f6b6e03e00e764e29ef8757dc135e9e04f3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010321, "uuid": "0411c026-b71c-42e0-87e0-542c4be0fd42", "value": "3A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010321, "uuid": "2d76c5d3-2ef8-45c0-b17f-cf64bd64c0ad", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010321, "uuid": "e4588fcd-ed54-439b-bbbc-7602a56ee721", "value": "3072:H9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:H9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010321, "uuid": "f29672e2-759f-4206-8216-a537803b783f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010321, "uuid": "c716f0f1-dc7a-4b50-b05e-2d8a99a7746b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010321, "uuid": "917a2493-a702-401b-874f-26d03819bc17", "value": "8927347c34f44be049b12b66a0edeeb1f1c520c1f32ad9dd2784132e12aaae9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98793c5d-875e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012591, "uuid": "e4eebe05-0f55-4239-a5ee-46707f33683a", "comment": "Malware payload (Dridex)", "value": "359e67049352390cd49a41fc1d75aba4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012591, "uuid": "8cc2f967-1a8d-4481-b1ad-befe0d77aefb", "comment": "Malware payload (Dridex)", "value": "897762a4b8dba4de3a58403c072081320996d4f912b2809fe5c8c44fabd80998", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012591, "uuid": "935bfe57-8bd2-4e66-82d0-b9e53b0b1940", "comment": "Malware payload (Dridex)", "value": "a26f0151bbf99fab247a79bf83b1db07e16988f2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012591, "uuid": "ad34825d-b499-439b-958d-70cecc24b8da", "comment": "Malware payload (Dridex)", "value": "ce228167a6ac284c6800c99a12ac979475d8d377bc58040ba4ebb844d682b88cc2bfbd51312aa8878b37c45afe6f0024", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012591, "uuid": "ae16e7e3-09e1-4ffb-a29f-f5f771c124f8", "value": "9B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012591, "uuid": "f05bfd9f-d9f8-4c64-8b9f-074f99bc273b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012591, "uuid": "10b03e6c-9681-4365-a9aa-d7c59a60e42e", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012591, "uuid": "5159cd18-653f-4581-89dd-2973c51525e6", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012591, "uuid": "027f0eed-2547-4fcf-a06c-c3d57dd1b7d0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012591, "uuid": "2e44c8b0-9b6d-4498-9604-b7b99d6aee4a", "value": "897762a4b8dba4de3a58403c072081320996d4f912b2809fe5c8c44fabd80998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93787032-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616013013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013013, "uuid": "7d95477f-d8ee-47c0-b1c1-4d1aeeaddcdd", "comment": "Malware payload", "value": "450c043ea2ad0f3cc3eeb2705680ce5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013013, "uuid": "ab5983e1-2f14-461d-b357-d1ccaffd1acc", "comment": "Malware payload", "value": "8a509324422601008a37d717428333d22f8135e9ff47f725724e93f0251374c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013013, "uuid": "99f1ff48-a79a-4422-9742-3edf9f690f00", "comment": "Malware payload", "value": "c68ce24f159e4d812228b7beb33d8f707cfe87ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013013, "uuid": "16d544ca-0622-4839-977e-c705217b0186", "comment": "Malware payload", "value": "fc782210fd4749bec3d7e199cde6fe8cd45117e82da8a9d34a34acb51d87ed18ac048d16d99ff4a547f6f6cd4408dce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013013, "uuid": "78b32325-deb5-4205-8d36-7e067369ee5d", "value": "1A05CF89B014C566CD2CB2B950B3D57A4AB27C67D574E29A2CCE3CEB36B76C12804DD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013013, "uuid": "0aea1c7c-fd4c-4d6b-a365-3e232a3f42f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013013, "uuid": "7e4e4fe7-0707-411f-b625-d025153884a8", "value": "24576:/XmiIo5zTedtxiXiP9yl3mCSzPJ2rRFa9mk:HI00xT9ySwFa9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013013, "uuid": "056b3059-95e9-4670-b01d-1160cb855736", "value": 804352, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013013, "uuid": "54664864-6ecb-4d3a-b4b5-f8eb7b5b589e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013013, "uuid": "ab58ca43-6f3b-4aea-82bc-21e1e5372980", "value": "Cotizaci\u00f3n de nuevo pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba3c3f0-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003953, "uuid": "0f250578-84bf-4145-990b-059a06f6e43b", "comment": "Malware payload (Dridex)", "value": "1127646e326c349f07bb68622e440ffa", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003953, "uuid": "aec300a2-080c-4deb-a944-6f1b1b3b996b", "comment": "Malware payload (Dridex)", "value": "8ac308e7876c3de4ce64a667c6043b3f41a9d36c933efee510d06dc23a0c11ec", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003953, "uuid": "4d85670f-e58a-44f4-ada7-41cb1c63af0a", "comment": "Malware payload (Dridex)", "value": "5b4d263f664961a3c0ecc46fe2e02ffd2b23a225", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003953, "uuid": "5f8eb4a2-a713-49a0-b938-2f7023474869", "comment": "Malware payload (Dridex)", "value": "b482117919b741039060f18ad6b7a54f3d1cd137d312748ef32bd6b4f396cbd1286ee9f81242832f3541ef6c745e4e27", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003953, "uuid": "3c313aa0-3db4-4788-9aea-a650141e2c94", "value": "3024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003953, "uuid": "455e2e2a-b672-4569-a84a-0301ae291303", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003953, "uuid": "a6b5e407-834a-4f73-9032-ed37f8b47e6d", "value": "3072:r9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:r9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003953, "uuid": "2113505b-a48a-4d81-bb48-8cd7b07576b9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003953, "uuid": "d675cca5-921c-4b1a-84ba-685c0e5aa81d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003953, "uuid": "f9824ffa-0c79-4a8d-ba06-8e3b593253bc", "value": "8ac308e7876c3de4ce64a667c6043b3f41a9d36c933efee510d06dc23a0c11ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1867f78c-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004216, "uuid": "5a09bb91-c127-4ee3-9049-3eba76b15033", "comment": "Malware payload (Dridex)", "value": "be33c82f2b595ab22eeb2092553ae7e6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004216, "uuid": "c1c3f820-0dcf-4298-92de-f013dd63c85f", "comment": "Malware payload (Dridex)", "value": "8b01d3e219bd704ee09e78f682c89f557ec330bed84907b068ccb4f77e13d64e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004216, "uuid": "1bee7369-b7ee-45ba-8559-6fffc7aae9ee", "comment": "Malware payload (Dridex)", "value": "9dfc4ff851e3a7e27f96d4bbff67727adde93330", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004216, "uuid": "637ccd67-df1d-4062-a6a8-a9a7c8091723", "comment": "Malware payload (Dridex)", "value": "d8377b73e8c6fef5f63a21205a8cae3a52b64d067d225553af84b9c00e286cbbc7a79a0f0cd9b8326b7cdfa6af247074", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004216, "uuid": "9e22d689-1995-4e76-8e1a-970d99e54fa1", "value": "E024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004216, "uuid": "5991eadc-e6f8-46de-a39b-862c391aa8fc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004216, "uuid": "d94c614d-1d45-4d8e-b5d2-ad52068972c6", "value": "3072:i9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:i9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004216, "uuid": "1bf46cdb-1228-40d0-881e-374b503c88e3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004216, "uuid": "28a6c44b-32f2-4174-9479-ffc53f0c6344", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004216, "uuid": "fea6f466-2be6-43f8-ac31-f2168ce7d0d5", "value": "8b01d3e219bd704ee09e78f682c89f557ec330bed84907b068ccb4f77e13d64e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7897dd7e-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003089, "uuid": "fd0aa487-2bdd-4abc-832b-22cd96701848", "comment": "Malware payload (Dridex)", "value": "c9ae1eff511ae85dd498fbcca69403d3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003089, "uuid": "9016f8e4-6cba-4dbc-af7f-3a7e0f90e5c5", "comment": "Malware payload (Dridex)", "value": "8b0551eed2a2d977f87005bdf8bb016903aadc51b20ae1aba6cb057a8cb65891", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003089, "uuid": "1ce5bc25-6041-402e-a1df-51b36dbb2a84", "comment": "Malware payload (Dridex)", "value": "76bfd4fd1b1343a7a406aa29a320fbea053b61db", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003089, "uuid": "a1eb3b3e-f108-461d-890e-b6ea423ca3c4", "comment": "Malware payload (Dridex)", "value": "0e00af146fe8b5549a24ac5aa8542e1d7a9c5d7d981851c56ca31bf3393c6942715844b9c9b776e3ed380e9919ee7ca1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003089, "uuid": "d975dec8-ca3e-4e42-8044-339293520d31", "value": "C324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003089, "uuid": "9d8d7c25-36ea-4df2-96e0-936ab01c841b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003089, "uuid": "8f344085-065e-4aab-b376-dbd4a9f95179", "value": "3072:69Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:69Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003089, "uuid": "e3b6083e-072f-4e82-a1c2-4182a0dc59fa", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003089, "uuid": "ec8fcf05-f010-44f2-8446-d224e26fe5e3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003089, "uuid": "3dea301e-93df-401f-a133-9b40af7d7a3f", "value": "8b0551eed2a2d977f87005bdf8bb016903aadc51b20ae1aba6cb057a8cb65891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26404a2-8759-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010568, "uuid": "c801efce-941c-49be-881c-8a68a2082d25", "comment": "Malware payload (Dridex)", "value": "8e8e570f2c7c8caf06d9ca0ad3e28453", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010568, "uuid": "a734e0fc-8be2-447f-b6c1-3ec98fb28dd5", "comment": "Malware payload (Dridex)", "value": "8b6238bfaadc053b0d141e4132ee4d6506a1f4a9b7c1559dbde616aeb13ad11f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010568, "uuid": "11d33a2b-41ab-40d5-a4b5-bba8d5636775", "comment": "Malware payload (Dridex)", "value": "f79a97d3ccab251b023b2d4cd3d666e0cfa24c75", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010568, "uuid": "71ffd956-9cca-4ced-9dd5-f124a8997e17", "comment": "Malware payload (Dridex)", "value": "ebedb689262faee068cdd823293d93119e25491ffd0995f38482acf469ed216c52a2f183da7bcc415ecc0a8f7a20f54f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010568, "uuid": "ef2945ac-39bc-4ef3-8c9b-ac55f351fcc2", "value": "4024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010568, "uuid": "deb33cae-81c4-4345-95dd-47af4001216c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010568, "uuid": "4b9b5fba-448d-4831-b059-bdb3a3123bba", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010568, "uuid": "8da44a18-ddc5-4034-b186-2978eb797f9b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010568, "uuid": "133834b5-c8ad-440a-98ae-572ac4605d30", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010568, "uuid": "b173a12b-1524-4719-ad4b-eadc70a8c492", "value": "8b6238bfaadc053b0d141e4132ee4d6506a1f4a9b7c1559dbde616aeb13ad11f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267de72d-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004240, "uuid": "d47bcc3a-cd59-4e50-96ec-320f290c2c7e", "comment": "Malware payload (Dridex)", "value": "b3c360294f8dd030ab59fa9f9cac49dd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004240, "uuid": "7d179fe8-c333-41e7-ae94-d66db14326e6", "comment": "Malware payload (Dridex)", "value": "8bcfb1d1a8681c58e32984a609794c0d970809ba7188c59c73f34664ef4daa81", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004240, "uuid": "e12d936e-e92e-4852-910d-d6a0bf2f4dd5", "comment": "Malware payload (Dridex)", "value": "64594ed0c72fe86adb9b618426da54d550faf67b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004240, "uuid": "7f890638-77c2-4627-93b9-86de1e3e7359", "comment": "Malware payload (Dridex)", "value": "87fb5d8dfa273c12c20aef809719945840f4524fde560393614c2503dd2c85c07b99f65007ded6d655545a9756983269", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004240, "uuid": "fd4714a4-48a3-44c6-99e5-5e3d547e3e9c", "value": "1324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004240, "uuid": "0bd34165-cfe3-40e0-bbde-78cd3fda89be", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004240, "uuid": "a8525574-9e75-4f65-bdf0-5043bbc0a4d0", "value": "3072:29Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:29Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004240, "uuid": "a33b767c-1dcc-4bc7-96b1-1bfd8423faef", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004240, "uuid": "52888dd3-db0b-42b2-97f0-5e48db6f557e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004240, "uuid": "ab2fc28d-7ab8-48ab-ab45-1e9d7271d9cd", "value": "8bcfb1d1a8681c58e32984a609794c0d970809ba7188c59c73f34664ef4daa81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dd48cf-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001682, "uuid": "ddca9eb1-9a88-4eee-8b5f-e349760d681c", "comment": "Malware payload (Dridex)", "value": "502522117a02725fd377215277b100f4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001682, "uuid": "89fc15d1-03d1-41dc-a94e-032f0c90e0a6", "comment": "Malware payload (Dridex)", "value": "8be857e6a00edfba6fe9123d0f5f4a02b0d7b42c5c2b2b61018b75fb585cc954", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001682, "uuid": "f9213bf7-d3a1-4158-876f-ff31a109a12c", "comment": "Malware payload (Dridex)", "value": "b84974af15b954aabafb80339a44012b4aa22c58", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001682, "uuid": "8bd5f36f-67d8-444c-abbc-93debd58fa2c", "comment": "Malware payload (Dridex)", "value": "2e7125216ed1be3a99df11bfcf0506ab80b0b15ad085491209178480d79120cb87d8cd96927e607e1729593bcb655a9f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001682, "uuid": "35b017a5-55a0-49a6-ba96-52cf979550fa", "value": "3F24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001682, "uuid": "af134db0-2c1f-446f-8af0-729766f67984", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001682, "uuid": "39b9ac2e-c8fc-4620-bf17-3d6695a52d87", "value": "3072:J9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:J9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001682, "uuid": "78a5511f-b16a-4a7f-a3bd-911848d06ec0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001682, "uuid": "293404a0-eef9-4b45-ab83-fcdfc554cf7c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001682, "uuid": "465ebf01-7c0a-4805-9c4f-a45915019062", "value": "8be857e6a00edfba6fe9123d0f5f4a02b0d7b42c5c2b2b61018b75fb585cc954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e597df8d-8758-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010144, "uuid": "40e1b10b-cfa2-4f11-80b3-040e45001842", "comment": "Malware payload (Dridex)", "value": "1fd2fd56d2a5bcd344d4da00124fe718", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010144, "uuid": "1d6b022c-626e-406d-b3e1-d591ca0e20f7", "comment": "Malware payload (Dridex)", "value": "8c0d660174c34c52283006a4f8f4c311fdd024d7eac55441c4d83e46e370bfba", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010144, "uuid": "d0e0fa2e-b1e7-400a-ab50-455cf28860ef", "comment": "Malware payload (Dridex)", "value": "b206fdb854662635e6f3a02eff130a05932f8034", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010144, "uuid": "3db16418-d94c-4b97-b55b-87c0da73ddf0", "comment": "Malware payload (Dridex)", "value": "6b02801b0fa91fa3b5b7fc9e15b63063b1ff57b9b8acb16024c7ad347e5dc33f865e6f6d988d346099657cd3a99540d0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010144, "uuid": "5bffe6a3-dcfd-4a97-87f8-b6766d70ab73", "value": "5B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010144, "uuid": "4903e3e1-046c-4fa4-b812-6d7ab51a0379", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010144, "uuid": "9c98eb8c-dd15-4420-a9f4-863bc5b0899c", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010144, "uuid": "ba944a42-d98a-4a5b-bd30-92b7e38949f9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010144, "uuid": "e3c5481d-1075-46e3-9e64-77f6e8aceec1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010144, "uuid": "a9cfe0cd-9583-46a0-804b-1429d6ae6f45", "value": "8c0d660174c34c52283006a4f8f4c311fdd024d7eac55441c4d83e46e370bfba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907be6b7-8767-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016444, "uuid": "7d559da0-dd2b-454b-a4d5-ceea229ea8e6", "comment": "Malware payload", "value": "a2f3a94675cc892c17ec2db2556ba14e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016444, "uuid": "74fd62ce-2d71-40bd-9bf9-cbda66db0bfa", "comment": "Malware payload", "value": "8ccad21ba8141bc341c1dac1cca5627c1678fc8b433bab01dfa1f9fd17608519", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016444, "uuid": "cff1219d-2472-4755-8f72-1b810e356d02", "comment": "Malware payload", "value": "2758d7fb2063556977bfa25ac3e7d8ed1958b13e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016444, "uuid": "584bc87c-1c8f-4d49-9790-3c405a9c6644", "comment": "Malware payload", "value": "c3986dc7aa6a0f009fed03f99c83c0d4dc86140ac8fcf3b556f22671be5bef1d85171fbf3156fefefd39f3eddccbb693", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016444, "uuid": "9d480677-3f72-4e71-8be3-e572dafe4ef8", "value": "BC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016444, "uuid": "d8167548-7d57-4168-a73b-13b157baee38", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016444, "uuid": "a2fa68ca-2c60-4e95-8abe-283bbdd3c303", "value": "3072:49Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:49Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016444, "uuid": "7d57f33b-7fd3-4950-91e2-5f322b71c8d8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016444, "uuid": "8cc97815-d8bc-4b09-bc23-1fb1e3edfabe", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016444, "uuid": "74cbc5b2-d6a2-4c53-ad4c-7cdd05826849", "value": "8ccad21ba8141bc341c1dac1cca5627c1678fc8b433bab01dfa1f9fd17608519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34395157-86ee-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615964320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964320, "uuid": "020a272b-3bcc-42d8-babc-142e7a32dd0c", "comment": "Malware payload (AgentTesla)", "value": "34c91402eabf97c190e5e318d5f114ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964320, "uuid": "e0bc66a1-586a-463f-b97b-4ff63e84bae2", "comment": "Malware payload (AgentTesla)", "value": "8cfc18637e87b114b65f90e633d4f6049f7d3366eefd776eec519fd93e5218bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964320, "uuid": "46a1f89a-bd63-4597-acc8-02ba649a61ac", "comment": "Malware payload (AgentTesla)", "value": "dd3a0ab7496c86c5dec4f15071f4fad36675bccc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964320, "uuid": "05c8c884-0dd6-4116-ae23-9796697ace85", "comment": "Malware payload (AgentTesla)", "value": "0b413f0b5b36395b8c0c9e6cfe4d8e190bda97c7739371adf2e795f1ce1c202bed6c6544afe65c859cb7b7005f56bcff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Garanti", "colour": "#D69945", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964320, "uuid": "bbd2e13d-1978-42c4-9b9c-cd361465e0f6", "value": "DCB423B52BCC56EA05519B14B0B972029EB19C327B94689C32A4DE06DAF1943CFCDDFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964320, "uuid": "c3c736a2-96ab-422c-b737-2f749cdca9a2", "value": "12288:vX35Xe+JW+ldgZ8FgY3JRYRfyUJu4ZvJb0B+LWw+Is32YC:vX35JYG34fHPb3Lwv32YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615964320, "uuid": "c9faddd4-6fe9-4e92-ae1c-57dc85654e32", "value": 528652, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615964320, "uuid": "478ebf94-a0b3-45e9-8d45-8ff84064172a", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964320, "uuid": "7e485458-876a-4881-8c1d-3bed2466e275", "value": "hesaphareketi-01.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a3e25e-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "4a2e2172-8da8-4c77-a8a1-91335e85c2bb", "comment": "Malware payload (Dridex)", "value": "c854cd8a61d1165aff22da428de81526", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "e2aa716f-5cd8-498c-aaed-a9d05ec0d0ff", "comment": "Malware payload (Dridex)", "value": "8d463875369de6d4750b386b02b83647e45ea5cccad33ebb25624440751b7db5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "13bad63e-9bf2-4985-bad3-a81948e07a05", "comment": "Malware payload (Dridex)", "value": "1889d60e6b714f3ff90a47815037c40b64430784", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003733, "uuid": "3fef25ce-0dbc-4cc4-bb4d-f8276fed5266", "comment": "Malware payload (Dridex)", "value": "f5bef01928ff9e4fbbbbcb0abf5b35855d1c98fb3b17f72a9802df07a6b60aecc7b1435bc5fd43fcab5f7248235aa29d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "4318e7d4-cc8e-4772-84f0-0bbfda34b9e1", "value": "4B24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "bc0c4f61-598b-4ee7-bb2c-32066f236ea2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "9d22bf8d-403b-48bd-9f02-9ccf5de1d55c", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003733, "uuid": "1aa6ae6f-525d-483c-a0ef-46b5d39e5c8e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003733, "uuid": "76894a68-ee82-4d8d-917c-d5d7b9128b15", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003733, "uuid": "1f11fe81-1f3a-4c73-8a73-9a5d1c79ee80", "value": "8d463875369de6d4750b386b02b83647e45ea5cccad33ebb25624440751b7db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917fffab-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615965765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965765, "uuid": "f25b9e0b-a8d9-4ba9-b62d-d7305744e248", "comment": "Malware payload (AgentTesla)", "value": "13c2dbeb0de3e8cf8f6d2f3e9d6be9d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965765, "uuid": "01541225-84c0-4cdb-b43a-95cd2d41bed8", "comment": "Malware payload (AgentTesla)", "value": "8e0a42940b1c3699bf4c04814773e6c9969b75225295560b4a112e210e63851a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965765, "uuid": "c52fab6b-f6dd-4e1a-80bb-ba630851fdb7", "comment": "Malware payload (AgentTesla)", "value": "61645fefa48d58db54c60fcd597fa7bf80566a0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965765, "uuid": "6c732587-4a58-4f7c-8561-a4bd1314c037", "comment": "Malware payload (AgentTesla)", "value": "c6301d78badbd8915e10bc2370e3b7e852d581789ab512819aec1b56c42fd4b03fb699e6a430d23abc7d5be6c940c685", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965765, "uuid": "f6e78cb2-303c-4ae2-b5cb-fde44878a995", "value": "F3F4F16037B95F0AE5F8BBF6016390482779BA3BE2A6D31C9CCA60DD1E31B518351B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965765, "uuid": "c7de42f0-961d-43e0-b926-c87cefdfcdfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965765, "uuid": "946676b1-4b65-4fc9-af23-d9d1e2caf116", "value": "12288:rN4r582r7V7O0Xblddz947HifQeU7gLUcS7DljYIZOQHAnBckBCQLBCpEUddddd:CV7xXN9DfwqIoQAOiCQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965765, "uuid": "56d3c0eb-cdd7-4bc5-a054-16e9a31ba80a", "value": 767488, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965765, "uuid": "377a56c0-e4a7-495d-8c14-3b72f59128c1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965765, "uuid": "d7c7d097-512e-45b2-9d9d-6241a46676c1", "value": "EbLq3CwxErh3RNR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa10606c-86ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1615964088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964088, "uuid": "693aa004-bbcf-4bb3-9632-680745e96ad7", "comment": "Malware payload (Mirai)", "value": "e2ea64535f6831537711192a154094f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964088, "uuid": "f20468a4-81be-4945-b87d-d4e41cbb8c40", "comment": "Malware payload (Mirai)", "value": "8e3fb9f382c1a3136da6e83361464e694d77502b483907eb3f9c55890372e66c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964088, "uuid": "d5c8b30e-e558-4437-bc0d-9ba956f57bd6", "comment": "Malware payload (Mirai)", "value": "b7414ab432895c2c946a2bdf6cad43da40349538", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615964088, "uuid": "2534458e-2cc5-4ccc-8594-8f7823e7ae1e", "comment": "Malware payload (Mirai)", "value": "10e54e055aae26e50e96f4aa828fd269774f7b7b49c3b14bd03ddb6a37ac86fb7495dd47024132eedf4c2220ea88c8f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964088, "uuid": "1a703945-b4b8-4331-a385-6a3fba9b7145", "value": "11230785BD81DA12CAD45377F90E42CD372A7399E1EE33039E16AF517BC782B0E2A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964088, "uuid": "772a40bb-fd2a-4141-ba73-c1ec427b15f8", "value": "768:bdFuYAlN5Se6Q6nLsDcwROJ/ewHQPQfA22TaKrYI1WYpE:dAlN5Se6Q6nLsDpRGwO0KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615964088, "uuid": "7dcc89d7-fb2b-4507-8868-967e835bfcf5", "value": 46252, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615964088, "uuid": "6410f99a-c34c-42f6-8b6e-98abd9c99586", "value": "application/x-executable", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615964088, "uuid": "55514c84-3167-41e5-9070-8ec7facdf5d5", "value": "SecuriteInfo.com.Linux.Mirai.5565.17250.31195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2942a878-8737-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615995655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615995655, "uuid": "1cd0b15c-39a8-4fbc-8743-17920834ab06", "comment": "Malware payload (Dridex)", "value": "9a617a20231e5ee293c77a9e4d3b4972", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615995655, "uuid": "43fbfb4c-e896-44b7-be95-5d2371602ffd", "comment": "Malware payload (Dridex)", "value": "8ea4aa33e4c6fa5c8afe66f2be4144c672be05e6742f02ecd94d328a5765d7e0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615995655, "uuid": "31c49868-5db5-4c3a-9a3b-41a5c7e9d696", "comment": "Malware payload (Dridex)", "value": "e833305fa14a24deb423c48dda19d7e7b4f0af28", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615995655, "uuid": "0d1f679b-1472-40a2-8e51-8a0f49352894", "comment": "Malware payload (Dridex)", "value": "ec10b526767159d50cc4e42fa08887cdacccc2d0341af8368f13f4176a55bcdcb6c8dc1cc6a6f7bcc872b803b31503db", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615995655, "uuid": "97de3ed1-6496-4ced-be85-4e3dbcc410e4", "value": "5814AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615995655, "uuid": "6f68f6e2-53c3-46d2-9d9e-c70975538da7", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615995655, "uuid": "98346671-f5d6-46dc-9acd-220d719cf363", "value": "3072:j1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ri78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615995655, "uuid": "ae349a74-c63f-4801-bf4c-8762cb43197f", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615995655, "uuid": "06b38bb9-1e77-4aea-90b1-9dc1468c9fab", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615995655, "uuid": "3cf7e262-7577-4f89-b6fc-dd3258205480", "value": "8ea4aa33e4c6fa5c8afe66f2be4144c672be05e6742f02ecd94d328a5765d7e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2345ef39-8751-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616006811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006811, "uuid": "33f27a4d-103d-47b2-8941-fab6ae81310f", "comment": "Malware payload (Loki)", "value": "2ca2406431fbaf5befbf0de21509debe", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006811, "uuid": "5152f813-212d-4143-9bdb-8acda191878f", "comment": "Malware payload (Loki)", "value": "8f03c9649059b067e687c1e3eff7915ecbf06ac99ac8b319e09a50d0c1a3df30", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006811, "uuid": "d8c5144b-93c5-4065-9f91-47d2b4d0b40a", "comment": "Malware payload (Loki)", "value": "b085dc9b7c1d385b82e267d9fb492bb5f985a678", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006811, "uuid": "10baca78-4d48-4d3b-b73c-215ec6c1f111", "comment": "Malware payload (Loki)", "value": "06e94f431f519976aa4a822711e7cf60889ba5bb146d9ddec3e91d2a29ae745e588568868291273430af063d8c86ee1a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006811, "uuid": "08c6189a-41eb-485c-9dcf-08c91428ed3e", "value": "6505012E03786B06D22D2B345CA1663507F4994532A2E7F5AEC1ACCD3C5EB84D6F11FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006811, "uuid": "3c1abc13-5cbf-4865-bae7-244a44224dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006811, "uuid": "8d513dbe-6ec0-4d58-adcb-0cfae0e931bc", "value": "24576:gT4wR3OdMwDk4BROauYp3sjaKghg4U2Uo:COdbDk4huw8vkU2Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006811, "uuid": "ddc8c042-d209-4deb-98e6-93763d125d1d", "value": 856576, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006811, "uuid": "fb000d51-650d-4a69-989a-e4caa298efab", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006811, "uuid": "fb00b610-ffc7-43d6-94f0-756581861b4d", "value": "SecuriteInfo.com.Trojan.PackedNET.586.2979.1073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d50b62-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004341, "uuid": "9feab15b-d79d-48ee-99b3-c5599f725978", "comment": "Malware payload (Dridex)", "value": "7d8fa65294b9fa3fba2e6ab91d75def6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004341, "uuid": "46c235c9-f4ed-4fd6-9487-66779d79793d", "comment": "Malware payload (Dridex)", "value": "8f9f0f9482cb80098c478712dda3de503cb09ab5b933138415433c683356a2e6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004341, "uuid": "cb058c62-fc29-4820-b03f-ec0436eea292", "comment": "Malware payload (Dridex)", "value": "cca0a21d37d3f498f00c1df067c98bf45956f959", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004341, "uuid": "8d4ab157-3a60-4b03-b1bd-394e882f027b", "comment": "Malware payload (Dridex)", "value": "6c7420db0e2a70e338dea0f3e29d248bef764fd9028f17b7d1bcf0e6ad20b6e452411ee7c3aff8a924ac4c72fa4ed5e2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004341, "uuid": "0db82d59-89f1-438d-a0e6-a4a24ebb8fed", "value": "6024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004341, "uuid": "fec48d1c-8e20-404e-96c6-f99b2fb833b5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004341, "uuid": "9b07a7e6-7c8c-4605-9193-743661fcf800", "value": "3072:y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004341, "uuid": "e2017364-b485-4322-a773-1e26f8cf13f9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004341, "uuid": "23edaf8a-dd9e-4fc0-917c-bc8d57897188", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004341, "uuid": "bdb63ee7-0082-4fdc-8651-9e5485de554d", "value": "8f9f0f9482cb80098c478712dda3de503cb09ab5b933138415433c683356a2e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ab4b5e-86f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615968020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968020, "uuid": "be9cdde8-32f4-499e-9504-77730fdd2938", "comment": "Malware payload (Gozi)", "value": "e14a213906d514a8603341cc4434fae7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968020, "uuid": "3052a075-ccea-4030-87cd-d4ca6f099bd8", "comment": "Malware payload (Gozi)", "value": "8fdd53a4c037944cb7135a92c7ca889b1845bcc599d1956d5dd3a444f4b0a51a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968020, "uuid": "7e8222f5-aad2-4248-be89-b6fac6ac195a", "comment": "Malware payload (Gozi)", "value": "ed1e7b9e3dbc336a40349697dbe68f7d6d841ed2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968020, "uuid": "9db1b322-6542-4e35-8f82-bf729bb55d6b", "comment": "Malware payload (Gozi)", "value": "3c97f488c206f36b97713f8a2d92ae5fdd77e08569eeb932506194bacd491188ba86540ac827e932621e125d590d686d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968020, "uuid": "8421ee04-7501-445c-8752-4212952ecf98", "value": "F0A4D021B5C282B2C133823A4878EA65DF78BC710B3858CB379D12774F796D1563BE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968020, "uuid": "058da754-2004-4ef8-9cf4-56ea342ea422", "value": "25f2108c27a9983e93c5c39e2411e7ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968020, "uuid": "a04d3d96-870d-49cf-8969-9f6e6623313e", "value": "6144:qvBZP3Kj73uoS2azm/TE35zCOcNKnu6Caa9aZS0Ndasyv4KgvRw/vP983wiYA:qD3ArBKuM1CRuEvcNdbyv4u/X9awih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968020, "uuid": "a03e0828-6ca4-4d08-b343-1bba457a5458", "value": 466432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968020, "uuid": "989b5c89-43ed-4f5c-8409-3c34bf1816f9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968020, "uuid": "117d41f2-1c5f-491a-ad33-7d5082879f94", "value": "e14a213906d514a8603341cc4434fae7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1881340-8766-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616016177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016177, "uuid": "f40ae97c-2363-40ed-900c-792944e1742a", "comment": "Malware payload", "value": "8f8ba1baa62537facb706ec574d81eee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016177, "uuid": "e1ab05c8-f46b-4a5d-a809-38143c414c8f", "comment": "Malware payload", "value": "903fb3e23bba7aa3d87c890f3679b6c9c7dc1951d409d70a350808b9858f1dc8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016177, "uuid": "1e294b93-076f-43ff-adad-317888266731", "comment": "Malware payload", "value": "67d8147bfb4429ae664fe5d06e4440ba9636ec5c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016177, "uuid": "7433b2bb-2015-4b51-86de-4e51c24fe5cc", "comment": "Malware payload", "value": "4bf2727e8f75cfc56795a7151b8694d19bb95f4d93543d1f45c9be8c27d3302bcfc26d14aa91854bcf022c5857059acb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016177, "uuid": "85a7b311-52b4-4ba3-9eaa-af620395f999", "value": "0724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016177, "uuid": "8be5bb41-d1b0-4402-becb-02cb1d030768", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016177, "uuid": "202ad71d-17e3-4038-bbcc-adca3eef550b", "value": "3072:J9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:J9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016177, "uuid": "ec605aa1-24c5-4dda-a11b-45f13f5d675e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016177, "uuid": "aa01f11b-7cc9-4d32-97ab-70173b32175b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016177, "uuid": "9776d207-b06e-4cc6-8e30-c694ff3407f7", "value": "903fb3e23bba7aa3d87c890f3679b6c9c7dc1951d409d70a350808b9858f1dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438fe18a-8764-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616015026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015026, "uuid": "b500ffa7-4f17-4d5e-970b-ed30f360ffa4", "comment": "Malware payload", "value": "2e8868b8ae78494f96c27c0219cb3e16", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015026, "uuid": "88885513-01b1-44f4-8f78-c195093d8507", "comment": "Malware payload", "value": "90520e265903b55f08c63b12bd1739cb4aa16660af93870f5870741d64fae8d4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015026, "uuid": "059b1f91-6c04-4c1d-90ab-8c13599e4535", "comment": "Malware payload", "value": "63af4bf4c767c45f46f247277acdaf9ce05cd4cc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015026, "uuid": "77ba5445-8b55-4cc4-b257-d20a304dd968", "comment": "Malware payload", "value": "34e1e76272ac0506b7a1fb2d248bca3f394cd1b6dc440f6c3f66d38fbe3430379a0ef85b96c19dc85c9575db7f16a9cb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015026, "uuid": "e95155cf-0f33-4f8e-9883-13972acb1770", "value": "4624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015026, "uuid": "28efd714-6691-4e2d-a0e1-7c742a74f019", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015026, "uuid": "58602cdf-4d02-4389-9a27-46d87850ab3b", "value": "3072:z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015026, "uuid": "7fb4107f-617c-4855-b517-f49cad1fa7e0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015026, "uuid": "636a1c23-e8fc-47a5-9eb4-78753ea5cf27", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015026, "uuid": "ae9e5348-621b-443b-adaa-66c5c9e8d196", "value": "90520e265903b55f08c63b12bd1739cb4aa16660af93870f5870741d64fae8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf78282-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003955, "uuid": "0dc9df8a-565a-4b7f-b266-970298b033f5", "comment": "Malware payload (Dridex)", "value": "3e813dec1971bcb62e0eba76e79609fb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003955, "uuid": "4abb78c3-94c8-4cfa-9461-ee2763d5956a", "comment": "Malware payload (Dridex)", "value": "90b21a65fa42c3e7bdea6efd2edbe40e5a0541492b4d7dfe2efc03d78bbe2800", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003955, "uuid": "e0e14542-d46e-48e5-9e45-7517ff0bc13f", "comment": "Malware payload (Dridex)", "value": "1d47e5022f26804a5fde6f2f17321a3836f6dc7a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003955, "uuid": "e4c4cb83-f603-4671-aaed-7cf63ae70eeb", "comment": "Malware payload (Dridex)", "value": "c9138c14e704c2feddec08ab3526d05b78cc45ade288cc8a613dc076c5dd64e207457d27b485d0672959f6a78075ea12", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003955, "uuid": "d761d3d9-3412-4c20-a1db-7fa628b6687a", "value": "0024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003955, "uuid": "b1cc48d8-16f0-4162-8cd4-d87834abacf2", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003955, "uuid": "97d7040e-3bfb-4b2a-b917-b9fbcd7bf3fa", "value": "3072:w9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:w9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003955, "uuid": "597caeca-b934-4572-a7aa-06bfa542a085", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003955, "uuid": "bcdecc9a-997d-412c-b102-2341d9387e96", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003955, "uuid": "aa7e308d-7216-4e6b-86a0-a730fb814f7e", "value": "90b21a65fa42c3e7bdea6efd2edbe40e5a0541492b4d7dfe2efc03d78bbe2800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4050d7aa-875e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616012444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012444, "uuid": "91cb35c9-ccb2-4c3a-85fb-a71dc3eadc70", "comment": "Malware payload", "value": "6f4e41a51cf853f04533b2b6dd3b7e88", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012444, "uuid": "a176280a-1cf0-4bd6-8be5-1fb107ecb9ac", "comment": "Malware payload", "value": "9116808400210d0909fae1b9575d5e330464d7396322cd3c792db8b2498a7ef3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012444, "uuid": "f0be3a53-c562-41ec-be4f-55e63585249d", "comment": "Malware payload", "value": "348f76e20d2bd59355b2d0f67b4cecefdd042045", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012444, "uuid": "a1f0da24-e834-4fbd-85f1-61d08c570d4f", "comment": "Malware payload", "value": "b60b9e0d044d5e670e6a568145a2617e41e97472033deca3eb7a6d114b90c547aad14fd1608ffe2b79d91e4eb346e656", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012444, "uuid": "11b3915f-891e-442e-bcd0-d355dd168474", "value": "8D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012444, "uuid": "f8e7bde7-c458-4412-9dbd-7223a88400b5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012444, "uuid": "583c1d0e-2aa6-4169-85dc-6d4642d7e02c", "value": "3072:r9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:r9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012444, "uuid": "af975e89-19cb-4e7c-a4c8-2df4729ac260", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012444, "uuid": "c6514348-511f-4562-882b-9c49b0217655", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012444, "uuid": "25d84bf7-27e0-40fb-b8ed-e41f39359cda", "value": "9116808400210d0909fae1b9575d5e330464d7396322cd3c792db8b2498a7ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc24350-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004094, "uuid": "61f864a3-f9d6-4be2-81c2-a1f1ae33deb3", "comment": "Malware payload (Dridex)", "value": "6247466e380a3a120cc77862d0031193", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004094, "uuid": "5575abc5-d0df-4d8a-9380-b7b85f34172e", "comment": "Malware payload (Dridex)", "value": "91644fc66e8afa0acbcc93164f4a3f26136b488211e268fad87b784e8d463cb1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004094, "uuid": "5051f373-c99c-485b-91d4-e2cd801145f3", "comment": "Malware payload (Dridex)", "value": "ec3aead379802c0de50f23234ad6c399cde8dd24", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004094, "uuid": "872dc745-7a14-40a4-af4a-85ff65d3f498", "comment": "Malware payload (Dridex)", "value": "014452cc70b9ba35fe8f36ab245077189a20f3431139fdb24d9711b6db37fcccbe325c487920dad884843d629b7f8433", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004094, "uuid": "1da0e853-3bf6-4393-afcf-92d56438a21b", "value": "D824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004094, "uuid": "5cedc524-154f-497e-807c-e69562597a06", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004094, "uuid": "42495fc9-2639-45c6-8bbd-fe2cb435d512", "value": "3072:b9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:b9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004094, "uuid": "f7ba4d50-5643-4997-941b-0f79f698f76e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004094, "uuid": "a5af778d-c8c5-4cdf-a4d6-22cc789ea93c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004094, "uuid": "a7f42f06-724d-4b15-ab80-be0e9003b47f", "value": "91644fc66e8afa0acbcc93164f4a3f26136b488211e268fad87b784e8d463cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d1a7f3-8757-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009331, "uuid": "d08f75f6-74cd-41a7-85b4-391d331044af", "comment": "Malware payload (Dridex)", "value": "2e87aa4debbc670051a7b5cf3297437b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009331, "uuid": "e7db5fd3-834f-4ee1-bd97-1e57569b94e5", "comment": "Malware payload (Dridex)", "value": "91645d63f105a954b173fd464f8e9e4a55553003f60f269f5b429af95b85be3f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009331, "uuid": "aa64b1d2-b409-4530-b5ca-ab58deb86937", "comment": "Malware payload (Dridex)", "value": "228e7728b56bed1c0d3962461281295690dfda77", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009331, "uuid": "cfd8bc7a-9cab-44c3-aa90-f9959c093cd6", "comment": "Malware payload (Dridex)", "value": "3315c6c2bd675db1b9ca2c223f9b996cc7ec3779104bf4102a6c04257e416b302de0cbb0e210ecd0f9f06f22f6ce8392", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009331, "uuid": "1743c200-6349-4ca6-bae9-06fb900241cb", "value": "1D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009331, "uuid": "9a664d16-a60c-49ca-a29d-322dc49e3cfe", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009331, "uuid": "46e42686-a33a-4a02-b360-2b2770f4038d", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009331, "uuid": "00acc306-22f5-410d-b5c2-ddec3e2f4ba5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009331, "uuid": "9095bad8-38c5-4ca7-b370-98cb9cf75f04", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009331, "uuid": "5fcff7f1-baff-4d9d-a4aa-05f0f12ea965", "value": "91645d63f105a954b173fd464f8e9e4a55553003f60f269f5b429af95b85be3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aeb1715-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1615969190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969190, "uuid": "11de9ad2-babd-478d-8dce-4e6025fa392c", "comment": "Malware payload (DanaBot)", "value": "aea6c372a52801b26e99bfc43087b4a6", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969190, "uuid": "07c15987-e193-4512-afac-a747b8904ed2", "comment": "Malware payload (DanaBot)", "value": "91aba74042505ab4b44295a886987e140510d6d9a38212e36e40f2433d64afcd", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969190, "uuid": "b6ed56e8-293d-4ce6-9473-ae6d1c8cdbb5", "comment": "Malware payload (DanaBot)", "value": "420099599458e4e4ab9ce9b09bb70beeaced0d3f", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969190, "uuid": "d5af6095-b1a3-4c84-829b-1c105b3a284a", "comment": "Malware payload (DanaBot)", "value": "2ed923fa9e6d503a9f522cc609689c0081f0469b245f90e8a81d674ec930534529f2beab84f18c5f1ad788e1f5791462", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969190, "uuid": "c9500e91-38ee-4b08-8104-1fa8d5b57247", "value": "73563300E765C079E8B279F986E9827C792979A15F3190CF12C29BFD5E69AF08D30713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969190, "uuid": "11708203-ccbc-4d47-9558-d3ca4cfb6c8d", "value": "83ff340a453ef764a77566842c792976", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969190, "uuid": "3cf0e108-0e36-43e7-b86a-c678bb19e575", "value": "98304:qyEBeIpuYZUiu6C9FDrU/RKKhuny4maK10la4xYN0FGtRzrx8uZNdbFP+xdkjTIX:q9e1YZUt6C9FfDKOy4uxW61PrxNdpGco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969190, "uuid": "2c6879b3-c852-4b35-9aad-2f341afed16e", "value": 6239232, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969190, "uuid": "a893017b-2965-4289-b4df-69118eb73986", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969190, "uuid": "d87c1a59-d3d7-4b45-9083-1fbd1a4bba58", "value": "aea6c372a52801b26e99bfc43087b4a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704ef907-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969574, "uuid": "a54dc93c-edab-4fa8-8b85-213e1088746b", "comment": "Malware payload", "value": "d2054b1b66e0d190be9eb250fada79fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969574, "uuid": "92b59143-6f07-4176-a0de-36dfc8a06f4b", "comment": "Malware payload", "value": "91b886840c7f674d17b48e5d2264228a55fe0f28e32e102c84dad5cca49ed807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969574, "uuid": "010fe61a-00db-49cd-ba56-4cf854807e64", "comment": "Malware payload", "value": "4828278c03885c1de97d601ddd2ee5a6267e73e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969574, "uuid": "e61b7595-458f-4120-a039-0d71661304b7", "comment": "Malware payload", "value": "2fa2829a46aaec8af68fa902b8c8fdb4aa4d94f4fe9b73b58b087eb73553a75127915bbc590e1e38f7d22b304e1fc3d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969574, "uuid": "68c12c75-8e48-4079-89e2-5046731f322e", "value": "8CD4F101BAC055B2C6721D315A78AB21253DBD201F24CFEFA3E46A5DDA301D1EB35BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969574, "uuid": "d30b6ea6-386f-43fd-bd3d-12f676189b06", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969574, "uuid": "bb6215e2-251a-46e2-aa4a-d10fb2a854a2", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbJchE4GyRgh3uxBBtIanFi4DqC:U2G/nvxW3Ww0tJapnTBtIaFSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969574, "uuid": "80c77623-57ac-4536-8b86-3ed89e68f286", "value": 618440, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969574, "uuid": "34f07619-83ce-4930-a2b9-6c3c94215658", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969574, "uuid": "5d0ca424-cf88-431f-b13e-10dee5006505", "value": "d2054b1b66e0d190be9eb250fada79fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5fdb80-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004516, "uuid": "0a5b0100-450a-4e0d-8134-c825ee86d95f", "comment": "Malware payload (Dridex)", "value": "c3e2921136a2b73a7f73e888ee337fbc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004516, "uuid": "8f1ef814-aa03-4778-bde0-3ca9f4dde294", "comment": "Malware payload (Dridex)", "value": "91dc82a15073418ef0c0e9241083d17d8f7b8f42668579ef398419088f0e419a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004516, "uuid": "c6841a58-accc-4e8e-881e-690e39cf5ecc", "comment": "Malware payload (Dridex)", "value": "181c007882ddc139eaec293cfabcd96557b8b220", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004516, "uuid": "15152817-6e8f-4598-bcb6-2849a4697c26", "comment": "Malware payload (Dridex)", "value": "7fa6e70173860d77087ba5ae26b99f298d2f3c0b6b1a2a7923db3693fdbf05789e1c1db1931256f2d3102bf87cc343b1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004516, "uuid": "51a54451-682a-44e6-8190-ced46ed6d328", "value": "B024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004516, "uuid": "3591365c-7c39-48d7-bb1b-4c79f8ac4c33", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004516, "uuid": "3095c09a-aa4e-4db1-ab12-fa40d58853a6", "value": "3072:s9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:s9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004516, "uuid": "ff94fe20-18af-4ed0-b713-7343be0ca2aa", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004516, "uuid": "3acec803-7aec-4c77-b5bd-6ede81fab284", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004516, "uuid": "a9bb06fb-427e-4dd3-b66e-b71637ae8925", "value": "91dc82a15073418ef0c0e9241083d17d8f7b8f42668579ef398419088f0e419a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d6b1fd-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "0163841b-32e3-4965-b34e-7e86ccf9d5d8", "comment": "Malware payload (Dridex)", "value": "84f5aa4fceacb766a317675b1321839e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "10b2de62-50bb-4c12-9aa4-263c9716684d", "comment": "Malware payload (Dridex)", "value": "9201cb9761fe6c37805aff0e9dcdca6b604bf020c2b244956f11da225f5ed9ee", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "2a46f864-008e-48fb-9d38-56f0c9f8aa2b", "comment": "Malware payload (Dridex)", "value": "7a76acb272e620ed1aed41141a79b40e737c47da", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003729, "uuid": "767ab5a3-899d-4fff-b034-a3433989be7f", "comment": "Malware payload (Dridex)", "value": "1dcaab03b1ebd1decbd25c558a36399990df8cb767999d670f560b64ed3c015ce0c3c6ac587769d86e2c1cf7dc7c9984", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "e89ffe12-899f-4302-b925-22885a42cf5f", "value": "2224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "f40cd0a2-6c77-4b96-b83e-ecf1a6f99dec", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "7277f48c-c732-4d31-a5f8-64ee07b18853", "value": "3072:L9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:L9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003729, "uuid": "fc4c865a-3c80-4553-b5b1-c9332294e223", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003729, "uuid": "c523d8e8-ea88-45c9-a3a3-18fd5e981be9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003729, "uuid": "6a472e34-f4be-40a3-a81c-f81cee955fa2", "value": "9201cb9761fe6c37805aff0e9dcdca6b604bf020c2b244956f11da225f5ed9ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063272ee-8771-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616020506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616020506, "uuid": "b506b3fa-0502-44d4-8008-67dfaf0b8d75", "comment": "Malware payload", "value": "4adcf9bc84cda8c5dc9c64a7b2b6746f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616020506, "uuid": "1ea4a729-484b-40a2-b8b9-97f5faec9f0e", "comment": "Malware payload", "value": "92186073f281f8a8c452f8f11c40b3313692ecce72349997c67d72f1278ad14d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616020506, "uuid": "cde1e748-5bd3-4455-90c1-9d881d616740", "comment": "Malware payload", "value": "d3c03011664c574478f2ce2fdc84a781b8ace853", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616020506, "uuid": "8ce930f3-2509-4a70-a32c-a2f90eb6bc69", "comment": "Malware payload", "value": "9d332dc4c28252a5d94a7f354c76eb1ae5133c0940c3d98cbfae5557caa1b696ddb7af4fee61c6aeee191ca02a15b23a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616020506, "uuid": "f1f02469-e5e5-4352-a4c9-09ddc4a17b49", "value": "ED24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616020506, "uuid": "1b1f147b-d3bb-420d-8885-26d2bf3edde0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616020506, "uuid": "d0223564-4d55-42c7-a67b-a9f7b5fc1bfa", "value": "3072:N9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:N9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616020506, "uuid": "0c383668-aeb6-47c1-abf9-4a7b06649022", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616020506, "uuid": "441dc168-d165-4d45-9b65-30138a2d8cb7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616020506, "uuid": "82039df7-7d45-4c7a-bfbc-5d8410b6d26a", "value": "92186073f281f8a8c452f8f11c40b3313692ecce72349997c67d72f1278ad14d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990ff8be-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013022, "uuid": "1cf6fe1a-0f40-476e-b823-4548427a8640", "comment": "Malware payload (Dridex)", "value": "b93342dad15a5e8d19c1682f5c97a396", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013022, "uuid": "16e1bd0a-bf3b-4a79-97c7-d7cda0c90105", "comment": "Malware payload (Dridex)", "value": "9258cb23ee48bd7e4b24b9db43d68c62c35f987f54c68c7a9c2aeea03f8326c0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013022, "uuid": "6d7b0094-66f1-4bc7-a404-5190124666d2", "comment": "Malware payload (Dridex)", "value": "2c2fb352beb17fddcc30988bdd7013c5aa287a57", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013022, "uuid": "7425295e-47bc-40d7-8ae0-117d4f87deaf", "comment": "Malware payload (Dridex)", "value": "9725926c703ac2d609056d6e61d701eda4beca06be805cc3d701dd7971004db80b3b9ef23ad7602d88f32ae9a0366280", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013022, "uuid": "a7520a7d-01eb-4634-b414-95a6469a9ae5", "value": "D824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013022, "uuid": "19063f7d-5535-41dd-9f25-4f47f4aa0627", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013022, "uuid": "2bc93563-91ac-4568-9010-9bce30c8f68d", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013022, "uuid": "3b4186c5-ab69-416e-b69a-f815c200a816", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013022, "uuid": "30530ba3-9bc1-4ccd-bcdd-ec31de480079", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013022, "uuid": "7335295c-e234-4ff2-8263-cf275aaeeb36", "value": "9258cb23ee48bd7e4b24b9db43d68c62c35f987f54c68c7a9c2aeea03f8326c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ce2686-8726-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615988423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615988423, "uuid": "7241df0e-3444-4029-b774-e138b8c093dd", "comment": "Malware payload", "value": "ef6ffe7dcf8b03bc45f0c5db2e8b5efd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615988423, "uuid": "83737aa5-685a-48d1-bfc5-d48aede2ef73", "comment": "Malware payload", "value": "935faf22f44af34fc970f49b16d29cb336918c121c3ca2c7bd3a1cf89dc642d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615988423, "uuid": "7b08a58d-24e4-4ff0-a587-282fa09284ac", "comment": "Malware payload", "value": "d6256c0adba4c2afae4ddf42b6a05942e483589c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615988423, "uuid": "52cb8cc3-0b78-4821-a372-be8bdbf0464c", "comment": "Malware payload", "value": "7477c2b9808675f96334f395e0757fedf47e32dd926501b1f835f8c11ac1416ad13ba913250f8fc004fa5c41b567e7ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615988423, "uuid": "ba2355c5-c14f-40c1-bea6-eca3a2f18e3b", "value": "E58523632DC153B0E27B82B4EC1392B4D3E6229854F5FFAE6CC498BC509215BCA56FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615988423, "uuid": "da0954c7-e0d2-477b-901d-3f3cc0c6e6f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615988423, "uuid": "1a2f5eb5-b0be-4cbc-9daf-34155a7f7fdb", "value": "49152:dwBA9vgGXN8X/aZ0hZm1pDycxh0oSkDbZm1HtZSAtE:dOogG+rZmbDyyjDbZmgAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615988423, "uuid": "ab04cf74-ae2c-4fd3-9473-e1d31109a004", "value": 1859584, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615988423, "uuid": "9a0cfc94-c320-4ed1-829c-ed060abc330d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615988423, "uuid": "d6b9dedb-8d2f-465e-b3a9-c454be013e17", "value": "935faf22f44af34fc970f49b16d29cb336918c121c3ca2c7bd3a1cf89dc642d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323af681-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969470, "uuid": "94f880bf-0847-4972-ae60-2943405ad168", "comment": "Malware payload", "value": "3b464a4879a13344f2683df235063506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969470, "uuid": "013c2389-50b1-44ce-a6ff-9015b52206af", "comment": "Malware payload", "value": "937a2660e7aae9eb4f2349ca7ab8381fbfbdf65290f8bdbfa18f86c4e0c53fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969470, "uuid": "21987f04-09ac-458e-afa2-bb81081b6257", "comment": "Malware payload", "value": "7c980ff7b17639cdcce2f030bdc2f72f336ad7c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969470, "uuid": "91850fce-27e7-4580-90df-baeefbda8481", "comment": "Malware payload", "value": "4a660bf4cac0f32291073a11b9068757b809b911c29ff1b079556494c9a7dd7216a0f3fc5f9f55d194dd613faea662f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969470, "uuid": "84803906-3b25-4004-b172-d231559d25aa", "value": "97C2F85A15A0B824F5EB4B3028D5ED793B3CA7758850D14BA019A90CCF82BB674DCEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969470, "uuid": "70ad63bb-e2af-4166-9c9e-c5ea158d6ff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969470, "uuid": "897467b1-63f4-4aa0-95ae-9ba3494d96d3", "value": "384:V+xjgFu0oqt1iC5BBvK/86IEvNULbT1vWu4KIWJclw2c39OJ/hU:UxU7n1d5bC/FIaYT1v4K+wJcFhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969470, "uuid": "45788da3-5e46-43e3-877f-4254638cd48c", "value": 25760, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969470, "uuid": "dc0cb80f-1f18-46e4-b3d7-971eb7af50b0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969470, "uuid": "e44f78c2-e522-49cb-bbe1-011ccc20dc50", "value": "3b464a4879a13344f2683df235063506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9ec540-86b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1615939212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939212, "uuid": "eeca45f7-c39e-4473-a447-40cc1c5f3e8c", "comment": "Malware payload (AveMariaRAT)", "value": "d2d9b57f189707e71a97921be9047a08", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939212, "uuid": "8a9fa598-5fff-41c8-a04e-cfd23618a886", "comment": "Malware payload (AveMariaRAT)", "value": "93805cfa4d0834d16582fbd07fc9a3d9976db3d83d0c67d80731627c2739d5b3", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939212, "uuid": "a84f0d6a-5557-4d6d-8444-67711e0aaa8c", "comment": "Malware payload (AveMariaRAT)", "value": "9733f9975a7bb93fa5213f99eb8cfaa81e63d28d", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939212, "uuid": "07e5b16d-c326-4a92-83ea-4a20722e7787", "comment": "Malware payload (AveMariaRAT)", "value": "da3a1b80d1257e5c6290d4324884f03cb8e85358af09d921858c82ff403f66d964204ca1e3dcda9bb4b906cecd557d84", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "avemaria", "colour": "#914D3C", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "GorgonGroup", "colour": "#FB5EBD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939212, "uuid": "6fed4353-09d5-40bd-a303-12deea67ab22", "value": "F6019E37F6E7D6114429C89FEC6E9F89E87001470F6955D1D0D084D78D4184A5B7D85D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939212, "uuid": "629cbbeb-ba0e-4b3b-85c1-61520e66930c", "value": "12:xbIlEcT/yEZgAi3phyc8brdvkPGoXZ1elhyc8brdvkPCEhXVyZJN:1IecuEZgNpYcYrdMPGoJ1elYcYrdMPH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615939212, "uuid": "18cbc354-33ef-4892-bd74-6c048dde008d", "value": 665, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615939212, "uuid": "1ee3b218-0125-4126-9bdc-0ac9f11228b6", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939212, "uuid": "073adf4a-cba1-465a-95de-c9c291692da4", "value": "detect5.txt.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488f49fe-875c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011598, "uuid": "84a39336-b375-4f44-b940-5214e2fff4ca", "comment": "Malware payload (Dridex)", "value": "ee36f9c4f62b3ea8f510ca7f37aef673", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011598, "uuid": "c8d10589-a4d0-42e4-9d52-a2bc9aa0bea1", "comment": "Malware payload (Dridex)", "value": "938d4fb4acbb7e3657dcbd7ea84eb2df1d4d5c1c386930a18528fdf244984a07", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011598, "uuid": "ad8b0abd-8f29-48ed-93a6-262fa6583a28", "comment": "Malware payload (Dridex)", "value": "6561b1581acdf747b944efcb8603422963f39bd1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011598, "uuid": "b8fd4407-a5c9-41e6-a8c3-dc70a16cffe1", "comment": "Malware payload (Dridex)", "value": "e156afcc1abf2df86066f9dcf47a8a87e824261279bf19eaf28cdbfbd6ca1a5fe62bceb72d148b06a848dd7d5ce41f75", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011598, "uuid": "d0c6716a-b433-4781-9f4e-b277689bf5c7", "value": "2224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011598, "uuid": "d9d82a21-84ab-48ae-a907-d6f27eeea7f0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011598, "uuid": "78d10f67-12aa-4060-b9f0-c712865cd402", "value": "3072:n9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:n9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011598, "uuid": "43cc3c04-2383-454b-88b7-4852ead21839", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011598, "uuid": "3b43033f-270d-456f-9cb3-d806900b5d86", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011598, "uuid": "1bae5a95-7ca4-47e8-9891-1ef3ce6d0fab", "value": "938d4fb4acbb7e3657dcbd7ea84eb2df1d4d5c1c386930a18528fdf244984a07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89853fc5-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013425, "uuid": "8fece554-5ed0-47ba-b569-a29213737946", "comment": "Malware payload (Dridex)", "value": "29a5b0acae77b077abc24eea6a009f65", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013425, "uuid": "13c496e0-b40f-4a38-832c-66d588da026e", "comment": "Malware payload (Dridex)", "value": "9397d4c8ad0ffea20138e66e6528181071f14f9e947ca8b3ffaa7dc38ee68759", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013425, "uuid": "725793ac-332d-4af2-b20b-8d9e158c4c77", "comment": "Malware payload (Dridex)", "value": "d02def466f6e78194bed3a6c69fedb80fae3cbe7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013425, "uuid": "e1388b38-b9fc-4dc8-bf43-bfe4eb770100", "comment": "Malware payload (Dridex)", "value": "08b4b1eef7b62e33421567e1c31da35ffefaa09cf731712c6a4513dd28031ecfa787e1d93c687f4034ce73f61fa8e3a3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013425, "uuid": "1aa937ad-1cda-426e-90ca-140202b81177", "value": "7A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013425, "uuid": "3046a641-b4f2-4c25-a061-92db9d0e6a15", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013425, "uuid": "f6f1b8a1-ac4e-43fc-b7e2-8dadab9affd2", "value": "3072:y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013425, "uuid": "1c2b3bb5-bfbf-4a1d-a8d1-97df04249066", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013425, "uuid": "782df9e6-5ee1-424b-aba4-c11b04a161c0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013425, "uuid": "6bb931c6-8580-453b-a420-38d4261aa352", "value": "9397d4c8ad0ffea20138e66e6528181071f14f9e947ca8b3ffaa7dc38ee68759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf06093d-874e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005784, "uuid": "cc6f4fb4-d56a-4bc2-8b01-0ebe228b740a", "comment": "Malware payload (Dridex)", "value": "6230ce8d31f63117f4e67d42b5f97365", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005784, "uuid": "b431369c-86e0-45b4-88a9-51c772617bcb", "comment": "Malware payload (Dridex)", "value": "93bcc6744f1983ad90cd7485a1d1480424baefa7dcd0ca865983f05410c6ead8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005784, "uuid": "510cbd01-e1f7-4d33-aee7-5c8140df5234", "comment": "Malware payload (Dridex)", "value": "fd45e98d3940cbfbb24b50554e4b50f9be161b5e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005784, "uuid": "463faf8e-0326-4b30-9a45-1b75e049fb27", "comment": "Malware payload (Dridex)", "value": "3dea67bd4861d5821e0e5e731bddf98e38e0b0bcb5368363dbb4e90a52b1e3830978c821d7ec4a0d6b03c5051eea90d4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005784, "uuid": "a0bafa34-f83c-43f0-b6cd-9c75fba10ca7", "value": "2724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005784, "uuid": "f6349e1a-c574-436f-98cc-52dad3dccc13", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005784, "uuid": "cdf5be70-9d6e-42ee-8b2e-be1a9f550156", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005784, "uuid": "747dd552-f549-435f-b0d5-1e7d6eda5d28", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005784, "uuid": "0cb30690-9295-4f02-bf4e-e0b037e35713", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005784, "uuid": "ef135a76-23ed-4872-b295-8d706ec2ab80", "value": "93bcc6744f1983ad90cd7485a1d1480424baefa7dcd0ca865983f05410c6ead8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30aa12c-875d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012180, "uuid": "d93fb094-e67a-46c1-b3f5-43cd0702e83e", "comment": "Malware payload (Dridex)", "value": "56d2d398f0cba46bb22d06b98ea7c9b0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012180, "uuid": "5fc28233-5e3f-4ed4-b8da-34e32fabff97", "comment": "Malware payload (Dridex)", "value": "93c1d50d79120f7e7c1ce99b5858f16da1117b594e48bf6a1dcd7c02916e3ff2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012180, "uuid": "664a1008-9dbf-4d8e-99e1-e7dbe91c4f17", "comment": "Malware payload (Dridex)", "value": "b5c893b380f62a4a75c460751dcbffbb4575df47", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012180, "uuid": "853276d0-ecf1-4764-ae63-0128495a1622", "comment": "Malware payload (Dridex)", "value": "7ac7e120c1ff705ca39eb77443afba2ce3050ca490cf3afefbe5f905cfbfbf151e7b2fb37be2ced07b771929f45ed389", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012180, "uuid": "e8fad0de-f82e-4be5-b62f-4c86e22f42d3", "value": "DA24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012180, "uuid": "9e94570d-6aca-4914-b02f-1a8d50224899", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012180, "uuid": "0461cf69-3a66-43cf-89fd-5fa7414e35c3", "value": "3072:M9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:M9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012180, "uuid": "08f883a2-c58b-436c-b163-b0da24997267", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012180, "uuid": "7ca30fe0-ce46-4e6b-92cc-b99fcadde1ed", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012180, "uuid": "df35fde5-ffc0-4dc1-91ea-6448261c2a8e", "value": "93c1d50d79120f7e7c1ce99b5858f16da1117b594e48bf6a1dcd7c02916e3ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b43202d-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615962238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962238, "uuid": "55773490-c088-4f38-8ca9-0096686d512e", "comment": "Malware payload (Formbook)", "value": "1160d74bb57e02470b3be1a810142fba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962238, "uuid": "2a334454-ff1c-4745-9b17-11ec654d67d8", "comment": "Malware payload (Formbook)", "value": "93f0dbe2452709c30334667f48a11754c139d044f3047289bf066bec95922360", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962238, "uuid": "eb148f73-a0c6-412b-a285-5e1c85b3f2c3", "comment": "Malware payload (Formbook)", "value": "8dd7f27bdd9698fd266afc32056f31190880263a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962238, "uuid": "868596f2-d344-4bc4-9ff7-e2235ea209e1", "comment": "Malware payload (Formbook)", "value": "8535195a5aaecfbfb4d9924e286d8150f5f1f321a3142fdaa06580ff3c9409454131f109f745997125178973b225de80", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962238, "uuid": "55d1fefb-e316-4a46-874b-e6f68f9e03c9", "value": "A2B53315F8E8C72AC66EA03B80CFCD259CC1DE164B5C4A5AB65EB2547437A643BE334C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962238, "uuid": "2f5d83ae-9294-4a3b-82a6-409bc2782acc", "value": "49152:BWujGfgFgcqz0kctZCd9EX/wFhz+DV+h25i4vzvFR1P7tJJuuqBibhZQCb:dj/2cqAkc6LOwUwGhtJU3oXQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962238, "uuid": "b41416bf-0b06-489f-ab3f-28a767fbe89c", "value": 2427392, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962238, "uuid": "a9ee25f9-bbd5-42ac-bc10-d346b57c9107", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962238, "uuid": "2a73dc72-e183-4e55-a5cd-f5eaccb4accf", "value": "POWPO-201209-248-INV10981-PI100833-Waycos20210225.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e931a307-870d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615977938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977938, "uuid": "ff932c1d-c0c4-4660-9f46-745757357de8", "comment": "Malware payload (Gozi)", "value": "f1da5918e0db04c6107e365093b23fbf", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977938, "uuid": "996c0dc5-cd10-4878-9c79-44b69b9cf53a", "comment": "Malware payload (Gozi)", "value": "93fd754c763a8452b710d58ef6c56f832fd30d785c4967c2494878d4b75bd907", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977938, "uuid": "17a50cc6-e40a-45bf-b566-3c9721d5b611", "comment": "Malware payload (Gozi)", "value": "c7dfe1c2946450f29f99870dddf714eccd1018b9", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615977938, "uuid": "f60808be-e295-4783-a608-95b256137e61", "comment": "Malware payload (Gozi)", "value": "9024a107100059298f02bd1ce729fd763f869cbd3a6a887def610d84612d50d79d4bebae8ddb388f8df339d6e78daf3f", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977938, "uuid": "5595a553-abbe-4eb6-a72c-6236a8c5c5c0", "value": "50359E10B3A3801EC5262433D58AF97228773D7C1AE6446B7FD80D9ABF70E50C5AA75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977938, "uuid": "7681fdde-8ec6-4bd2-a208-4e184ac4ab72", "value": "6ca4dd1f7463ca6a328f95e62608742c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977938, "uuid": "4a35e385-0111-4356-9e50-4858378faacf", "value": "24576:+V9LlhcIPAEDsQcWr1sd347LRl4RLlGRLw9kDFRLERUqvLaNGMmZqvLaNGMgVlof:kPzTsYVl8CAKSahu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615977938, "uuid": "a91b0a74-7ce0-4465-b4f1-e2e042090da3", "value": 1080832, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615977938, "uuid": "e9ee0ec3-5bb2-4aca-b88c-7c9f89978ae8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615977938, "uuid": "1cbb3781-1d22-4b25-b381-76fa511a32af", "value": "f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eee5c0f-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004227, "uuid": "ee23c27f-2265-42d6-9825-9ff04acf586b", "comment": "Malware payload (Dridex)", "value": "ec9d93aa8ca34a7136d183227ff46143", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004227, "uuid": "989977ca-8257-41d9-8ba0-3ec470ff06ce", "comment": "Malware payload (Dridex)", "value": "9420256de8fb7c5b81bb26a34cbc72f9a202b521572bf75d8eefd8ebf8b987fc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004227, "uuid": "38c57d1e-cf93-4dcf-ae8d-e6cf873f1c6e", "comment": "Malware payload (Dridex)", "value": "1b85e610cf882764e19ef2e49c730bcc7bc54a71", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004227, "uuid": "dec50c30-67cb-40f7-b6c1-0e641e8db800", "comment": "Malware payload (Dridex)", "value": "f82ded83adf60657b3737fe6a1ed40b1df56e3c92e4f28d3dab3a185b2755c3198c4b33db63b4299f3bed7f19173e935", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004227, "uuid": "63f20c60-1d26-4dcc-9b26-167c349c3c09", "value": "3524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004227, "uuid": "fdaad982-7d88-4a2d-9f2e-c9d9cc3d9243", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004227, "uuid": "8f754b82-0c33-4e2d-89cd-a21017521e86", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004227, "uuid": "9e4a9f2d-570f-48c0-8bd7-aad6e24f6b0d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004227, "uuid": "243db82d-cff4-443d-9828-607c804e88ac", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004227, "uuid": "7cd3472b-460c-44f5-ad45-3de3d4349f1b", "value": "9420256de8fb7c5b81bb26a34cbc72f9a202b521572bf75d8eefd8ebf8b987fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2489ccd-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017386, "uuid": "55ef332f-96cc-4ef4-80d1-c9abda0f6c07", "comment": "Malware payload", "value": "34b3029b0db092b362a301ba77483d1a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017386, "uuid": "8d9cb4f2-618f-449e-99ad-65f0bbaec92d", "comment": "Malware payload", "value": "942f5f26305af4515ec53224328f7b73542ac43b5be81c1297a5830ef0df15cc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017386, "uuid": "697344e9-f6b0-4aa8-9dc3-f95e45e926e7", "comment": "Malware payload", "value": "6b6823d1e4f279c6db316f94111fd02b0ed9a1c0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017386, "uuid": "6bf4579a-79e2-4a9b-9eac-9280dc3ec9fc", "comment": "Malware payload", "value": "a53a480d638c37e27ffe5c8bbbdf5ac8bd81a937a932d2d7dcae33be65a8317d042508b39bb8d01a13445af47bc12040", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017386, "uuid": "228606c3-1c81-4f45-8286-472edfeb1978", "value": "B224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017386, "uuid": "91cc7768-171a-42a5-9d9c-4d269d530308", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017386, "uuid": "c539b501-b914-4ae0-b021-879898677402", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017386, "uuid": "7269b820-cbe9-4869-b70f-19cde837d336", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017386, "uuid": "d7ae059e-8719-49fe-af6b-8539bff9c26f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017386, "uuid": "9f9e2388-47e2-410d-aecb-38ea07194af0", "value": "942f5f26305af4515ec53224328f7b73542ac43b5be81c1297a5830ef0df15cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71164923-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004365, "uuid": "c248fd3c-305f-4281-8c6c-6de9a907200b", "comment": "Malware payload (Dridex)", "value": "58fd35ace6693af6dd0dc0af5b5d821b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004365, "uuid": "b0c7d8da-c2a4-4d11-821d-d5be81d785a2", "comment": "Malware payload (Dridex)", "value": "94497240332d547c2c5cd4538038353a63474eeba0725bf812ad5af48f5ef3cc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004365, "uuid": "e5f7f1ef-9037-4077-9fc9-74ae12da9671", "comment": "Malware payload (Dridex)", "value": "cad8ff3ec50d1d4b426a516cab49b1e9a74c4811", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004365, "uuid": "ddafb51c-2349-4889-b8db-9e197afb510d", "comment": "Malware payload (Dridex)", "value": "9dc1f76f938aa9afcc69257b9d0560326a1f8c32b5bf3479d0f3e138c9517208ee6795c76c5b2980ce5ea18cdc839fb0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004365, "uuid": "8f49c7ff-5cc9-4564-8eb1-d8ca107100ba", "value": "E024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004365, "uuid": "4335adab-f0c5-41ab-bc9f-44aece66cca0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004365, "uuid": "12fd1ccf-a34f-48d3-b90b-310dfae6efc8", "value": "3072:Z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004365, "uuid": "96c29a94-548c-4a66-b958-9e2c161515bf", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004365, "uuid": "fe5514a5-c89d-4d48-b521-e1b71977fe9d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004365, "uuid": "956a95dd-fa92-4b80-b06f-a563e36c20c3", "value": "94497240332d547c2c5cd4538038353a63474eeba0725bf812ad5af48f5ef3cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fc082b-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Makop)", "timestamp": 1615969371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969371, "uuid": "ece0bd4b-bdb2-41ca-a553-2bfcc8e57d07", "comment": "Malware payload (Makop)", "value": "b80103a60fa68e425a4fd200ca223915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969371, "uuid": "5a190a7f-127c-4c0d-b846-5b7ab832707c", "comment": "Malware payload (Makop)", "value": "94658982002db6acea22c68b7619f71154933effd6428a81a235aba6e2789328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969371, "uuid": "18c2dd89-2fc3-4509-9655-a2c29a29e90b", "comment": "Malware payload (Makop)", "value": "635825a5b35ea82c0255ba2c2e887c27fadd76f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969371, "uuid": "024defa6-acdb-4247-bf6b-dd33b824636c", "comment": "Malware payload (Makop)", "value": "6f96ba1ffa69a98392b407fb43bfac87adccad780350aecaddae6336fe7a962269758b7bfac0aa8cc71195646c6312fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969371, "uuid": "718fa143-ea1f-4e1c-8ce7-7bc4e6385f89", "value": "E9F4B625EDA77A8DB6A0421307A4B4CDA7BF43F2B95F7E59143446C74D9BB102BC8E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969371, "uuid": "fc1d150b-1cec-4593-9bad-6e99a49edcf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969371, "uuid": "03f502b1-f5f1-4163-ba64-05e80b28a890", "value": "1536:adn51E+v0XS7xwXwTONIsYKhV9Z5CY3J3Towo3mN98xA9Z/EfDa5LJXHdTfhMnZR:evoStwXjN9Ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969371, "uuid": "f8e9e904-e537-4ab6-a275-aed52b3bdfeb", "value": 769840, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969371, "uuid": "84d903ad-5588-4f1e-9d81-2f632c43e585", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969371, "uuid": "307310b6-b1cc-46bb-90ae-b4a2ce8688b5", "value": "b80103a60fa68e425a4fd200ca223915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda13829-8758-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010077, "uuid": "371c2024-633d-4d0b-87b8-d5a6db2f70e9", "comment": "Malware payload (Dridex)", "value": "5864baaa5d1f4f10ca9218ee696629e2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010077, "uuid": "8ed5397c-1e7b-44e5-ae5c-7ff562f50204", "comment": "Malware payload (Dridex)", "value": "94793bc6ded7440c41d1d9e5d18a801e6550bc16f7c993ac0be97dd67ffcb6c8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010077, "uuid": "e808aea9-48d0-493e-88a8-129e6b662fe3", "comment": "Malware payload (Dridex)", "value": "c803cb82d73901875056be085848862abd4a792f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010077, "uuid": "e4e2b479-c316-46ec-8280-d0d06cf8c094", "comment": "Malware payload (Dridex)", "value": "8e63a0e523c0096517770cca26ef52fad0834ed8ea79b9f17ba9271f1396ad16cf49b296f172377729036182ef26fc89", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010077, "uuid": "00e174c8-ceb4-4447-839b-09b7d921123e", "value": "9C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010077, "uuid": "22767656-5eb8-41e5-a986-393b4aab6d00", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010077, "uuid": "6d7128b0-4128-4594-8af5-0f9d80215e1b", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010077, "uuid": "50906f5a-92e0-4d14-aa12-a1341018c4d1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010077, "uuid": "81239cef-a422-4c93-a5e4-1ffbb1febe06", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010077, "uuid": "b63a883d-acaf-4fde-a933-f753d9462c2f", "value": "94793bc6ded7440c41d1d9e5d18a801e6550bc16f7c993ac0be97dd67ffcb6c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5aa55d-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004382, "uuid": "cdef7fc7-97cd-465b-91c3-a50007026b25", "comment": "Malware payload (Dridex)", "value": "e51c5d31268f2091239cea9cc5743463", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004382, "uuid": "08d2f1b8-e0b8-4e67-bfc4-efc7d71b2af5", "comment": "Malware payload (Dridex)", "value": "94e1e6787bf76b7b4a8f6210f3a8c42e3bfed96adb560eb485fbe24c31dcdcc3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004382, "uuid": "dfed2cc6-2b30-4822-a271-bf5efbad2086", "comment": "Malware payload (Dridex)", "value": "db8aad543ff8043772a8cf285373676026e7b819", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004382, "uuid": "247339d7-3fc0-4383-a348-0ecbcca755ea", "comment": "Malware payload (Dridex)", "value": "a52ba1f444c965477e86cbfd31a4e93a94f3d04d856fae4b64ea4cbe6e00f11f7e79dd866bf2037810657c2630ba8408", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004382, "uuid": "51645297-5f6e-4221-81e2-c4a106700310", "value": "CD24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004382, "uuid": "312de6a6-8e37-4220-ad20-2ee101839011", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004382, "uuid": "4ed13f5d-d4ba-46b3-89f7-b5963e5ae19f", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004382, "uuid": "2dc19f1b-f769-4a14-911d-d548b3aa5d65", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004382, "uuid": "a2555617-5763-4660-a28d-3a2ecc3fb455", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004382, "uuid": "8caf085a-fbe4-46ac-8daa-16e0e88574e2", "value": "94e1e6787bf76b7b4a8f6210f3a8c42e3bfed96adb560eb485fbe24c31dcdcc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5c9edb-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615969591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969591, "uuid": "c3c8b97d-477e-4115-bf7a-fd1d0c9802a4", "comment": "Malware payload (GuLoader)", "value": "7c25ae00b62e3a1c90a46927a270f72f", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969591, "uuid": "ed78a486-042a-45fb-b87b-ded8316fa690", "comment": "Malware payload (GuLoader)", "value": "951786817c43e29b07072c916a224055851099b56a171f7dad0f129d6a6bc2c3", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969591, "uuid": "1ce52517-11dd-4b65-bc0b-27648ec12e06", "comment": "Malware payload (GuLoader)", "value": "bdba95e6d2a3bb257c8443bbf7148d7c392d27bc", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969591, "uuid": "e37fa0fe-259f-48f7-9692-2ed2ff799472", "comment": "Malware payload (GuLoader)", "value": "9e6992ba071ab089167bc1c6d38d18bc4db60a77dd59abf6c407f9c0df1ae292039b859a76b6148165caf8801d161b4c", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969591, "uuid": "fd79ad9c-f790-4111-bbef-85d71cfcd665", "value": "F6E2F120BF103D81CEA307F9D4B3660E953769AFF9E555DA8A6044CDF24839589630EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969591, "uuid": "da40396e-f139-466d-a52c-e0fbe8c4c833", "value": "768:MmEMcy0InjZE+GUSx4MgLqleIXLG1OiH1T2MPN1UCNKf5iI/c:NEMcyrNE+6Ed6cVSiU4E5/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969591, "uuid": "9a913487-0254-4349-a4f8-8cebc85e1e16", "value": 33624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969591, "uuid": "8815ffdb-f160-4a97-bf01-5cad0d9b737a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969591, "uuid": "1a845261-824c-4a23-8901-24eacecab4cd", "value": "ph (1).cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135375d8-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004637, "uuid": "f100cc58-c494-437a-98f3-2ba803c4903c", "comment": "Malware payload (Dridex)", "value": "797f346d02efe05a6c547739aee01838", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004637, "uuid": "db89d298-eb4d-44b0-ad92-ba785b61d1e0", "comment": "Malware payload (Dridex)", "value": "956951120a32ad4bda87eef733de06bcf73cad6e33e3cf699ca81ae8a991b7e9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004637, "uuid": "d4a7e645-da6b-43ef-91d7-aa17e03b3108", "comment": "Malware payload (Dridex)", "value": "3778a02b0ad4186bb02f8b1f1da28ef31683b246", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004637, "uuid": "8c8c9409-ebd4-43ed-898b-a4b37363ba1b", "comment": "Malware payload (Dridex)", "value": "c13e1101308dfeecbf68fc62ee39f1569a6bd2618221ef3a71a2e609fbf2251f3df764cc04deeb7a7b913a64c2384c3f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004637, "uuid": "a0625633-d8de-475c-860d-89d16499240d", "value": "5724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004637, "uuid": "146896ed-8f55-41d8-a80a-dfe5630b8fab", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004637, "uuid": "6e3f37ea-4479-457e-871a-649d59aa909e", "value": "3072:F9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:F9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004637, "uuid": "4d977611-5b4a-4b54-9d7b-e5d2b0e80582", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004637, "uuid": "aeb92558-30cb-41bf-b259-61ae6c86cd9c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004637, "uuid": "24d83c14-f106-4c2b-a33c-34c4333c5de8", "value": "956951120a32ad4bda87eef733de06bcf73cad6e33e3cf699ca81ae8a991b7e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4490cda-8758-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010169, "uuid": "8e71f805-5e7b-4f26-8622-1c06a33891af", "comment": "Malware payload (Dridex)", "value": "30ccd49bb13b23ae46b56e3086747588", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010169, "uuid": "0ef5aac0-a7be-4d29-8d7e-f73a3da90589", "comment": "Malware payload (Dridex)", "value": "9573391a0ee535894bc205bc1d2dd9558936aa2fba2f925d40e030d964923ef3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010169, "uuid": "7d15353c-331d-4bd0-b3dd-e866813e4701", "comment": "Malware payload (Dridex)", "value": "43dcc87e2fcdb60bcbf5c1bc09ec64509cadbe95", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010169, "uuid": "a47fca0b-8e31-4e23-9dca-719393ebba8c", "comment": "Malware payload (Dridex)", "value": "47cfda771740007a10cd325927c88a607411ab418d70efa1888b5e41fa464ecc948e610652daac2617a4266c25453f0b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010169, "uuid": "f6201162-6876-40f1-b5cf-05c65736b522", "value": "4024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010169, "uuid": "915c4815-511c-44d0-a362-b43fd2140e8d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010169, "uuid": "fd62339c-d956-48f5-a0f9-749a8433d506", "value": "3072:P9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:P9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010169, "uuid": "044fe668-2866-416a-b9d7-91cc1ee02b4d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010169, "uuid": "b53fa037-2c0a-4a49-9937-03bc51f0b588", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010169, "uuid": "3fe133b8-2032-4448-b8da-11a30f6976a0", "value": "9573391a0ee535894bc205bc1d2dd9558936aa2fba2f925d40e030d964923ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2863548b-870a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615976326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976326, "uuid": "5494f5da-9d69-4a71-bbfb-1f204504312b", "comment": "Malware payload (AgentTesla)", "value": "eb8dd4479c7e56f370965efd1f5bfe42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976326, "uuid": "748bca33-8c50-425d-9d53-d907e1ff5a31", "comment": "Malware payload (AgentTesla)", "value": "958b88da50d90cea5d54285d31cde79ef7841df6604aa8cfd0a52c87e714aa93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976326, "uuid": "e14f5cb7-bbe5-40e9-be31-2c6964e76510", "comment": "Malware payload (AgentTesla)", "value": "80c64b74ec6491f1bacd7ce452af9a981708516d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976326, "uuid": "94cb05fd-365a-43b2-bad2-c1bebc43d31f", "comment": "Malware payload (AgentTesla)", "value": "db04ae95cc95f2ff6afb6427f7976afede05ff4eccd2041d7142b18656c95c3320d4673643d09bdae7c40f946cb2cc0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976326, "uuid": "7b5ffe61-6e0f-4008-92dc-feae18dbcd65", "value": "5BF35CE8E8D1CDE4CB8FC5DA460D7A951073F979C6C36C8A4428F3F50B9266F5A1AC60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976326, "uuid": "8c7fec46-e80d-4bf6-83d3-e5b7e6100d60", "value": "3072:zkV0AvFTnx1//kUWwyJi7eLbkrMrN6EetrKYWZ6gq6AVKlG5hEBYRPek02e:zkmKFvkeeLbyA6EeNXvgGVKlchEBgPKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976326, "uuid": "cfcb32ae-4af7-49d8-ac05-91f0d52eb563", "value": 162014, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976326, "uuid": "17a41991-fd20-4374-a575-c2b4da17d168", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976326, "uuid": "a15f4e02-94a9-4e73-bf47-9c694efde770", "value": "Purchase order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454095d2-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001714, "uuid": "61152640-fad7-4387-a2b5-df081e7effa1", "comment": "Malware payload (Dridex)", "value": "8153879220670f9283185b81aefa4d8e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001714, "uuid": "3f8257af-e2c1-4587-8195-1811050545f4", "comment": "Malware payload (Dridex)", "value": "95a95d3d42e5e0fd3f0fe9a48e0fc0d2cc8c06ba844733a9583b5a5d6f2970ff", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001714, "uuid": "5b272c26-70f4-4e27-9a4c-f8372965661c", "comment": "Malware payload (Dridex)", "value": "2b13faef05eb5b5ee902003086c74a3f47dc3fcc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001714, "uuid": "f3ac6ebc-b76c-44e2-b4ba-bfd345fa2bb7", "comment": "Malware payload (Dridex)", "value": "601924546feb43a7faca39bd36fd84a7e3b4b67629e181a1fd26a3cc5b7fe701ca23474d34153c48efb4b03488f39caa", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001714, "uuid": "c091fc55-9db1-43d0-84e6-41872b36d149", "value": "5C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001714, "uuid": "65aadf7a-ce58-43d1-ada9-e548bd59fd10", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001714, "uuid": "aadb9a31-d44c-4807-9825-d3547251338e", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001714, "uuid": "6e0c8c01-18fe-4b93-85a1-71fa07dcd8ae", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001714, "uuid": "5e093391-8d76-491f-b7ff-af362bc5e2d7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001714, "uuid": "dbd62cf9-ba84-4818-8436-ad7b821a2b91", "value": "95a95d3d42e5e0fd3f0fe9a48e0fc0d2cc8c06ba844733a9583b5a5d6f2970ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf5cd14-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003741, "uuid": "e85c15e5-f5dd-4ce1-8d50-7e090a0aa101", "comment": "Malware payload (Dridex)", "value": "251e1c825a6431f0d791442f443ca667", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003741, "uuid": "9b33552e-d9f0-4501-aa58-b721b362b37f", "comment": "Malware payload (Dridex)", "value": "95c7cc2f92e77de22e93efa5ba28350cabfe0a6e735c353902794ee9a7b82154", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003741, "uuid": "2ad0839e-c54a-4965-a056-bd6ab5c00ef0", "comment": "Malware payload (Dridex)", "value": "4cd0fbd2188d3b64f221448d58a84ddba6368c93", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003741, "uuid": "073210c5-fed6-4a34-a76e-9e4cb05f57ae", "comment": "Malware payload (Dridex)", "value": "54decff1fbdf6d43f0a9ef2b5265d276004e4378340967e2f9c9f920ff6fe8a7940bdeb3549fbabd82cccb2570d1f1a6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003741, "uuid": "2d701d08-b26c-4c17-bb18-ff96d14643d9", "value": "7C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003741, "uuid": "fa7c5f59-b82b-4d21-9dbf-400a2418dc05", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003741, "uuid": "d0519033-8106-40fd-90f4-6c2893b551b5", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003741, "uuid": "569391b0-4afe-4016-b2ca-d1a815f7cf32", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003741, "uuid": "4bdd1413-c2e6-4a9e-9bad-fef436cc7f63", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003741, "uuid": "92e71ec6-7fd3-4f02-a2b0-6c5ec582e23f", "value": "95c7cc2f92e77de22e93efa5ba28350cabfe0a6e735c353902794ee9a7b82154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e298b49f-8753-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007991, "uuid": "13423d63-3916-4b08-bd48-c766e5239cc3", "comment": "Malware payload (Dridex)", "value": "945d6918d33060393600bef857731036", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007991, "uuid": "8841cacd-32a8-4776-9167-af5547ba0d10", "comment": "Malware payload (Dridex)", "value": "95c82c0240ecf330697f856c7195d00225819618e70af2447b91ff72ba804dbe", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007991, "uuid": "4e403f56-28af-4a0c-acd7-3f382849de9e", "comment": "Malware payload (Dridex)", "value": "7f60a2c3d8e74147303e260b1610f0cbdc618fcf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007991, "uuid": "3766ca14-45b1-4bbf-bcc4-5ef27e506226", "comment": "Malware payload (Dridex)", "value": "66c7545024874585aec0abd9cbc67a1a4d9e956af5590cfe74867135b5f0a369ac376cf09d145676148082647cc0e702", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007991, "uuid": "3495b92f-6bfb-4399-a739-90f6e3545ac8", "value": "2524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007991, "uuid": "a38c90e3-5046-45d5-8fd7-bdd9f5e3f8bc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007991, "uuid": "092770f1-0abd-4866-8e59-9fbe77426625", "value": "3072:I9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:I9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007991, "uuid": "5d8ff8c1-02f3-4338-a10f-38f55a5cd7b5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007991, "uuid": "bdab22df-5a44-4302-9d5a-9e6c5c954587", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007991, "uuid": "4bd2e923-62f1-4844-abf3-6446d740bd29", "value": "95c82c0240ecf330697f856c7195d00225819618e70af2447b91ff72ba804dbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255ba8d7-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004238, "uuid": "da5a1412-eadd-4d97-9719-3e7a1ebd6140", "comment": "Malware payload (Dridex)", "value": "d4f588cafeb66a16ba1729ab51841168", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004238, "uuid": "186b61ed-4385-4df9-be09-83f1fa1849d9", "comment": "Malware payload (Dridex)", "value": "95faf6a37685ba9172e06df8195306b931ceb30530aafd415931343e6c86beff", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004238, "uuid": "925187cd-799e-4bbe-ade7-ec55a172030b", "comment": "Malware payload (Dridex)", "value": "83e9bcc30dfee8cc5e5af82d339d35fc2e19167d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004238, "uuid": "c1f694f1-be2d-4fb1-8a89-a2406305ffb1", "comment": "Malware payload (Dridex)", "value": "d49304e46dbb46c9b16da54b78795f701f8848da306f0f01e23160893c99fe32444c26a0ab448ab82b6ba7590917a1b2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004238, "uuid": "9335d7ab-07f2-43fb-bcdd-5f38f25d1391", "value": "C324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004238, "uuid": "b5680279-caa7-40da-89a8-8e5a7e074765", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004238, "uuid": "ae69bd15-a4b3-4d0c-bdcf-68a0214671e5", "value": "3072:U9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:U9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004238, "uuid": "4e4864f1-3d99-4699-9a54-e8f3410c7fec", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004238, "uuid": "7621b9eb-6a67-4557-a323-ece69140986c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004238, "uuid": "2fe582f5-e611-453f-a99f-e3c98cbc9d8e", "value": "95faf6a37685ba9172e06df8195306b931ceb30530aafd415931343e6c86beff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55ca768-86f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1615969234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969234, "uuid": "4ae9d277-5cff-4e34-a712-44bd13178fad", "comment": "Malware payload (RedLineStealer)", "value": "ce0f93d2bb7f18632d6695cf4800f436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969234, "uuid": "14eae63a-4d2a-4b6f-a349-ba2c0e6d7ce0", "comment": "Malware payload (RedLineStealer)", "value": "9624e9bf93ace2e4b9106fb1b30c1dfb9de68bf63f4fb9559f11078569fbe334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969234, "uuid": "29fca304-0d50-434d-bf4c-0f8c8123aea8", "comment": "Malware payload (RedLineStealer)", "value": "c36922e5580cf622752115f2c8fa95278ad455a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969234, "uuid": "0d9edafa-4643-434d-9d73-7846b003d59b", "comment": "Malware payload (RedLineStealer)", "value": "c1d1700d93f0171f39554ba56b7c48b433a96e00adc7f23bc1af22cc260ad18f5451ac86925bdb1655d557f79bcc477f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969234, "uuid": "6f9b802f-fc2f-436d-aa17-094d0bee7198", "value": "3165FC41BC9709C525B7A8935EDFF048E6DD767A5E82196BB8BCC7039183640C1BBE38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969234, "uuid": "5571f8ca-4c53-4558-a45a-3f1c555e19d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969234, "uuid": "af294426-3992-47e6-82f6-ced4ecb54086", "value": "6144:QVUWkqsPUI4MZEDjklKbkAtG17jBH6Em5lUTpwXHxCJfvELiC:QhkqsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969234, "uuid": "cb5a5e8e-13bc-4b14-b9ef-c320e5ece272", "value": 1457456, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969234, "uuid": "eccf2d1c-fe77-4676-a20a-f5f1fe97d5ba", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969234, "uuid": "1fce6d9c-4f55-40b0-97ff-12902230b75f", "value": "ce0f93d2bb7f18632d6695cf4800f436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943431d6-8750-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616006571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006571, "uuid": "e68de5a3-38da-49bd-b565-bda1a46484e2", "comment": "Malware payload (Dridex)", "value": "ae0df6875b7c318319942cd7c1a492fc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006571, "uuid": "ca3480e8-7224-4413-acdf-cb2eca50fc8e", "comment": "Malware payload (Dridex)", "value": "963615dcee94e0d3949d3c9236bc660870ef5995ba11028c17ed04d66b5ec89a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006571, "uuid": "af8f7e4c-fdfb-4341-83d1-5373f74627a6", "comment": "Malware payload (Dridex)", "value": "34236069e0515a5b6e3df6cee0196f9acc25cadb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616006571, "uuid": "1d164592-a056-4db8-81bd-3e684faae26c", "comment": "Malware payload (Dridex)", "value": "a683190a9b17e50754af5c254f456561ebc0dba320c13ca84323509c800cff3d5b2fa33fcccb5788adc20d59bd344d75", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006571, "uuid": "256552ac-8ef4-4d8b-9c38-5ba0af7714f5", "value": "0424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006571, "uuid": "2bc3205d-8a2c-4f14-b0dc-eac1c899d9d1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006571, "uuid": "e8643893-eda9-4da0-a7dd-74b52ccc61e1", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616006571, "uuid": "44993bcf-6c0d-4b5e-a3e0-028df2edd796", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616006571, "uuid": "fd6861ca-507c-4f98-bbac-14f9da8f5070", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616006571, "uuid": "2f7e3c2d-91c2-4110-aec0-f65c9c8e33e0", "value": "963615dcee94e0d3949d3c9236bc660870ef5995ba11028c17ed04d66b5ec89a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413707f9-86e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615962194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962194, "uuid": "672f04ab-72dc-452c-ad6d-5e3f714c1742", "comment": "Malware payload (Formbook)", "value": "4e341ca4f8091086c105a45de9a2c9a5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962194, "uuid": "af15ca7a-8f50-43f4-9ffe-aa43bad3a63c", "comment": "Malware payload (Formbook)", "value": "963eeafb60cda25de4ebd634dca5c64bd680db73d4727b1ff3e638d1e78380a4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962194, "uuid": "d546b022-dda9-4418-8416-a93f947c5d06", "comment": "Malware payload (Formbook)", "value": "4b1059989a3657c8f478c7f2b5e3c64185fee349", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962194, "uuid": "115f1097-0804-468f-ba8c-8f68fe1b98e4", "comment": "Malware payload (Formbook)", "value": "0eff7f612db576bdd3406a46afa0fe81435a9f933db3274c7ef149a5526b2a241ff552fe0a44615b820154c2d6deaa86", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962194, "uuid": "6344b309-baa3-4b6e-9ea3-78a4fc860452", "value": "7AB533049CC19B11D2FF97F04234C11A97796E605D08D8897B58F606B2F6B36BBD2BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962194, "uuid": "10b228bc-7a73-4a19-b487-cd2d429d2c8a", "value": "49152:KhOy8CMdtz4vI1TQzkq3ltDrQm/QlXfKA6wdQz:9xt8Q4Vh0mIfKA6vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962194, "uuid": "3572ed07-d24f-44d2-a9ec-e3c462e6f2c9", "value": 2284032, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962194, "uuid": "30542472-e97f-4285-86bc-6406ff8b872a", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962194, "uuid": "66c3d89b-668e-49e1-87b7-dd946c22decb", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6412a56-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008454, "uuid": "eecadb53-d243-4396-8f43-28707defbcaf", "comment": "Malware payload (Dridex)", "value": "447a457af0217b0c9ede7e690109600d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008454, "uuid": "67e3014d-98a5-43c5-afc6-f1504908f84e", "comment": "Malware payload (Dridex)", "value": "9689d259bdbfd5c17ed95ff8c70713fa3b8ff8944a47afde035d1834c560b870", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008454, "uuid": "3952b893-8d4d-485b-a443-80742be3d108", "comment": "Malware payload (Dridex)", "value": "b5c00efe3d4046527d8d4cffb428e63e6dd23a47", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008454, "uuid": "707d643c-4213-4a08-a8da-b1017c6ff292", "comment": "Malware payload (Dridex)", "value": "4e61d4814523cfe73b3416ab2caa774acc89f7218cfeeac07b5c4e900f41b9b643b314ba9e141b5cf0ce6bec693b7934", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008454, "uuid": "17cc2ebf-a252-4256-9682-31eb835d3304", "value": "C424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008454, "uuid": "8346047f-8049-4442-be6b-0c016a14f72d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008454, "uuid": "c568f3b3-c56d-4e87-b155-0b74fbde3ae6", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008454, "uuid": "8a45a00b-cb9f-4b47-9188-59c0bd23e71f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008454, "uuid": "e3bf73ff-387c-40f6-b585-69f84bbf1d73", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008454, "uuid": "9ac6ad15-e4b3-4b76-a302-f130a25f7c55", "value": "9689d259bdbfd5c17ed95ff8c70713fa3b8ff8944a47afde035d1834c560b870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec0c6ea-875e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012441, "uuid": "1a644c84-ceb6-4a4e-a3f4-b251954123e3", "comment": "Malware payload (Dridex)", "value": "6b7009f062ea6fc01e32549d984ee1a0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012441, "uuid": "8f683f98-24ed-4996-91dc-e8c3f46cb3c3", "comment": "Malware payload (Dridex)", "value": "96bc22912a10f88a0f1d4300ceb15b717ce5733ce1dc19a518615d18fd4a4272", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012441, "uuid": "0481da85-e8f3-4502-a03a-83de4ecff664", "comment": "Malware payload (Dridex)", "value": "a7c506df088399673c1932a7040fbfaf095e4a6b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012441, "uuid": "0fa2d855-474d-412c-8e51-18cf0affc20e", "comment": "Malware payload (Dridex)", "value": "02b0ae12cfc53738fbe6f9d0248b652601062102fac8276ba867ed273e64b9ceba6f403135e2eeb03c438c96a63708c3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012441, "uuid": "b5714cda-df8e-4d4a-8f69-a817bc42101e", "value": "DE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012441, "uuid": "e4ed529d-0737-4fe1-93f5-3c83b77287ea", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012441, "uuid": "f54b666e-af24-4a9d-ab00-538f955060e8", "value": "3072:N9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:N9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616012441, "uuid": "fea35f56-2238-4e57-9b2d-9d1b0f50c5d6", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616012441, "uuid": "655063ee-5800-4d25-bf6e-2afeabd33623", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616012441, "uuid": "f8528937-5a50-4547-82d3-a3d64c69a59e", "value": "96bc22912a10f88a0f1d4300ceb15b717ce5733ce1dc19a518615d18fd4a4272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17068c73-8752-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616007220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007220, "uuid": "c8c2a893-eacb-4187-88ca-bf9809a3f783", "comment": "Malware payload (Dridex)", "value": "ab048f2ec50b6c9427377a81eb5a92e0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007220, "uuid": "21cc996c-d8f6-4fd8-a707-4f6dae6263dc", "comment": "Malware payload (Dridex)", "value": "96d2012aacb1d2d7dc9d01bc51abb7a5b751d1d4d657f1b59955a2adc53c34b6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007220, "uuid": "6acf48ec-f7ab-4d96-9ba9-eac97e629711", "comment": "Malware payload (Dridex)", "value": "e284267d7165ab2f8ed7250eafb13ce1a9bd8b17", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616007220, "uuid": "c3ebbcb4-0ab6-4dfb-8bdb-5853cc8d1943", "comment": "Malware payload (Dridex)", "value": "ae3f3725d6b443a0ad4e65f211471ee413503c1cdb19b32bcd1de1b9d7ffd86419943bd99ad7579e310e4f62cf9ed8b0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007220, "uuid": "afb63dbb-8e26-49ff-9d81-f2ffed41f863", "value": "9A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007220, "uuid": "93b2980a-279e-4380-9620-5a9e59866402", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007220, "uuid": "cb8a79b0-a506-4267-a9b2-35fc63b48dad", "value": "3072:p9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:p9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616007220, "uuid": "dfcd217d-be08-44b0-8742-7d7afef7bfc7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616007220, "uuid": "b01be0d7-597e-4a16-b2be-85920d420ea7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616007220, "uuid": "7ec0da81-b6ea-4a8b-9284-ad8157ad5fa9", "value": "96d2012aacb1d2d7dc9d01bc51abb7a5b751d1d4d657f1b59955a2adc53c34b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4246de-870b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615976866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976866, "uuid": "c8abee7e-ab10-4e77-9824-9d020987b5e0", "comment": "Malware payload (Dridex)", "value": "f45877c8ab9eb8de26934ac8a99e83b0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976866, "uuid": "2f9352cc-9f8a-4125-a10f-6026a6e72517", "comment": "Malware payload (Dridex)", "value": "9709239fcc5cbe01d8f94a50cf727ae9b03766e76af5d0cba76aae6883e1b5ac", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976866, "uuid": "b40e6095-d47b-4a5e-85c9-628055543d01", "comment": "Malware payload (Dridex)", "value": "ee24ed127623aa0e70e7783be5317db3e4cfac30", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976866, "uuid": "c05f66ae-5ea3-4ae7-b4c7-66b6b94daba6", "comment": "Malware payload (Dridex)", "value": "8957a33813828ec322d1b85bb4846f30cd721a34e7dd688fa6aae4d3d9156cfc9b2a7c957fe7931db4501be6b96f4982", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976866, "uuid": "b2c93cc7-a879-4a31-adc4-c0451e7869ec", "value": "DD14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976866, "uuid": "3f61a909-f885-42e8-b6dc-82156cbe6a8e", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976866, "uuid": "ba6a2898-a8d8-405f-b5f2-baaa34a47094", "value": "3072:h1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976866, "uuid": "016d8e77-3c1d-4a61-a560-fc4f9a31ca2d", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976866, "uuid": "028528c6-ce45-49ed-9e10-a74da0eaac60", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976866, "uuid": "d3a06270-b23a-419c-9c4b-615fa1e2b48f", "value": "9709239fcc5cbe01d8f94a50cf727ae9b03766e76af5d0cba76aae6883e1b5ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152d7be8-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003352, "uuid": "58ea2cf9-a571-4264-9694-54f800497ddf", "comment": "Malware payload (Dridex)", "value": "3e06c32d02469098e2a5056c5c440669", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003352, "uuid": "9ab31ded-752c-4d74-b3b7-ecb73af32c02", "comment": "Malware payload (Dridex)", "value": "9752b67132671ccd637b7031be39c309f17166f3ff3517534cbf7850d3232129", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003352, "uuid": "c0ff859e-18fb-4937-8594-b6dbbe1c0fbf", "comment": "Malware payload (Dridex)", "value": "7390c92835829f8ceaa0a1d9d125956b67a9ef9c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003352, "uuid": "c99763c9-921f-4036-bf27-8007fa0e5c06", "comment": "Malware payload (Dridex)", "value": "851ecdbcf03f80401a64343de61525442c147ed0a803fe934a21b778eabe2fd6305508f27c8ba4ea725e75a6df7100a4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003352, "uuid": "02f93292-7c85-476c-9d0e-1df0cdb7b91b", "value": "F824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003352, "uuid": "0aa48d83-2df4-4923-a88c-5a3205918cf3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003352, "uuid": "29b4b608-b765-43aa-a482-920bd393249b", "value": "3072:k9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:k9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003352, "uuid": "0ca3b414-70a0-4998-9fea-6ce318bad067", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003352, "uuid": "98758f32-956a-48b4-b97c-810635dbc261", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003352, "uuid": "ddb69db6-a8cc-4999-b581-f75f75e28e27", "value": "9752b67132671ccd637b7031be39c309f17166f3ff3517534cbf7850d3232129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724a8a31-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1615968719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968719, "uuid": "1ac13c9e-739a-4b0b-aea7-40fe5e8b0298", "comment": "Malware payload (ParallaxRAT)", "value": "e83b5f2b03ffe236917d448f42937528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968719, "uuid": "871341be-b7b9-454a-bc8a-bfe3e41d2043", "comment": "Malware payload (ParallaxRAT)", "value": "978a48a2dabf47b1f89f176583063b5b52f68ef81dc48e6f4acf38a16ef3680f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968719, "uuid": "98fdc97b-894a-4028-aee8-d0e10b8dd709", "comment": "Malware payload (ParallaxRAT)", "value": "f316f26720a06f7698e2ad6bb6e5bb64bfd602ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968719, "uuid": "7c83685d-d437-4002-a929-6eca18259c98", "comment": "Malware payload (ParallaxRAT)", "value": "557a7eb629fc46e21a68d68518f3e6a94893fadcf683a8925d3022c01a4f49108d3d9de62497d8cf4e1cafb430630c70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968719, "uuid": "26bdaf2f-abf6-4f33-9c48-6a22c62b5370", "value": "15B48C31A6968371F2EE00FF0DB5B56449E57831A2E1B3F9BF85897CD930651DBB8202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968719, "uuid": "156426f2-d73f-4b68-9dea-3d93f1fd47ed", "value": "425c54b6507d90a6e2c9eaf3ecf04a80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968719, "uuid": "3b9743c7-33bf-49cc-a755-8e80fde0aa2a", "value": "12288:gqFIlDHGjf9HdagGizzBwQQGPJM5r6rC25NRHQTqW:9Wsjf9GizzBwx185NRwTqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968719, "uuid": "0a74f902-c21d-4cdb-8b1c-cd69005aa149", "value": 510512, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968719, "uuid": "027aa376-fd0e-4d78-bc5d-9de8fc8fa9f2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968719, "uuid": "6808dede-7d44-4b6e-b388-4ab868739c5d", "value": "e83b5f2b03ffe236917d448f42937528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b9a077-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "a9ef4195-9789-4265-9f35-c6f750831346", "comment": "Malware payload (Dridex)", "value": "dec3faf7fd453508d86d5ede7cd50bab", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "247bbbaf-598f-42df-8462-ee1df0c585f7", "comment": "Malware payload (Dridex)", "value": "97c4d58299fa3bc2815743f0c0352a5b94e3d1833d2a62e7a007f1fa9ec9460d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "8a3d37b7-3a29-4718-a68d-9ba95a39b6b2", "comment": "Malware payload (Dridex)", "value": "5a72a548bfbbf9e1922a07146776d967fa087fb1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003839, "uuid": "edfded79-2e29-43a3-af74-0b36dcc716cf", "comment": "Malware payload (Dridex)", "value": "650484e31a6278ee53a66eec701d88a8a2fc02e9a05c86f32a7188c953b7ddc887159a675cbeeb6402b7ebdf1d9cb3bb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "c4f806a1-4783-486d-a69a-8212e6646e79", "value": "D324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "388cbacd-596a-49fe-ab80-e5e1550497b7", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "14de5e5c-64d5-40d6-bf2e-643233e71971", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003839, "uuid": "367bd569-999f-4074-9a85-95d2ea2d58e8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003839, "uuid": "c7ebdc95-ffbe-4fa2-9085-38edded44b33", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003839, "uuid": "9f9027bb-a149-43e2-997c-c2cc79434e39", "value": "97c4d58299fa3bc2815743f0c0352a5b94e3d1833d2a62e7a007f1fa9ec9460d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259498f0-8729-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1615989635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615989635, "uuid": "6f170830-cd87-46f3-aee1-a4b4fe6ac43e", "comment": "Malware payload (GuLoader)", "value": "96aa5f77933303e933d83514f8fcfac8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615989635, "uuid": "65971def-4611-440c-a148-7b830673152a", "comment": "Malware payload (GuLoader)", "value": "97c784403f83adbd7a4b8142c3e69e9acba2898d7293063a07b58ea35dff7b39", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615989635, "uuid": "f65b0dd4-303b-41ae-8954-6041d509feaa", "comment": "Malware payload (GuLoader)", "value": "0198c8c7c5b0d340031e0db983243d304a1eb806", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615989635, "uuid": "5e1f0cfa-2679-4d1d-ba72-79a5886026a1", "comment": "Malware payload (GuLoader)", "value": "58820d954e55bf15d54a2209fb1cf187c56779a3e6a3721613a2e1ed1e8c7f060d9504a3b30b3354c35d6f3f2617af74", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615989635, "uuid": "100d2c33-4d9a-47b5-8a4f-e2edcc75273f", "value": "72A3E7DFE5A94723E521BD325324D32D3F21BC313052CF972E506E7A78B8652A4BE642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615989635, "uuid": "6b6efbe5-44e4-4caf-a974-c23768a86382", "value": "97871acd9c5a2bdcb6bf8a291448d3db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615989635, "uuid": "3934a732-daab-4c26-bc85-b40e4195a534", "value": "1536:xjIRTAcSBFJxO7V4DFmDk3RfpHUGLSB3W9ThrjWpurOTpOE1YTHauIR:xeTNGFJ0V4DFjItCHaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615989635, "uuid": "bdf96aec-9cab-43de-9bc5-4bf8b00faf27", "value": 102400, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615989635, "uuid": "74ab0017-4fbb-494b-b12c-da6ea5091f54", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615989635, "uuid": "1603b4ea-7575-4a1a-8500-77410b34856a", "value": "PotentialAPT.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52350b4-874d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005311, "uuid": "bf71cc30-f9d4-4b40-b443-4f25dbca6490", "comment": "Malware payload (Dridex)", "value": "df09c0ef95b8675a885d4105c611580d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005311, "uuid": "a6b24969-1d1b-4a17-8eae-af484c03d577", "comment": "Malware payload (Dridex)", "value": "97cbbc40a9b005629660bc324baf4075350b9d90db78801ae379bf4c01c0b6d1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005311, "uuid": "d35803cb-af97-403c-b9d4-1d4bf59428f4", "comment": "Malware payload (Dridex)", "value": "91a5e06ef0689de564047b665b38881001863e61", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005311, "uuid": "655763e9-35f9-461d-bd01-dbe9f63a33df", "comment": "Malware payload (Dridex)", "value": "eb0a63fe8667721e5a25bd034bd76823b1de4ca0e3540ff7a7ea6657052b53c803c52893bd4a5c711f048325dbb231bc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005311, "uuid": "3cd3968b-858e-4916-baae-68cd118a14b9", "value": "F824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005311, "uuid": "80d5e3d8-e371-48c8-8fa4-4cec0e1711aa", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005311, "uuid": "633863b1-523e-4524-887f-3eb6bbc25b9b", "value": "3072:o9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:o9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005311, "uuid": "c63a6744-1235-4a47-9fc5-c0ef40c2480d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005311, "uuid": "a2a44961-891c-4393-800e-5b53bdda2786", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005311, "uuid": "7877e12e-059f-4489-98c2-cfbd10bb7fad", "value": "97cbbc40a9b005629660bc324baf4075350b9d90db78801ae379bf4c01c0b6d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604cef55-8748-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003048, "uuid": "85a0eb72-f7d0-460a-bcab-118cffb4d3ac", "comment": "Malware payload (Dridex)", "value": "aab5f0a94528753bb74b94ace963c0d9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003048, "uuid": "3e26dba7-1945-40d2-87ca-2958ce1cfe01", "comment": "Malware payload (Dridex)", "value": "97d07dcfa48ea71bedbae83d975f6a4d7641ac796506c34da876188292671885", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003048, "uuid": "67ce5ed1-d440-4654-846f-df1d1592e811", "comment": "Malware payload (Dridex)", "value": "58e1aff1b14f4d9fb89d3f13b87f5df0ca721b74", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003048, "uuid": "fd713f01-32b3-423a-b9dd-b5d00562a9f2", "comment": "Malware payload (Dridex)", "value": "5f4524da2a037b2a4f60dc4f0bc0f95b0dd077bb5f9eb156ebb1830faad515349ca7c16dac341d35d630a1de880d3040", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003048, "uuid": "8d5780f9-80cc-4d6b-a942-71c5f78f8e91", "value": "F624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003048, "uuid": "0b1bbabe-0bb4-4063-be4b-9dc14ff9212a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003048, "uuid": "db9e90ad-5cb0-4e87-9ce5-65c666dab6b0", "value": "3072:T9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:T9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003048, "uuid": "e3953360-3031-421f-8481-4d946ea9c543", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003048, "uuid": "4588b0b8-51b7-452e-8ca5-a50b17f45e67", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003048, "uuid": "ae925e2b-41f5-4153-ae48-a200b55ac39f", "value": "97d07dcfa48ea71bedbae83d975f6a4d7641ac796506c34da876188292671885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37ec1e5-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615969741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969741, "uuid": "8a9e0acf-0438-4686-92cc-d487d895d4be", "comment": "Malware payload (AgentTesla)", "value": "feaf596e897e593424451250f21891a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969741, "uuid": "920838dc-d66c-43e4-9a10-40cf437cd4b3", "comment": "Malware payload (AgentTesla)", "value": "9805afbc4ec53bea5c08ab912445f1a9e34791eeaaba6c8ec0d50223e2c6005b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969741, "uuid": "efa5a1c4-cf01-4d71-abb5-589cf1445d6b", "comment": "Malware payload (AgentTesla)", "value": "e286a9cb61deafa11d72a58501a6f1a585c052ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969741, "uuid": "fd7c8e7c-1fdc-4c7f-9ae5-88c73d3254a5", "comment": "Malware payload (AgentTesla)", "value": "773bcb7b8d4d2a1f58d05cfabd9705b70644ae9ba3fdde79426bac270ddff7c7b09dc50398f50a66fe2943c60ce0dcff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969741, "uuid": "d6cc4c04-3819-4d34-bc06-290a43b1fcfc", "value": "C165831316F4FE24D27D32718C7B5419C5EC95329338F069796A338ACA6F9104FA26EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969741, "uuid": "4c2539d4-6c7b-4976-80a1-ac291ad219ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969741, "uuid": "39b7b24c-6108-480c-8c97-f67b28eb3ade", "value": "24576:ogsRYud0v6kAIVncKuxvE/NxJPopH2brP:ogsRYI0v6scxvyVopH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969741, "uuid": "2cf29b98-60b2-4b7e-a038-c73890c6932e", "value": 1548800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969741, "uuid": "fc9d4c52-c71e-4dd4-a286-a1701a95a164", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969741, "uuid": "07a4622f-8766-4dd1-9738-8e356a15e5b0", "value": "Payment Adivce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85f8fee-86c8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615948301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948301, "uuid": "48bb8a48-e5b3-48a7-8d01-4fd0ef37d18e", "comment": "Malware payload", "value": "bf7fcef0f51a7fe6d00752b8cdf25762", "object_relation": "md5", "Tag": [ { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948301, "uuid": "5182d932-aca5-47bc-982e-71f96db29f69", "comment": "Malware payload", "value": "981ecfc67d7192f0e82f3f8042d7c26c78396a3a62e5e34c717db31aee566eca", "object_relation": "sha256", "Tag": [ { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948301, "uuid": "e52d3288-171c-4e4b-a7f1-bafe747a6f93", "comment": "Malware payload", "value": "5d97e581853be9a8ca94a3b09d9f75f4ce99ef56", "object_relation": "sha1", "Tag": [ { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615948301, "uuid": "9df78680-a4e3-46d5-a930-e4469bef8799", "comment": "Malware payload", "value": "6f8d10c3109a7b5a73635c7d24a6638f553e89e075d889dcd2ccdbffae630ba3b3266153076c707ce43d20765b69d614", "object_relation": "sha3-384", "Tag": [ { "name": "FIN8", "colour": "#EE36C6", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948301, "uuid": "261424ed-753c-41a9-88cc-5f90e476c64a", "value": "32D3E137CA33ACD94FEF326AD0F54A1A14145961DBFB4C80DF4928FEB1A2350AF59918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948301, "uuid": "4fd76e4a-50c5-43a5-a3e1-8310a4b6079f", "value": "3072:ndyuK0GwT1tSYJgYUcvNgY8FgVQTsbt+eJCmXtoNZVWpF+uKJtIBB:dW/C1A1o+YOjgIeJtcW2YBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615948301, "uuid": "8b8264c6-ebd0-4013-b413-624cd18b9c92", "value": 132676, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615948301, "uuid": "ad42103a-5333-4535-bd60-5bf7c29ad8dd", "value": "text/plain", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615948301, "uuid": "e4b43ce1-39b3-4d99-9cba-f21768bab3cd", "value": "981ecfc67d7192f0e82f3f8042d7c26c78396a3a62e5e34c717db31aee566eca.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b405801-874c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004650, "uuid": "4ab87710-01ce-48a7-ad5c-9c6ed49cd5b2", "comment": "Malware payload (Dridex)", "value": "269312430b7b158d86f7d0244c08ec26", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004650, "uuid": "08c9642c-8460-4dfa-99da-c05acdc27201", "comment": "Malware payload (Dridex)", "value": "9825c68354f9fc9a96ad2bea31a2f7860151ccd45f7b34013f5e52b7b58637c9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004650, "uuid": "117ee7dc-0e2e-4493-ba2b-7df228f14f31", "comment": "Malware payload (Dridex)", "value": "78cfcce38559451a702675f4d5e1666174f665a5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004650, "uuid": "55697c08-547c-4a01-a7ba-a5b4f4e34fa9", "comment": "Malware payload (Dridex)", "value": "df5834a76216aad6b74a236eeaea5a65571ac4fd615a0c90aecbdc5feec5c37bc4fecddc0a23a30ef33e0e85b6010388", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004650, "uuid": "3250ac42-229e-4ec8-bcd7-6452f62d414e", "value": "0424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004650, "uuid": "af5c8d4a-0e07-4a63-a670-71edd6a72a3b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004650, "uuid": "8d0c2613-e5bd-4dfd-a674-96292df53a45", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004650, "uuid": "9f23eaf0-16cd-4886-a652-add7b060a757", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004650, "uuid": "8da0e32a-72f6-497a-aeea-d689b9399e60", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004650, "uuid": "9501978e-14cf-4eb3-906d-c1b30939256c", "value": "9825c68354f9fc9a96ad2bea31a2f7860151ccd45f7b34013f5e52b7b58637c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c797361-870b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615976896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976896, "uuid": "ba569c77-4d62-4ef6-9279-4e35652ab9a7", "comment": "Malware payload (Gozi)", "value": "d40ee9c8e2047bf8391d45ff1b067dda", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976896, "uuid": "df549fc4-1e12-4d13-b9da-202660a707c5", "comment": "Malware payload (Gozi)", "value": "9857b0a657e357460e67f1f1830ec8e461f3c84115a466f9eee3af32c92e2e20", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976896, "uuid": "a8fc8e65-f359-4d22-86f9-780ebc5edeaf", "comment": "Malware payload (Gozi)", "value": "0d327f54a14d9515f3818a23ec6ff3f5df8d4f29", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615976896, "uuid": "84b5480c-0df5-4a64-8d61-0e4855e02439", "comment": "Malware payload (Gozi)", "value": "c9fb34ce9ab3412305f89028c555a8e4653f8efc1d064ce5f37ab72e8c86ef927ee9ba50d48e103115f6974b40deb844", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976896, "uuid": "73acc3e6-9a1d-46e1-b27f-65fc42308c2c", "value": "9226AE7F10515DAFF740B8761A3080036E8A625BE4DD94DDB80F90736F18FBA94AFA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976896, "uuid": "5f0a9af1-b7a9-48a2-b795-08e7e056dd08", "value": "49152:oVUg5AfUb76jl/PTV0maWj4qO4eiJbFFYRKFZW+sYzqtqrDpee26:o6gF2jxPpbaWjRnuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615976896, "uuid": "440994b4-2aaf-49ec-8ab2-f04936abfad1", "value": 4505600, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615976896, "uuid": "45fb02e6-2277-4c7b-8d00-ba8162bdd5eb", "value": "application/msword", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615976896, "uuid": "3e43b218-6d58-4fc8-9375-36edc519f32b", "value": "d40ee9c8e2047bf8391d45ff1b067dda.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31931da-875a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616010972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010972, "uuid": "84f821c7-1009-40a0-8dfa-2da2292893ef", "comment": "Malware payload (Dridex)", "value": "e3c3beacb68af0aa2cb7fc97d9007b06", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010972, "uuid": "c3aa98b9-7474-4db2-a2bd-9a49127ba292", "comment": "Malware payload (Dridex)", "value": "98ad99bd3318b7aee8760d0e375789ed6923b2c523696b865580368a92b58300", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010972, "uuid": "c79f156e-4d5b-454e-a49d-58ffdf7bce1e", "comment": "Malware payload (Dridex)", "value": "bbd9c01bd8da7fc8c1f95b21b00bdc822dfdaf33", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616010972, "uuid": "eed4ef2b-eec3-470f-965e-d90ecea45415", "comment": "Malware payload (Dridex)", "value": "23d4a239e5b1cf398a203aa4f88423ef90beb52099fe7b2c3eb5f2cdbf21ed7bac41a5ad682e7026572a7f75de0f9be7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010972, "uuid": "20573658-3fd4-4efe-a536-4eb6e1d5b8fe", "value": "6424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010972, "uuid": "700f52f8-66f3-49e3-a071-bd9b6619b675", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010972, "uuid": "711652d0-4591-461a-8fcf-c8bf2e2ecaa8", "value": "3072:29Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:29Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616010972, "uuid": "64c288ec-0171-4ece-b9cc-875467ce6088", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616010972, "uuid": "a42570be-f1b1-4cd2-803b-760ea56f8886", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616010972, "uuid": "33933d12-41d2-49b3-809f-eda60040d38f", "value": "98ad99bd3318b7aee8760d0e375789ed6923b2c523696b865580368a92b58300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f89dd8-875b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616011222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011222, "uuid": "7a9440f5-224f-44ca-9071-fc3a15539ddb", "comment": "Malware payload (Dridex)", "value": "dce9ae81c95f35e2058772b38744df4d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011222, "uuid": "04237db9-b02c-4729-87cd-a11c737ccac0", "comment": "Malware payload (Dridex)", "value": "98bc6a9d4b6a2a20e9fb852a591edc9e05beb16544b5ef60bf0a4c07fec41536", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011222, "uuid": "c87ea3fd-0134-436f-90b6-5bfbebb5b3a3", "comment": "Malware payload (Dridex)", "value": "054a2ea850bf52ea78328692ac688565f6a18cc5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616011222, "uuid": "f5fd1b72-8d26-4494-bad7-ad57b0eed5bc", "comment": "Malware payload (Dridex)", "value": "6838cd5b0be95492c87025843ddefe0107281215597caa035f83a21a28e5c02ccec5894c87192ae1466913ded558eb4d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011222, "uuid": "74fa9601-6ff9-4a32-9a1e-8fd056f0e6c2", "value": "5C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011222, "uuid": "0810e73e-bb46-4736-aa8b-48c5e8cf73b5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011222, "uuid": "08998687-75c5-42ad-a4d5-020dcb713377", "value": "3072:Q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616011222, "uuid": "7e312939-e2cf-4a1d-9e5f-2ece4264765c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616011222, "uuid": "b51c295e-32bf-4e90-a490-33bad534983e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616011222, "uuid": "da5cf32d-284e-4603-beb1-f8fa09e5161e", "value": "98bc6a9d4b6a2a20e9fb852a591edc9e05beb16544b5ef60bf0a4c07fec41536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cb9a75-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001694, "uuid": "f09f480f-bbf4-4b11-be52-cfe3a205d980", "comment": "Malware payload (Dridex)", "value": "c75b3562bc4a08878511635fd17af07f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001694, "uuid": "1f99456e-6c66-4ded-9b22-3b8860852ff8", "comment": "Malware payload (Dridex)", "value": "98e4f682a0a9064a5f7aba57d536a9188a1eec69c5295645b45b22866493254e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001694, "uuid": "b4f9bdc2-531a-4498-9c2b-46146d49a4e6", "comment": "Malware payload (Dridex)", "value": "6bf78aa6cd51914cbca02a03288d5ac6365a1aaf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001694, "uuid": "b821dfdf-97d8-45f3-813f-1c9cca671cd9", "comment": "Malware payload (Dridex)", "value": "dbec9fc080e4a18d661050da97fd65725c5b5a8969d8fc5b8a26b6f247c3dfd5567f049c631fe4d76d563fc006a2f4db", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001694, "uuid": "da457b1f-ecc4-4e1e-8f3a-732153a265a0", "value": "6C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001694, "uuid": "92970e50-42f3-41bc-bf1d-c3da1029832b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001694, "uuid": "4cf3caca-e7aa-4078-8a53-5c54ddbcd9a4", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001694, "uuid": "e5555929-bd08-4b9e-8fc0-590492be389a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001694, "uuid": "51165896-31c3-47c4-ab0c-c727326262f5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001694, "uuid": "c3c3aa07-0e1a-41df-a9b5-9c4cd9a9dfd9", "value": "98e4f682a0a9064a5f7aba57d536a9188a1eec69c5295645b45b22866493254e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e35c01-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008178, "uuid": "229a0e1c-b29d-49fa-bb0a-fb4d8bf687a2", "comment": "Malware payload (Dridex)", "value": "46e919dc0d0f501324b29772083309f6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008178, "uuid": "82012b24-4b8c-4bc1-8e3f-8b24e6ff6b55", "comment": "Malware payload (Dridex)", "value": "996d58079e06dcc2b43ae383cbc72dca676fca4c29757012a43edce7d8ad5e1b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008178, "uuid": "6fe8b982-633f-4ff0-85e0-38efa50ebccf", "comment": "Malware payload (Dridex)", "value": "4b95bc1e1c5293994221119bbe9d3dfc052d0140", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008178, "uuid": "ef9835ee-fe5b-4ec1-b9f1-a04fe886bb17", "comment": "Malware payload (Dridex)", "value": "d1ddcf56522c81b125dbdb5505f0b983f926ab15061fc7bbacdcd9bd8520a9ea9265c04cb8981e581da60ea5302b88bf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008178, "uuid": "03488224-d0f1-4fab-bb2b-c05cd80e55e4", "value": "D724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008178, "uuid": "804c467f-b49f-4005-915d-b678de8e5fa9", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008178, "uuid": "789cd1e6-0693-4014-a50c-313d10b66a04", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008178, "uuid": "bcb3dc80-d53b-4c37-b458-b05cf513c0f1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008178, "uuid": "5e3d0cfa-c9da-409d-ac44-4fbe18699897", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008178, "uuid": "1f9be571-d734-485c-bb28-4d3f86ab6fa1", "value": "996d58079e06dcc2b43ae383cbc72dca676fca4c29757012a43edce7d8ad5e1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9736d9-8721-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1615986454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986454, "uuid": "9294916c-8b38-4ec3-8784-b11a68d6f498", "comment": "Malware payload (Formbook)", "value": "25f6f6b51a99de3918a1b7eeefc13237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986454, "uuid": "443769a6-b28f-4f34-b538-db1feb6d0808", "comment": "Malware payload (Formbook)", "value": "9998ff1d42d8af0fcc166bea36887eebf182e91d1816853d9f80e6cbbbaf9145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986454, "uuid": "5940f34d-8ec0-4ea6-9a8c-88d76fdcaa10", "comment": "Malware payload (Formbook)", "value": "3384efdca9b2def4f94465c7c70f1097b4d38bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615986454, "uuid": "097ee2bb-7e1a-43ce-9d77-43332af39be4", "comment": "Malware payload (Formbook)", "value": "068858349eaab175cee3c422d8d2c1d8f502d4f6acaba64b64f9fef859ab07d2e0edcd7c9103455a9507c624c7f8f97f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986454, "uuid": "acf2e88e-80cc-484f-b3cc-b8029b0ed954", "value": "53946AC5E98455A0DD59AB706A36CD358223BEBCA874A41D29DE3E3B3FFB2D31025053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986454, "uuid": "7f5d3bf9-5d97-49e4-a847-6a233c679949", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986454, "uuid": "72cb15e4-c4b2-4b0e-8950-172907ee9e2a", "value": "12288:tP7r9r/+ppppppppppppppppppppppppppppp0Gmet24mmISRu:t1qme44mVIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615986454, "uuid": "7841a2e1-a1f9-4ecb-935c-9dd020ecd16b", "value": 433198, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615986454, "uuid": "645e29b8-9e50-43e4-a3e4-ae4c4ac78544", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615986454, "uuid": "fc0c4d4f-754b-46f4-b6a5-2ebb4ce09b74", "value": "order samples 056-062 _pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1652a6-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616013399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013399, "uuid": "b988d45a-ba6b-4226-84c2-511b11df3ed7", "comment": "Malware payload (Dridex)", "value": "c6c11be867c7d5b6c789488643100867", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013399, "uuid": "793ea1d0-5626-40f1-8406-06b36971cfcb", "comment": "Malware payload (Dridex)", "value": "99f808b90a0a02645f462cac23b756652966a5d421bee9eef179802f987cce1f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013399, "uuid": "74ea9586-e2d8-4434-8936-2920c69e450a", "comment": "Malware payload (Dridex)", "value": "c0041d46a6ae6ef970d6f7e4594214aeee07ac0c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013399, "uuid": "4e3407fc-f89f-45a2-b619-30731e82355f", "comment": "Malware payload (Dridex)", "value": "4061642f781e6703a2074861dd9ad49733fa3e9a640e9a4a8d23ed32f60f0c4ab8f6ccd32f8b0295d4b1f5d38af7ca33", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013399, "uuid": "b0024cab-e664-4f5a-a22b-3a9a1feb57cf", "value": "CC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013399, "uuid": "71eefe69-72be-441c-bb2d-5828f41ffb61", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013399, "uuid": "2f4b3487-9c95-4f07-9a42-2c332b67bde0", "value": "3072:Q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013399, "uuid": "b27a7661-5dfe-46c2-917c-fcac2ca2243f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013399, "uuid": "a0a06d68-df47-49d1-8de6-f3ce054e6686", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013399, "uuid": "43026b0c-9bea-487f-9d2c-dfdc2d512cce", "value": "99f808b90a0a02645f462cac23b756652966a5d421bee9eef179802f987cce1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70061ea2-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001786, "uuid": "9085b1cb-c35b-4d71-bfe5-f0854bd76812", "comment": "Malware payload (Dridex)", "value": "92f48ae7742b31eb03dd76bbcd7d49f8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001786, "uuid": "92582b84-15e4-474b-af33-d7dcce5d13b4", "comment": "Malware payload (Dridex)", "value": "9a141f7c1b5c738e7d01cd2aaba61559b8ef230d20ad656a92c0f18b57036d03", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001786, "uuid": "67ad2b64-e503-46ea-99c8-b74a12aa6f70", "comment": "Malware payload (Dridex)", "value": "3ad17bcad81293e2cc7328d94779b3c35b25d3fd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001786, "uuid": "3d15a0d8-6192-443b-989e-5e8ad859131c", "comment": "Malware payload (Dridex)", "value": "1ee8035c785a33cd2e8ffc7b1e150be13f62f4ae9b6cf5b813442421714f2578a2e54bc3421393ed0d7783000e2afef9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001786, "uuid": "62ddfb13-dd67-4db5-b4e3-2da24b06a79c", "value": "3024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001786, "uuid": "550961a5-f689-4ab4-b82b-393bdd0181c8", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001786, "uuid": "fc173149-23b1-4975-9fed-659ee87f8bb8", "value": "3072:I9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:I9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001786, "uuid": "3c6b12d6-ceee-4e06-b05a-e7803c7648bb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001786, "uuid": "908db01d-9151-4fd0-a473-3dc93dbbabe5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001786, "uuid": "c48b9933-e328-4859-b28a-06ff47d02ea0", "value": "9a141f7c1b5c738e7d01cd2aaba61559b8ef230d20ad656a92c0f18b57036d03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc783f3-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008302, "uuid": "c09acbbc-1a31-48d8-ac96-bf4864162b70", "comment": "Malware payload (Dridex)", "value": "d6abdeac90de4859147919fc8277e59c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008302, "uuid": "76b10524-9560-4cf7-997b-3398d47fec23", "comment": "Malware payload (Dridex)", "value": "9ae6ec944b17961fb92eea7b51e033dea109456e3bb4ac1c5f85bf6fd3ab45c7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008302, "uuid": "79cf5ce0-9899-4c67-9ebd-9617f0a0d4a7", "comment": "Malware payload (Dridex)", "value": "ba6b74d32c81d9cddf29c1496130463166642e0f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008302, "uuid": "32968e41-489d-4c0f-b0a3-8018258f43ec", "comment": "Malware payload (Dridex)", "value": "26342af1ce1324edae636095fb5a811c1be8415bf02f89259bceedb51508d792f650ebee453e323ca3011fe1d33dda12", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008302, "uuid": "fff8e992-1bb3-4a19-9f76-fa3da1d69ec5", "value": "3424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008302, "uuid": "cfbcba38-69ac-43a2-9f85-99ec58ce45a3", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008302, "uuid": "664f457e-9864-40b7-bd65-b5698ec50178", "value": "3072:t9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:t9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008302, "uuid": "74f51de9-1f48-4986-94eb-fca459ea26d1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008302, "uuid": "7133df1c-4472-47d1-9201-13735cc99a50", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008302, "uuid": "42c10487-444f-4a2a-8952-ddcfa7210708", "value": "9ae6ec944b17961fb92eea7b51e033dea109456e3bb4ac1c5f85bf6fd3ab45c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592c98a7-8728-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1615989292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615989292, "uuid": "a0478f20-658f-4005-876b-05cd84cfb9d6", "comment": "Malware payload (Gozi)", "value": "45fce7fad17e37916456694865b10bf4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615989292, "uuid": "4e2cbabd-41d1-4271-9992-7b6b895609a0", "comment": "Malware payload (Gozi)", "value": "9b46b746e0838a160ceaa31bcde6d7eda49c3a065b7f50a3a29577ab6fda1023", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615989292, "uuid": "747b78ea-e04f-4d8e-a5bc-028912807e88", "comment": "Malware payload (Gozi)", "value": "dc2e64142432586caef9205f959181fb3d26c301", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615989292, "uuid": "3cd0a5b7-1ca5-4bca-8303-aa02af503e46", "comment": "Malware payload (Gozi)", "value": "96cc9f00d6195fb364038d58d69e8de72faedb7f0e284dc244d8a2d8b871fab3b7f97f8afa3fefe621b2764ecf0c519c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615989292, "uuid": "5e3d666f-0f6f-4855-8838-757f656fefaf", "value": "7ED4E03139D29170C073993A0675E5618FADB8722B3885DF738C617B1F36AD01A3BDA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615989292, "uuid": "b11ebf05-92d1-461a-a79e-9c88d6d5f6d4", "value": "1364ce9b1686179e269a4e96e0644010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615989292, "uuid": "05916cac-85a2-4a17-b3c7-ee75e823caf6", "value": "12288:uFaY5n9ONYzWxtSOcRRRkoGTgEjsZfPryT/6b/OodF/8VEe:uD59ONYzitSOigo2slXbPd18VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615989292, "uuid": "af873cfb-91cb-4133-bd57-fa23c13c2670", "value": 600576, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615989292, "uuid": "7dcf8f52-d995-4624-9376-e3f447fb73d5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615989292, "uuid": "4d0504ef-d73c-446c-9682-b911a25bab78", "value": "name1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1f9551-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003575, "uuid": "0762c883-e96b-472c-85d8-7e32ed4f2350", "comment": "Malware payload (Dridex)", "value": "a233acc2021b6e3fdf1da7fc4f9d17a6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003575, "uuid": "e5899c30-a4f5-49d9-8dac-e5e50eb4da1b", "comment": "Malware payload (Dridex)", "value": "9b666215ef64f327ae5c8ae1dcd76b0cb14dd7963ea581b37fc16f0fd97950e1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003575, "uuid": "85b99c4f-ce9f-4491-b8ac-81d3811fd053", "comment": "Malware payload (Dridex)", "value": "8dbd846e07ceb043e452aeb3d3703e5ec14d1e75", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003575, "uuid": "678f1d88-073e-4d0c-ab17-d313b7d1ee5f", "comment": "Malware payload (Dridex)", "value": "6e59fad502392996ae265462d2c1796fd7c0bb0dbf03854feed089f4c10a5f5ad5c5e2f8f763c68555936f09f239b7f8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003575, "uuid": "b764fbdc-6654-4c39-ab8c-e89fab82fb9a", "value": "2524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003575, "uuid": "4de24f5b-8299-460b-b93e-124be7fee342", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003575, "uuid": "0af9fa3a-bcff-4cf3-9226-60d1ffdf7ccd", "value": "3072:t9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:t9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003575, "uuid": "d9ed3463-4f9d-4071-a952-2f3f1ebbf2b2", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003575, "uuid": "5634ce7d-a309-4eec-b33e-1e1d2858224a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003575, "uuid": "8c45158c-5b93-4d61-9b92-f2cb40b58874", "value": "9b666215ef64f327ae5c8ae1dcd76b0cb14dd7963ea581b37fc16f0fd97950e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875d7d03-8757-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009556, "uuid": "04e8ec43-c186-49ef-80b2-bfb7b586ff50", "comment": "Malware payload (Dridex)", "value": "96e2ac91a4deec3ef7171cade9ad1ff3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009556, "uuid": "6d98bfd1-2b85-48b3-a964-40e40dc12923", "comment": "Malware payload (Dridex)", "value": "9b75258f70d5a92551280c529664aadacfe6fe7e574f3e3932c84eb4c8cbc6ad", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009556, "uuid": "67d87113-7194-4263-9bfd-bc44e09ae7ce", "comment": "Malware payload (Dridex)", "value": "cc5c091186afc12dd3b0be22fe0dd7515b2015ab", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009556, "uuid": "fe05ae11-ee6d-4a9f-a978-ff8dd276a918", "comment": "Malware payload (Dridex)", "value": "2cf3ae5c5165d8266e44bab68109c8a243b1eae71862f19e2597b42972ec265f9d9076e84e1ac88312180e7f0dba8232", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009556, "uuid": "0995815f-3dd4-4f7a-8c86-a481ba53ac32", "value": "6C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009556, "uuid": "2865adc6-3028-4ac1-8316-bb40876f0bc1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009556, "uuid": "a2d48064-8984-4a49-a472-ce0ab5ddc187", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009556, "uuid": "8cc7abe0-8e15-46f1-ac5a-97f27e139bad", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009556, "uuid": "cc69ea92-8c76-4624-ab46-1585f66496e8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009556, "uuid": "67498c03-84d7-4e87-b2ed-2a996ce0228e", "value": "9b75258f70d5a92551280c529664aadacfe6fe7e574f3e3932c84eb4c8cbc6ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d8494e-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "7c0993e8-c01a-4dce-9a5f-62b29e9a9793", "comment": "Malware payload (Dridex)", "value": "7edd5920e2aae353f384f916e997395c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "50509470-e552-48bf-86a1-cc00f5cfe619", "comment": "Malware payload (Dridex)", "value": "9c5d6667b710b0d581c4bcd2589e5220ad42fc3fa4a13f0341a47eec9f2f4ab6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "b12ad4fe-6d79-458f-a37e-c8b0a145b921", "comment": "Malware payload (Dridex)", "value": "728b0dc3e437ddfb8ed0e5588b398a72b6cc3992", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004084, "uuid": "6a671245-b61b-4e01-affe-3f1a39da6b48", "comment": "Malware payload (Dridex)", "value": "7ce5337a6446e8cd10b8c7be5a5ea63b528d27b832c9f805b8f70be5f018483597f930741ce605cbfa1ba5b955c6ec2e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "26cb31e4-e852-488d-9216-9d6555988cce", "value": "6824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "f8787193-e0fd-46a9-a70f-d2866e5cd169", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "cc0cf6cc-165d-47b3-8505-4f723259e713", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004084, "uuid": "7cad745f-9f4e-4898-8827-9675c9699d60", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004084, "uuid": "aedd634f-6acd-4b96-a6c1-22f0decfa7ee", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004084, "uuid": "0f557082-5bc3-4c72-8694-4ef7ed028265", "value": "9c5d6667b710b0d581c4bcd2589e5220ad42fc3fa4a13f0341a47eec9f2f4ab6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843f2971-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003538, "uuid": "eb063dcb-0fec-450f-89ce-fcbe3d00d1a3", "comment": "Malware payload (Dridex)", "value": "eeab5e8cfe37cbcc76b658f1f5b4bbeb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003538, "uuid": "8da0a032-f1fb-4594-a307-8f0d98ce51dd", "comment": "Malware payload (Dridex)", "value": "9da571670028f659482ea0d5fc38164a3f7b01042ec8577d1cd8dd0cf08ce2dc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003538, "uuid": "d242f914-b402-4f4c-b94f-3c7ca92922a4", "comment": "Malware payload (Dridex)", "value": "a6d4d3000ad0653309804c6f9dc5a41df810ef43", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003538, "uuid": "2f9be555-c165-4486-bc89-84ca0874420d", "comment": "Malware payload (Dridex)", "value": "43ef7d0cee58eb03acdde51824c17e85b965d22ecafc9138fd2237b3ba645d60ce920904d02399bd991ededbf2232c2a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003538, "uuid": "d3b3076c-e573-4850-827a-7dc080fcd949", "value": "D524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003538, "uuid": "ae00ada6-9364-4a25-a337-7e8c502d05d6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003538, "uuid": "de0678ea-0d39-4e7d-906c-5f14aef477de", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003538, "uuid": "133031d2-c417-41bc-856e-9c6650868fef", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003538, "uuid": "969249a6-406d-4029-a838-ee0b0be7e8ab", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003538, "uuid": "bcbf0727-91f2-403c-9779-fff99c236192", "value": "9da571670028f659482ea0d5fc38164a3f7b01042ec8577d1cd8dd0cf08ce2dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4217a3b7-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003857, "uuid": "835f5313-3d6d-4c4e-a48b-793990e3a929", "comment": "Malware payload (Dridex)", "value": "caf9ccfeaf41e08e7e5eacc139b5993e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003857, "uuid": "2492ac2c-d49d-41c9-86a1-46dd71751405", "comment": "Malware payload (Dridex)", "value": "9df0c7ff0547d167b41fed01ca6e368887755c615ccec85a8c8042e8891902d7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003857, "uuid": "9bb7afdd-7314-40f9-be3f-f1641f107991", "comment": "Malware payload (Dridex)", "value": "e3c0e89a93ee466a921ca41967eada5826f1f70c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003857, "uuid": "d302938c-0b92-44e3-9549-2a7e89c27b57", "comment": "Malware payload (Dridex)", "value": "21403a770a2ceaddd60b5075d854c0e96ae7d03885ea5da533f0ad5bc6d193cd970d6a4c41b6f9342467f15733d377cf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003857, "uuid": "5bbf3a00-804f-44a2-a750-94fbc5ad5a59", "value": "0224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003857, "uuid": "b6ef3ce5-d6f8-45f5-9812-56a59ecdc011", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003857, "uuid": "5a2567b7-18e4-4560-ae4f-a7e9867c0000", "value": "3072:M9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:M9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003857, "uuid": "f55d7e23-86da-4f40-bb38-a68ce278395a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003857, "uuid": "b4c812e4-6c49-4e46-b163-ea98d158d27b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003857, "uuid": "dc1b5e90-590e-4be1-8fcb-e5be403b13fc", "value": "9df0c7ff0547d167b41fed01ca6e368887755c615ccec85a8c8042e8891902d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acbc9ca0-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004036, "uuid": "ce0b1a3c-801f-4d6d-a365-c5061bda91b7", "comment": "Malware payload (Dridex)", "value": "8dcc27b4885a33947039422d613cf513", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004036, "uuid": "d14c493b-15e3-4be9-8e2c-29e8396234ca", "comment": "Malware payload (Dridex)", "value": "9e261389cccce6f48d94ba226cd55c53bc3cd76e9d9c236cf03b3288fbcf53f1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004036, "uuid": "80f44e67-68dd-4c5e-9388-6dfb105c1a75", "comment": "Malware payload (Dridex)", "value": "0f80502e95b0c5096029df688722751e2ac75dec", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004036, "uuid": "d6b0e23c-3a96-42b5-9b47-8403d704fd34", "comment": "Malware payload (Dridex)", "value": "ea0cc28aa27534022a4e1fcb611225656bcfc70b187c3a34ff06a2b99fbe1eff3f3e08b8ab97309e596770a08e8e3d31", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004036, "uuid": "9114958d-97e8-4c5c-8f67-0f593d19482e", "value": "8D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004036, "uuid": "0d6aaf56-0a48-42db-95d6-bc14e8eb29fc", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004036, "uuid": "f99fbe89-f87e-44eb-b093-09f7604f7066", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004036, "uuid": "b5cde3b3-d21a-4b3b-bb0b-42f8867d8982", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004036, "uuid": "e79a42aa-4067-46e7-b539-93648525e5f5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004036, "uuid": "55bf54a3-11b1-4e47-8a12-febbb54a6090", "value": "9e261389cccce6f48d94ba226cd55c53bc3cd76e9d9c236cf03b3288fbcf53f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda3edf3-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615965866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965866, "uuid": "23cce004-d5e0-47f5-bfe2-81ccc624b527", "comment": "Malware payload (AgentTesla)", "value": "6ac860e3c427880aac2716da9e6f9269", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965866, "uuid": "83b27837-0080-4eda-a811-13e28209c235", "comment": "Malware payload (AgentTesla)", "value": "9e28ac65b7ebe4b1dbf9fa6c94b5e5df3fd3847553877aa693a383233a289add", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965866, "uuid": "0db9f5a0-dfd3-4c18-917d-f8305e9ffd5e", "comment": "Malware payload (AgentTesla)", "value": "5e880dd8c85ee2dc9c3e76b6156a3b11cfd19a17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965866, "uuid": "5d313a2e-75aa-4fb1-94eb-45fd914157f3", "comment": "Malware payload (AgentTesla)", "value": "80a2828a7c04c21853cd2e0a66d4bbf26643984000c64c60883d84db1e728d13af8319aaa90e66eb86d52eb2cabc808b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965866, "uuid": "e1cdbed5-a05a-4788-8346-340242eb700c", "value": "EEC4020527B4B71AF13507BA4CB9820127F7F94967B2C2BEAEA5F0CD05A1B04D6F4A35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965866, "uuid": "6f6279f7-d169-477a-9efd-36f2c9c42275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965866, "uuid": "75b9ede7-ae29-41f5-b2e8-8bbf27319c88", "value": "12288:7M110HFPh2psLemfBkV/By9ivpk4sc7KbBlD6V9TMWhOP:7g1I1hQsqmfSnzNi2hM4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965866, "uuid": "8eb84d7b-f3f3-4e4a-bbdf-89c45624e14c", "value": 586752, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965866, "uuid": "534c27b0-2ac8-489b-adb2-9b5fd854ced7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965866, "uuid": "8137f817-2732-469d-93dc-26eecf84bfbb", "value": "6ac860e3c427880aac2716da9e6f9269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66fd2e5-8738-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1615996375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615996375, "uuid": "9d9b196f-501a-493c-b1d5-9e26ca49ab4b", "comment": "Malware payload (RemcosRAT)", "value": "b5bd8d66e3db84f2ab18713465ed4637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615996375, "uuid": "3c95ae49-2872-45ad-ac93-c3e6f2c78e24", "comment": "Malware payload (RemcosRAT)", "value": "9e2f12a9f3c0111297fc6741ed27cd226789500a9aa012a738c524a20ffbc837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615996375, "uuid": "73978cb1-e66e-4148-99bf-aad519b69086", "comment": "Malware payload (RemcosRAT)", "value": "0693385d984a0bfef3f9ac9d5320e9467dc220dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615996375, "uuid": "c7e8c3a9-ae1a-4451-a6fb-3444037b0190", "comment": "Malware payload (RemcosRAT)", "value": "7038b0588e997925c354a02885b65872b1622104d1fbdfef74fa1ac53cf6e905aeb7edce35b99163b807ee022cace201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615996375, "uuid": "007a777a-ab09-42b2-888b-4228734ba6a2", "value": "75E47D61A1A104F2D0535A799C26626844AABE713EB45D4637FC2D0CBFFF7803E2CD96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615996375, "uuid": "b7c4eb3b-604d-42fb-8c97-d629b8bf8f07", "value": "8bf672a41053f2797940aae8ccd5c211", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615996375, "uuid": "7cca8613-dfd9-477a-a2f4-152cddff30c8", "value": "12288:Dcmw61oKvfK189V4k3vymEyhVPznPMP8PGF7a34UWKg:oC1Y189SkKmnEEf3Xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615996375, "uuid": "bf0535df-2151-4e29-831b-200d20b0004a", "value": 714720, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615996375, "uuid": "677918f3-7949-4f3b-bccc-0f3f6e99fdc7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615996375, "uuid": "9c712d01-a27b-46a6-83c9-5041f96e3131", "value": "#20102141 Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7def473-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003598, "uuid": "f62cd2e8-6127-40b0-86d0-8632c2813315", "comment": "Malware payload (Dridex)", "value": "02571cfb65b4258a16ca6990b82436b6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003598, "uuid": "dee4281f-fb7c-4401-a943-06d6f8621482", "comment": "Malware payload (Dridex)", "value": "9e8aac4b68e5ce34757e8faa4f07b3e3eab528f95b38122cb1d3de4781f51881", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003598, "uuid": "220c694f-d151-4f93-80bb-5cd3cfac523b", "comment": "Malware payload (Dridex)", "value": "8d65dd771c4efe39073ba58da6d0522d5e3e236e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003598, "uuid": "d0fa3fe5-6076-4ea9-adf3-d408a34da25c", "comment": "Malware payload (Dridex)", "value": "a7c6f008e3ae645253a1404825fd691e92275eddcbbfd10f0ae5dc605ddb5e72db7c7f219f79288e01c52db91f42b8c2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003598, "uuid": "90e5f636-7b09-4446-ad8f-9bd9c8d9d4e1", "value": "F824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003598, "uuid": "94fda99a-5165-4628-a6e9-7ad869ac58be", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003598, "uuid": "fab2aea3-9352-4071-8022-2970b07e5b3d", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003598, "uuid": "35ff9e23-47f8-4a8f-ac5e-92899bf7603f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003598, "uuid": "2969b422-a831-4462-aef5-93cb1465e6b6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003598, "uuid": "9b4bdc2d-8ba8-4e03-9395-e08ff58573ca", "value": "9e8aac4b68e5ce34757e8faa4f07b3e3eab528f95b38122cb1d3de4781f51881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dbdd9b-8757-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009522, "uuid": "1fce44bb-2586-4ce6-8fef-3ce579144e73", "comment": "Malware payload (Dridex)", "value": "8585fcf490a82ed601b7ecd54c38e549", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009522, "uuid": "37c8ee07-29c6-4ed4-aa08-26b513f5c4ec", "comment": "Malware payload (Dridex)", "value": "9ea73a6ed62709f46241eaa3b25e28d8811415b854d5a11fe08ef7a8d30d463f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009522, "uuid": "cf184fe2-2724-4011-8a72-ef92b71228c8", "comment": "Malware payload (Dridex)", "value": "668f63268fb1a5d432d112ed11a53cf8c6ecfe2e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009522, "uuid": "da1ea147-53ca-47b4-b1f6-a0045a48964a", "comment": "Malware payload (Dridex)", "value": "0f605bfec316d3aa7049ce3adf66e7ece30a68f5ac4f4067ac5afbfa604c06849382e40bcd73e75a17fde79afae154b8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009522, "uuid": "254c1916-f5b9-4330-9f45-c2f06fd0ac73", "value": "D124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009522, "uuid": "f674acd4-8cf3-4aa5-b1c1-9b42faec17ec", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009522, "uuid": "49488236-571f-4416-a736-04473a47ed5b", "value": "3072:49Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:49Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009522, "uuid": "962bc153-5b34-4f18-990e-d45bf685acaa", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009522, "uuid": "0973f61c-fd7a-41f8-a7e3-d1f22e24295f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009522, "uuid": "ca91c52b-a31d-41d5-a51b-ec0889bec9e4", "value": "9ea73a6ed62709f46241eaa3b25e28d8811415b854d5a11fe08ef7a8d30d463f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b825cfb9-8763-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616014792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014792, "uuid": "f58c97a2-98af-4016-9b70-774f54ab4b91", "comment": "Malware payload", "value": "c68395e474088d5339972e2bf5a30f3c", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014792, "uuid": "c05139fa-3ef2-4fea-9b7a-dc74ca4104cb", "comment": "Malware payload", "value": "9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014792, "uuid": "2ed1a03d-6b6a-4a3b-9bd4-e780f0106cd5", "comment": "Malware payload", "value": "502e42240969399c09337ecc7b5ca8fc1ba4baf3", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616014792, "uuid": "9a261f07-f204-49cf-91ed-d16af1df6382", "comment": "Malware payload", "value": "a8906bc4e0ba99748a96fd6f546ac3e75c9109acdefe426734cdbb3d51de0ed3ccb3ae760cb73366bac70167ed8738a8", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014792, "uuid": "49940131-4423-4b40-a230-550f9915d639", "value": "E6C36B1274D19C31D5F2587804E792639B7EB9341BB88DDB57C4262BCEE21C07D39B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014792, "uuid": "fe29ee16-8dc9-4540-9b93-34c3193e82f6", "value": "7bd2e5fa6a60233b32aae2586fd8acda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014792, "uuid": "f72a38ab-671a-447e-95c2-e92893cad424", "value": "1536:j/t3fhrg5rw0lQa2+T37us7RidSkPq9IiJ/EXrAyPca7m94nqHBmQSsWZcdH2kB/:lG55XP0Vq9IiKXrxkKNqHBmEHNVKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616014792, "uuid": "b29f4f81-5f6f-4e3b-9d19-e4dd7e92bf3b", "value": 122368, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616014792, "uuid": "a0eb3c52-3db0-46cf-b48d-165fe7aac5fe", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616014792, "uuid": "6bdf74a3-c3cf-4e6d-a3e8-98fb5100573b", "value": "c68395e474088d5339972e2bf5a30f3c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b730ce1-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004355, "uuid": "a14783e0-771e-4873-8d89-6111cc0b190a", "comment": "Malware payload (Dridex)", "value": "6103a986628db09bcfac0258ee50f85c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004355, "uuid": "387ef804-abce-4f6c-975c-d29e493f325f", "comment": "Malware payload (Dridex)", "value": "9f393c24e2c070a9f9545f4c8f419f9ef31faeeee0ec8ef36d4d4df3a73b752a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004355, "uuid": "05c4ff91-a3ad-4e33-bf3b-797e74bcf10d", "comment": "Malware payload (Dridex)", "value": "f9267ff5d16c7d85e3cb078e4b371629a4510a44", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004355, "uuid": "de89e074-e820-40f9-b6cb-94e60f778a00", "comment": "Malware payload (Dridex)", "value": "b19f0a34712fe01cf8fadcecfd2eab0d3875945aaa14105c474dea50a8d046ac715d3f23b79ff8e1e1f6681024337ee9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004355, "uuid": "02bf33e3-4c7d-47af-9020-1dd4c5926a48", "value": "1A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004355, "uuid": "2703ee80-5d9e-4460-989b-ad993c62e092", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004355, "uuid": "4534ced9-e5c8-4942-b31e-920a189923f4", "value": "3072:g9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:g9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004355, "uuid": "4cc07e68-cc8d-44d9-8534-51c27c187deb", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004355, "uuid": "8a1ddc0a-0fc7-4362-8c58-2f0d2d5bc7e9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004355, "uuid": "5e210be2-4396-4608-8d5a-b234e4f57efe", "value": "9f393c24e2c070a9f9545f4c8f419f9ef31faeeee0ec8ef36d4d4df3a73b752a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af96072-8756-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616009106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009106, "uuid": "d8aa2f5c-9ef5-45cb-9c2a-ae9fd4999a5f", "comment": "Malware payload (Dridex)", "value": "59898a57f10f9b4010ebc67fba6c92d5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009106, "uuid": "1c8fd146-d98a-4d54-bbb2-fb10fe2dcacc", "comment": "Malware payload (Dridex)", "value": "9f6a5b290c1594ddb8f7952fdbd4f0b60d27f12813de7385aa94e01cbdacf091", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009106, "uuid": "700f0d0c-2741-41c9-92d2-0eae2c606313", "comment": "Malware payload (Dridex)", "value": "bf7ad7f9f176bd74d42b5a1385910b0239ed777c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616009106, "uuid": "797acd10-a8fe-4fb2-b3f9-45355328de44", "comment": "Malware payload (Dridex)", "value": "98322a78c5b05e652ea67b0ea8a9ef1faf5fe5017d8c45d0bb141695cd3362e2c191ff0af871740068bffa54775afbb0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009106, "uuid": "c60a6376-01ef-4274-9368-a84977af75e2", "value": "0D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009106, "uuid": "fe7e8cc3-69e3-41ff-8df4-9cd46f56d337", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009106, "uuid": "b1c7faea-2b71-4e69-9472-4b675c533726", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616009106, "uuid": "104b45df-1eac-4c9c-a493-bd39e5bd08be", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616009106, "uuid": "f4458e65-937f-4a80-8011-b3ec881b1c1a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616009106, "uuid": "d5fe6ea8-feaa-404e-9d7c-95b656fe6e9c", "value": "9f6a5b290c1594ddb8f7952fdbd4f0b60d27f12813de7385aa94e01cbdacf091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2349d8c-8760-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616013601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013601, "uuid": "c940be29-1953-42c8-a028-3c160d1633f1", "comment": "Malware payload", "value": "aace722104a998fac786d14eed6efd99", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013601, "uuid": "5247f033-ef72-4f58-b573-43284530e41f", "comment": "Malware payload", "value": "9fe01c7fafbf5b4b4deff283962c07da508aa7c2d3ae622818b403544e8d57f5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013601, "uuid": "32017021-3867-4b68-875d-d2faf7c04386", "comment": "Malware payload", "value": "ea40673bb42f8bc1851656d492f9fb4aadba7d5c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616013601, "uuid": "7dd80454-43da-46de-9ad5-6c471bad1397", "comment": "Malware payload", "value": "aba1bfad34a088df765d23946b32872364df9e43011be783f066a771a17cbc1ae3302952e2284273fec3d41cdb1254cb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013601, "uuid": "3eb36ced-73cb-452b-bf64-7f057a3bd231", "value": "BF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013601, "uuid": "5d7ab60e-dc26-42f5-b0d3-aad471af4621", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013601, "uuid": "ea8111e8-1cc9-4a5d-8371-a501a05535c9", "value": "3072:C9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:C9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616013601, "uuid": "cfb9a9d4-666e-4085-8aae-51573ecae71e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616013601, "uuid": "f94a0bc6-ff1e-460c-bc31-ef62fdd442a6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616013601, "uuid": "f02c2505-00de-40bd-839c-030cf9dcb10b", "value": "9fe01c7fafbf5b4b4deff283962c07da508aa7c2d3ae622818b403544e8d57f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746cceac-86f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615966145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966145, "uuid": "53c1ddb9-7a93-4acd-89a9-e8eb0f453b4e", "comment": "Malware payload", "value": "bf7c56e80af8e2ba7bd09fe4b0c9c633", "object_relation": "md5", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966145, "uuid": "a959a9a2-f777-43ee-9a90-a0a9fd05742e", "comment": "Malware payload", "value": "a02ea9c8255c0992cb9f021fbfca4cbcdec165658a5542d89151ce369cda30c0", "object_relation": "sha256", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966145, "uuid": "3d4eda77-632a-4e69-9e18-67953e44419e", "comment": "Malware payload", "value": "c62bb6c2fd2f85f4a4720ca5aa7af2eb7849bc7f", "object_relation": "sha1", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615966145, "uuid": "741c65e8-03f5-4500-a1c4-78aa66c62a04", "comment": "Malware payload", "value": "9d63281a2484f43ec4832a80fdd349e8223d2d70b7f789c459255c10404f7034a0c4aa6c39accca47b4fb35d19c01980", "object_relation": "sha3-384", "Tag": [ { "name": "bfdnews.xyz", "colour": "#42DD80", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966145, "uuid": "72095de9-330c-42b3-87bd-879d1c0359e9", "value": "F6B3020EE6151DADC639707FA705A8F4650D72A1A852F40B2524FF0579E99F30BAF0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966145, "uuid": "4304bedb-ab9e-4d93-a1d3-0b9d8e3bb190", "value": "3072:+fOYPvsUtFARPULAZemMA5uAgz3xQGaARVnfdCPlf+:+WMFAeErgzBQGVVnfde+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615966145, "uuid": "8396250d-0d2e-4128-a5d1-1d3f6da007df", "value": 116314, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615966145, "uuid": "4a4bb0ca-5fa8-4b73-8587-20780c9f7a01", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615966145, "uuid": "bba2798e-5ce5-4cfe-bab1-010539b5f42c", "value": "a02ea9c8255c0992cb9f021fbfca4cbcdec165658a5542d89151ce369cda30c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d94dfe-86b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615939284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939284, "uuid": "cd18af4d-4274-46a5-a72b-d3af3b72d83e", "comment": "Malware payload (Dridex)", "value": "f7449883818f56ef45c93ff42f888a44", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939284, "uuid": "061c63cd-28e1-41f6-aa4b-30bb18cccd31", "comment": "Malware payload (Dridex)", "value": "a02f4397a836401cdeb0c1460c8b351274b4f4579149c85bef240e110c6ea189", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939284, "uuid": "5b9c140b-21e2-4be5-a84c-8692a7c6068f", "comment": "Malware payload (Dridex)", "value": "76b5cadb7c3f6d2a102d0b857422e9231353722b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615939284, "uuid": "5dbb5e3f-34a9-4c13-a86a-234da910164b", "comment": "Malware payload (Dridex)", "value": "42be7538271f4f5490108294103afa153689e30a2497556dd1d96727310e46e3fd6670bd82dd5b7cb3f7e6b429f07145", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939284, "uuid": "0298671c-63cd-4f21-9d6c-485d36b7b723", "value": "7714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939284, "uuid": "6017a290-af22-475d-9d3f-441f5b536924", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939284, "uuid": "52244235-35e7-44e2-99a0-057f7383a4a2", "value": "3072:71i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:5i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615939284, "uuid": "df68ccec-88a5-4d85-a736-d5acd86a98a1", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615939284, "uuid": "2a075794-d186-44d1-84fe-cb7efa0da167", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615939284, "uuid": "5a5dfa21-6eba-4698-88da-69074ab22840", "value": "a02f4397a836401cdeb0c1460c8b351274b4f4579149c85bef240e110c6ea189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fc8c71-86f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1615965591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965591, "uuid": "b0497ba1-8233-4ec8-9452-96c132703510", "comment": "Malware payload (Dridex)", "value": "582949572efb06e2474feb1294fea5a1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965591, "uuid": "099d1c46-3457-43a0-88e1-d6035a47ec72", "comment": "Malware payload (Dridex)", "value": "a03426312569e569320a45051c4a29810c24dbebb1c423f30b857c9a62eb9e72", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965591, "uuid": "75b2c8f7-e8b4-4e2d-b75a-2f524781a036", "comment": "Malware payload (Dridex)", "value": "4c02643fbe09280d54976ce23d6aa1994404cde2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615965591, "uuid": "48a483c3-d313-4c47-935b-9d9cebec5f96", "comment": "Malware payload (Dridex)", "value": "79b7b3707b4db54b93880ceeeed44011f68edd43bd8cf262e8986babac72e5f553adaea738c1ad70987f00c5d0e32375", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965591, "uuid": "0b4e16d2-915f-45bd-b059-8a6b82418519", "value": "6914BEDCD376F186FFD3CEF09519935656232D42861FE0A9A9C6A83F82BF90C045618E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965591, "uuid": "eb8576db-aa20-40b3-b269-a5e1d509df39", "value": "554e238e1840919675ea2a74968f15ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965591, "uuid": "6750d9ab-9461-45d8-a823-6d27ca9e35f7", "value": "3072:7Tcr3VWYFcXTNZEjmL18zM7cXzAMsT7bXsObx7UpYN4IO6KMZJpSx:7TMFWYYTNKjmLyg7ozALzXsONUhIl/Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615965591, "uuid": "729040e7-9986-483a-8631-d62c116bd813", "value": 196608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615965591, "uuid": "d3521414-d955-46fa-8a25-891e88648dae", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615965591, "uuid": "c2e31798-6a28-4d6e-b558-f98b30946a6a", "value": "a03426312569e569320a45051c4a29810c24dbebb1c423f30b857c9a62eb9e72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0c3b1d-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004227, "uuid": "30174315-4e3d-4e5a-b450-a81ceb77b50a", "comment": "Malware payload (Dridex)", "value": "45ef273288542e4bc743c94291546d8c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004227, "uuid": "7882b9c7-795c-49bd-a9f6-d31bd8e2ae92", "comment": "Malware payload (Dridex)", "value": "a086fd922514ef20979b6a686cbf412343e42120722e11f9911b5cf1192ca7d5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004227, "uuid": "ea6c5bf9-9c2c-4466-94c1-f1af63e59d22", "comment": "Malware payload (Dridex)", "value": "311a07519f9aad5618d9304e528f49be35564bc1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004227, "uuid": "7f9b8f16-1043-46f4-a234-12302798ee70", "comment": "Malware payload (Dridex)", "value": "c71f1228f2e768d8478449744ec046f1fcbe27e8255e066131066dbc6d3a7836e6b51aabd95a640a1c164d7100f230f6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004227, "uuid": "bc8f0b3c-d7d0-464c-bd7c-f3d44e1479dc", "value": "9C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004227, "uuid": "cb1cf070-32c7-4b82-96af-6e3711d137c0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004227, "uuid": "a5f870b1-1cc0-4fde-99f0-d42a9f6360f7", "value": "3072:k9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:k9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004227, "uuid": "23c3f94c-887d-4e1f-8149-207754aba167", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004227, "uuid": "e9f92447-d513-47ed-bc15-a2ecdcb8d145", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004227, "uuid": "de947a0f-fb8d-4eec-a84a-fcfdf1c1c770", "value": "a086fd922514ef20979b6a686cbf412343e42120722e11f9911b5cf1192ca7d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b8a394-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003806, "uuid": "312b3def-ff7e-458e-83f7-b785cf3d7d3f", "comment": "Malware payload (Dridex)", "value": "cb09b4e580317856bcb8393b25fef285", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003806, "uuid": "238c7449-5a34-4fb4-a25b-4c6cd22efe36", "comment": "Malware payload (Dridex)", "value": "a0d0b43504fb7031664e10beaa33772e423a67837d3d2a5579a7768cd2c26562", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003806, "uuid": "1728755d-6277-4713-8462-1014feed2920", "comment": "Malware payload (Dridex)", "value": "b729204e2b6890c4262205de1e5adbb5c85dbad6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003806, "uuid": "4e6fa17a-efa7-431f-8390-5fea6723ea73", "comment": "Malware payload (Dridex)", "value": "f4e9e07559945541bde39054f8895de9e9ad8d68b5492e80ba14cd310d2c776abdbffee00977c03c7901cd711f4d176a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003806, "uuid": "2b89eed8-fad8-45f7-aef2-d5593c4c3131", "value": "8324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003806, "uuid": "c978d1f9-ad21-46d0-8343-d08f8a613cb0", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003806, "uuid": "0a3b9e82-d1a6-4c77-aaaa-2ddf6eb0e06d", "value": "3072:39Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:39Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003806, "uuid": "053bddee-bfa7-4bf2-8b12-d15a04b79c81", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003806, "uuid": "41b05f9b-c624-4497-ba56-847da79dd6e8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003806, "uuid": "1b439802-79a3-493d-a25e-e52c65f56747", "value": "a0d0b43504fb7031664e10beaa33772e423a67837d3d2a5579a7768cd2c26562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce0133f-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017377, "uuid": "89c86914-cc0e-445a-9a80-0a0fabf1a0ee", "comment": "Malware payload", "value": "bd957a3c48fa8927e1d7da83cee2866f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017377, "uuid": "642972c9-3980-4ea1-ac22-ff23c47d4a2a", "comment": "Malware payload", "value": "a0e4ae0c214cae327df416e64b1bedca1e15aa1d2ddd0f5885d03b0a144a2bf0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017377, "uuid": "8d6b880b-1073-4c04-8b6b-f8115df60e95", "comment": "Malware payload", "value": "9860cf9b0aa9b4e4b6e395b862a05ae95e25c7fc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017377, "uuid": "6938c173-160c-41aa-9475-0ddced71b96a", "comment": "Malware payload", "value": "74fb938901ced916d76c5db61187f6b747a6550a00a6b907b77554f7689115c5b1e8adbf5e0a6bbbab2c267a28a57f03", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017377, "uuid": "4dcded05-9bbe-4999-9241-a87128a9a180", "value": "1E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017377, "uuid": "1bff14db-98fc-489a-93f1-b52ab7a0ff8e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017377, "uuid": "c1e84fc6-6078-4b7c-80f9-ec41d13f280d", "value": "3072:B9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:B9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017377, "uuid": "dd05ea27-de3e-42aa-a3af-cf661de67b9d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017377, "uuid": "e185a79f-f30a-4d9f-819e-b365f6d2ca39", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017377, "uuid": "826ebe40-91d9-43a2-86d3-f14533f63d5c", "value": "a0e4ae0c214cae327df416e64b1bedca1e15aa1d2ddd0f5885d03b0a144a2bf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911f21b2-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001842, "uuid": "dd5119ab-5f6e-4411-b053-d79bcc57a898", "comment": "Malware payload (Dridex)", "value": "bc0c7aaabdd912eadb63c040c177f49e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001842, "uuid": "c3c54e37-52f1-404f-8c17-3b9795a9449e", "comment": "Malware payload (Dridex)", "value": "a0fbc7b62ef48fd800f033ed8f4a50256da1e1f411eb6a9a81f7bc5dbc6c373c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001842, "uuid": "a49ea3f4-c86e-42a1-b501-35c8f1e6063a", "comment": "Malware payload (Dridex)", "value": "2018ccc4887b6cc19cafb80f9c1f6caa1ca32908", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001842, "uuid": "6f8d1708-08ca-430d-9dda-f99a5e7ea582", "comment": "Malware payload (Dridex)", "value": "8213c4cab3b37d22ae79571c23d8993367dc56bf3a566a658ab8581bb99d72cc88f5f81180055807f0e38cc9177a62df", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001842, "uuid": "6bfea8c0-a761-4043-8957-df88d8525d6d", "value": "4024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001842, "uuid": "726ba20e-db74-495c-ae59-623711fa8f3c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001842, "uuid": "35878e4f-c501-4abe-aafe-28e8b15066c9", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001842, "uuid": "1f841413-7d50-4426-abcb-5754dce96a1f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001842, "uuid": "7dd9e022-10c2-449c-aa4b-8152202ba491", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001842, "uuid": "3ee66f8e-af35-476c-bf13-4de7e983c65e", "value": "a0fbc7b62ef48fd800f033ed8f4a50256da1e1f411eb6a9a81f7bc5dbc6c373c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0156f981-8767-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616016203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016203, "uuid": "16938ea9-acea-491d-98a8-7225bfd583db", "comment": "Malware payload (Dridex)", "value": "e6c11c3ceb841791077cd13910dec1f4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016203, "uuid": "3a86bc17-fe3b-4ee4-89ec-c29bace0c74b", "comment": "Malware payload (Dridex)", "value": "a1241e46e0a3a71406d3cee95b24ea03f5ae972bf434f906d56dbc9e626e3102", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016203, "uuid": "528be9e0-a58d-4f0e-83fd-644f397d9fb6", "comment": "Malware payload (Dridex)", "value": "e36d0b35a39ac25061aed91e756c02e419d3a14b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616016203, "uuid": "ac4b1ec3-c8a2-40d4-9eef-8d28f8a8caa7", "comment": "Malware payload (Dridex)", "value": "16d60098b877f6d1e191415a2ee2255853a53a40c2cfed3bbfc09107e9b1a0da9d5352ea21dadf68dae045b666585717", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016203, "uuid": "529db0dc-1826-4f1e-9209-0014c749c194", "value": "0D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016203, "uuid": "5b40aa09-3b23-49fd-9ad8-1f4ad59d2685", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016203, "uuid": "3b24151a-3b69-4a5e-9dd9-0f39a76f89e9", "value": "3072:c9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:c9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616016203, "uuid": "f9966ec2-7428-4f21-a71b-d804d50fd1fd", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616016203, "uuid": "860129b9-ecf7-49be-ae93-2bbb7470d285", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616016203, "uuid": "590acd0d-d02e-4f48-a17a-d9bb59cad407", "value": "a1241e46e0a3a71406d3cee95b24ea03f5ae972bf434f906d56dbc9e626e3102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482a81fc-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001719, "uuid": "81a20f76-97e2-4348-9582-820ccdb41f1b", "comment": "Malware payload (Dridex)", "value": "fc48b33be31cf0d55ab900dad374073a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001719, "uuid": "f3a8b46c-fafd-4928-8b69-38a12ea6fc1a", "comment": "Malware payload (Dridex)", "value": "a143a974ca414014ff2c4e58def3900ab2411797dcebf8608dc0a1ea72a09d85", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001719, "uuid": "129ab281-7251-4be6-82bf-ce5c40709eb2", "comment": "Malware payload (Dridex)", "value": "e328934c91a93c77e09b3d7115f3b3a58192e776", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001719, "uuid": "ae084800-cbdf-4ee3-95cc-05ef39790c82", "comment": "Malware payload (Dridex)", "value": "cde9880ebfbf57766e1a87f4e0ed7f93338ff36a079f5c9fd6f228475b4c4ea1f4d3c5b065889e112dac597781b654c3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001719, "uuid": "5b39fe29-b00e-433c-aa51-2b23a249f013", "value": "EF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001719, "uuid": "9d9b58f8-f8e7-4c50-818a-3378b495162f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001719, "uuid": "6bac713c-0ce2-4253-bdf4-2f02cfcef323", "value": "3072:89Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:89Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001719, "uuid": "9f2dd402-51d5-43f8-b9f6-7cd9cf580af9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001719, "uuid": "1d14ed0a-5d48-4abb-ad67-4062309471be", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001719, "uuid": "430b26b5-a584-43f1-b053-da50d7e46c53", "value": "a143a974ca414014ff2c4e58def3900ab2411797dcebf8608dc0a1ea72a09d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1554e9ab-874b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616004211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004211, "uuid": "b55b3319-5f68-4e77-b9cc-cc37123024c2", "comment": "Malware payload (Dridex)", "value": "dc503804e9068d692ebbccbb103c1370", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004211, "uuid": "373e453d-1cf9-44b9-98bd-4184486bda00", "comment": "Malware payload (Dridex)", "value": "a16b002a0e8c89f4235cc75db77343e1055ab77c939dc68cef9ccb6ce2e993de", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004211, "uuid": "216dc784-eb59-47f8-af4a-4fc5bb5a4426", "comment": "Malware payload (Dridex)", "value": "032da099d8d533daa9614385ff853e563d77626e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616004211, "uuid": "99fa5ab4-7a83-4b68-a4db-a28cea548272", "comment": "Malware payload (Dridex)", "value": "4dfc3419613a7addad0770d70289105241ec980b8266b26cbad133b9eec37353c80fd35931bd9778f82aee5d8a8ec36f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004211, "uuid": "eac9705f-b3c7-4f7d-9886-5f58774de97c", "value": "DF24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004211, "uuid": "c1ae0408-6421-443f-a17e-a37322ddaffe", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004211, "uuid": "1c5f7364-1c1b-4f96-96a3-63e01aca6476", "value": "3072:y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616004211, "uuid": "9c234eef-fe9f-4c29-ae71-7dd4cf4a226a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616004211, "uuid": "0abaa565-8f99-4672-9505-1951171a0af4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616004211, "uuid": "b6a49c6e-374c-4813-9014-c35e1d104355", "value": "a16b002a0e8c89f4235cc75db77343e1055ab77c939dc68cef9ccb6ce2e993de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52121804-8754-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008178, "uuid": "7f4c2184-7987-4c7e-818b-f1b2e274f653", "comment": "Malware payload (Dridex)", "value": "ca96903f8a7ed6610e9dd479ab182f3b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008178, "uuid": "fec6108d-5bab-4332-89b2-fe2a6ee6c7d8", "comment": "Malware payload (Dridex)", "value": "a1d70b59892747fc87d8ac565ca3231e6928c80745fa33fc84b4572fd9c8884d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008178, "uuid": "c2f7c248-aa49-422e-8c76-699875cb105e", "comment": "Malware payload (Dridex)", "value": "7f0b0d6b6357d71c386941dc97d9f08e1930c0b8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008178, "uuid": "bf3114b5-5a95-4bce-94bd-3b5f7159bf0f", "comment": "Malware payload (Dridex)", "value": "a9a92e1eff98b16c0b1e927f8c5a0c16b84c4eb7f4cea09140f94ced39bdab74aac8a5ce71ebec83eb5d4b1df568a9da", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008178, "uuid": "82a5d7c2-7326-4d14-93ac-1c59319297eb", "value": "E224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008178, "uuid": "b6248edd-8e37-49f0-9a69-e5c930c95fb5", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008178, "uuid": "379fe08c-b5b6-403d-b5cb-571e15bddcd2", "value": "3072:59Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:59Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008178, "uuid": "341e9737-7445-41a4-91dd-4389ef19896b", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008178, "uuid": "a6ff7f34-5ea7-465a-8d3e-9da18b6f978a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008178, "uuid": "bb32c5ce-8c27-49fe-bddc-cda0c2d5f042", "value": "a1d70b59892747fc87d8ac565ca3231e6928c80745fa33fc84b4572fd9c8884d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d28c367-8755-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616008734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008734, "uuid": "1a7e1c7e-d32e-41f5-804b-985d24e4e41b", "comment": "Malware payload (Dridex)", "value": "1d055000079e09885050b981f373c7c9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008734, "uuid": "d08371eb-0ced-43e5-8393-e62bd6dd0d5e", "comment": "Malware payload (Dridex)", "value": "a29f7d00a308301728ca34d5101205631ad3be4c88d5ae6eff1702bbb81e7501", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008734, "uuid": "55a80f9e-364c-4245-a537-d3600c014afc", "comment": "Malware payload (Dridex)", "value": "0811a8709d35547d4d4be6c5986a8a5452a1cac8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616008734, "uuid": "18f0f203-1003-4e2e-9c85-fbe4b98e8bf2", "comment": "Malware payload (Dridex)", "value": "a8e2925bc7019479b5c0fa5a880e164aaa67746208d3d31c1527a8692326a2f18cc4f498a3e573f34b8dba1f8fca605e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008734, "uuid": "54b4d1bd-e404-43b8-bad3-2070181ea449", "value": "D924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008734, "uuid": "345c2250-3c74-4b22-99a7-03d2f5617665", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008734, "uuid": "0746888c-be63-4b37-b502-081adb4a3962", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616008734, "uuid": "6af5c2d5-71e9-403a-bdcb-a53948d24fd4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616008734, "uuid": "706bf1d5-395a-4730-a746-b2060ac2ecfc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616008734, "uuid": "d35592da-0cfb-4e53-9ced-996b03621c84", "value": "a29f7d00a308301728ca34d5101205631ad3be4c88d5ae6eff1702bbb81e7501", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5c2225-8749-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003736, "uuid": "df5ce58e-ff7b-48bf-8623-9f7e670d9e0b", "comment": "Malware payload (Dridex)", "value": "ddd07a0005ec5ade58dfdb1316d20d3b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003736, "uuid": "d0514fed-0ee9-4319-996a-2e0d85f79723", "comment": "Malware payload (Dridex)", "value": "a29fdba68506d979271aaf5a21f2251fe759391b9c623b5dd586211f6e5a8b4e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003736, "uuid": "3fa22a3a-9a51-481c-b44f-e9ee3743b503", "comment": "Malware payload (Dridex)", "value": "2df8a1dc6b7c4eb153b14d595c34f4b9d9d38bfe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003736, "uuid": "7242d2be-ec1c-427a-8ca0-239590163e61", "comment": "Malware payload (Dridex)", "value": "793f31191f713be53c839e65729ee7ffa82d35b10cde082ec7346c3d0e8fd78155c9d311f2d96264f273af54d7f943f8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003736, "uuid": "6b9b337c-e448-4888-978b-cba307f56e76", "value": "A624CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003736, "uuid": "f02e3f00-19c6-4280-9345-95f849b92f40", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003736, "uuid": "e7f8ffe8-785b-4783-84b7-58a8f6c94f71", "value": "3072:Z9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Z9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003736, "uuid": "7e0c75fe-8854-4956-abc7-aa6f5b084e43", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003736, "uuid": "a3e1c642-df3f-4438-9f27-84eea39740df", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003736, "uuid": "4899683f-a652-4859-8d92-26090f8425e1", "value": "a29fdba68506d979271aaf5a21f2251fe759391b9c623b5dd586211f6e5a8b4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487d42ca-8765-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616015464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015464, "uuid": "96b2a9e0-c3e3-44d4-aa42-06b3b9128be1", "comment": "Malware payload (Dridex)", "value": "defcfc0b961b79578c572a7973c0838a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015464, "uuid": "056adbdb-1b0e-4a34-b6d8-80e5005181de", "comment": "Malware payload (Dridex)", "value": "a2b0a4913878735a3ceb46adf3fd4296de090b6beecd959e297da16c1d959406", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015464, "uuid": "b129a236-e3ec-4732-9737-b5d074e2646d", "comment": "Malware payload (Dridex)", "value": "4ccbc673f39d6bf1c5b664f758eb77f537252a4e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616015464, "uuid": "7f01b970-d7f7-44de-a4e3-a73aceb92163", "comment": "Malware payload (Dridex)", "value": "87a53412ca50e22e88f59465bf6ef6dccffe281f673eea89974877ec7eee1cb14f4124b3bded3935131aba68319d271b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015464, "uuid": "7fbab7df-14c0-4cfb-bc9c-bf13b269910d", "value": "1C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015464, "uuid": "15602c9c-0b85-4e91-a55a-690c52dcf17f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015464, "uuid": "502fded1-2680-4092-98d5-2e7152f003ca", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616015464, "uuid": "82a1faba-03c1-4d6b-b5bc-bb359c1796f4", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616015464, "uuid": "6265d2f7-26c1-44f0-aceb-4b5ec4128f0b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616015464, "uuid": "768da7d9-1f86-48b1-ab1e-e6ebba8e89de", "value": "a2b0a4913878735a3ceb46adf3fd4296de090b6beecd959e297da16c1d959406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d60bdd-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616001930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001930, "uuid": "e30ae4e1-15b9-4e81-a787-498c38f6ccf3", "comment": "Malware payload", "value": "7fcc3c96ae6363acb13bdd87bfbc5eaa", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001930, "uuid": "e3a5969f-b337-4c5b-916f-d58f91430030", "comment": "Malware payload", "value": "a42a338e82286545ff7542d7c435f9e7e63eb29f004d91466cf32fc56fa15ceb", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001930, "uuid": "574a3761-7667-47bf-b17e-a3e1c5a2ce2b", "comment": "Malware payload", "value": "eb2a3095eee723981d7e62b9c785a4636bd87236", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001930, "uuid": "2240d016-a268-4289-994d-beed6f012bd6", "comment": "Malware payload", "value": "788c0720d737599660fe7c24d6a04d7486dfdb717638789128f70b595a60aadc1143a9ac22b812cadb3489a7f9cf3de4", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001930, "uuid": "d3de22cb-1cb8-4722-b3d6-94391314c068", "value": "5B0412C168317BA5E6A5DC0D45F93BFE9BC62993ED890FD448395201FAEC4E8C792350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001930, "uuid": "17f45f08-a8ad-476c-be7c-15a2a7fd149d", "value": "3072:gRkNYd8DUauOny6py7MI5uV70YkI7EzUBqFdzSZcYeoHLckU8N39bSxLOW/Ik:gIYsU2yLF0ebdzSveQBb9bXKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001930, "uuid": "02cc4ffa-da81-41c2-86a5-34f9c8f07516", "value": 176371, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001930, "uuid": "b608a802-cc84-4954-a84d-d480dc334678", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001930, "uuid": "ec0bd054-15b6-43bb-a04b-8f5a9667161b", "value": "Proof of Payment.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5620bb7b-86f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Poullight)", "timestamp": 1615968671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968671, "uuid": "49661820-d8f1-40c8-92c8-b7dec5615a0f", "comment": "Malware payload (Poullight)", "value": "45759d997c2bfdbc3a9fa7e869c50b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968671, "uuid": "acb77629-07df-440d-b484-7aa331bc2a00", "comment": "Malware payload (Poullight)", "value": "a43bdcb235827c92183c0bf3d5dc6700e21cfdfaadeaa115868281a2f7935980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968671, "uuid": "de0647f1-d0ff-4976-93f3-a9489d916070", "comment": "Malware payload (Poullight)", "value": "0f7f0503d5c120ad5acac2f16a6ccf1cf50e889b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615968671, "uuid": "4690e134-4b11-4217-a9db-f0c1acf50419", "comment": "Malware payload (Poullight)", "value": "d39e4b083de0a5a9c09c065a224f93625f0af8fdbe6e097c777dce9c5bfad1b945c04b731813d77a8da342371e69ec82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Poullight", "colour": "#1E4B52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968671, "uuid": "a301883a-578d-42c5-b0ec-ba8327966acd", "value": "83155FD3DCC36CA08701BB9566F8D3FA0A23B27B10ACE63D5B055BA21783594A197F74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968671, "uuid": "ddd45a9d-805d-4286-9e43-e21500ae3516", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968671, "uuid": "85d5ba3c-4eaf-4e76-9f2b-629d5b45c04a", "value": "768:zB14qJ3W8z9FGMoKvebbG43nl1qQenUTGR9a+YxxplxjiBRBMec47CGtXrqhq2mn:T4S3W8zti32LniGBvzS34UfNS34Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615968671, "uuid": "fc4c37c6-d73c-47c9-b011-b1c4d2b1a32e", "value": 960816, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615968671, "uuid": "7dacc0ea-8005-4c93-bc72-801fe288cff2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615968671, "uuid": "d25ef5db-efa9-4098-8a07-148372ca4d25", "value": "45759d997c2bfdbc3a9fa7e869c50b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146d6d5c-86eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615962978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962978, "uuid": "4e248d67-58a3-470f-9193-a49520e93eff", "comment": "Malware payload", "value": "73181e114d512259ffe4fde67aed888b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962978, "uuid": "4e83831b-ed47-418e-97f8-c78ca3707f95", "comment": "Malware payload", "value": "a48049a1e33a52d28ead6671c52e4c4f1ad24de982761ca4a0c3964e88fa5abb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962978, "uuid": "d279454b-8fdb-4b3a-a0d2-c75f80870735", "comment": "Malware payload", "value": "b8a1523fc8980fe1ebe676f0ab872794d4c7e385", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615962978, "uuid": "3b1302bb-a084-4c64-953b-056848caea51", "comment": "Malware payload", "value": "4d67e4a7881400780c6b6a350f674556762e865ce2db286f316000d447f67c7395cdca4e6f5bf004340f8121a4298c44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962978, "uuid": "f47c8e70-d943-4f49-aac5-a3ba2fd5523a", "value": "5D7423DF83E268D3D5BF6206C6909A3A562134C742360D5E87B124473F8D662A8FC67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962978, "uuid": "89912736-ba5f-43a1-b110-52249f5b576f", "value": "6144:hk1jhaFqUw8JBJMUevsbuOCmr52iflC4rxBtms3i1yhQLLScVPl:hkiFqjkCZvsbu7mrEifsixB5y1BLScpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615962978, "uuid": "defcfa4e-278b-4917-ac73-34a0f84c5f33", "value": 368439, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615962978, "uuid": "d08594cb-1d63-4a3d-8eea-d01804a9c55e", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615962978, "uuid": "9ed06b03-6ea4-49ae-a796-bbd4f3040f70", "value": "\u00fcr\u00fcn sipari\u015fi pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2545b9f4-874a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616003808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003808, "uuid": "c1cad072-b90b-457a-a423-dee52efb2692", "comment": "Malware payload (Dridex)", "value": "cb1a3cec5e7c93a0a8554ec747964bdc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003808, "uuid": "66aeb752-42fa-47f2-b01f-876775df6e47", "comment": "Malware payload (Dridex)", "value": "a49703f762f53da40fa4def283f4b5af6c2fdfe8673c51ce91c161f4c9ee98f2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003808, "uuid": "5a87f512-eab5-46d5-91b8-a017ef845896", "comment": "Malware payload (Dridex)", "value": "68c8acf52072703b19078db69da698495ccdca2f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616003808, "uuid": "7d8f0c53-2c35-4885-b688-796fee9c3e72", "comment": "Malware payload (Dridex)", "value": "ed8b2ba4ad11c4730546c9e56ee12f7fd51d7881c81a86cf40a94439c67b0e841492d99a513551ce0647b50a2f5cab7e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003808, "uuid": "1c34a383-2019-45ea-9d9b-6ac66efa496c", "value": "DA24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003808, "uuid": "ab75fc2e-f162-44bf-b452-bdad4ce92dba", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003808, "uuid": "2c54d667-9f75-4beb-a7dc-02da2b467e34", "value": "3072:R9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:R9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616003808, "uuid": "3c3e25ff-445d-467f-bdee-87e4ac3837a8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616003808, "uuid": "ea8b5b3e-7119-43a9-addf-3ad34847a982", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616003808, "uuid": "ba30f90f-06cd-4ba8-b793-815a05d31ed9", "value": "a49703f762f53da40fa4def283f4b5af6c2fdfe8673c51ce91c161f4c9ee98f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac9593f-8726-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615988517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615988517, "uuid": "029fc256-e2a5-4737-b96c-62d73b256536", "comment": "Malware payload", "value": "dfd1a4ce7ac321b2b69464a13a107c05", "object_relation": "md5", "Tag": [ { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615988517, "uuid": "ee890063-abd8-42d8-b38d-f236209a2f08", "comment": "Malware payload", "value": "a4fc63c8806d53f3a0bf11418007ca7764e77655b4d1c3693bff6a8e1907eb77", "object_relation": "sha256", "Tag": [ { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615988517, "uuid": "3e454535-1aa8-4564-ab88-e6f89b371bfd", "comment": "Malware payload", "value": "4402e19ed47656bf9e5e2d1ae713cdb8b3f996e3", "object_relation": "sha1", "Tag": [ { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615988517, "uuid": "0db7a648-42be-47de-bbd0-0425102460d1", "comment": "Malware payload", "value": "ebe97d8118b6b5805d5235c75479d748a049f97a73d52c3ef036ba0c02d38ed161e9704f4fcbfbcbe0d22cf47c6fe608", "object_relation": "sha3-384", "Tag": [ { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615988517, "uuid": "2c8de796-5695-4170-810b-d823ba1f0292", "value": "5754CF65AD44DF9ED1E438F023ACC86655D16E54637C74C63BF6CC2BC2ACC42648BA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615988517, "uuid": "bde9b474-97d3-4e6e-883f-2ff44991e1b8", "value": "029e584f86f8b09e2a390d528826a5a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615988517, "uuid": "c53cdd12-0f49-4c20-b6e4-b81478959929", "value": "6144:U1ID842v93kLMhjjBhNqU9XK4bzyiK+FD+9J+GAXUZ:mID9/LM1EYy/+A9aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615988517, "uuid": "59a3c14a-aa1d-46c9-a2b2-3bbebf1fc9da", "value": 299008, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615988517, "uuid": "bc746eb8-0e8e-4ab8-945a-b4aaf14ebd83", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615988517, "uuid": "4aa54e4b-221d-4b4b-b33b-f55b5ade2671", "value": "a4fc63c8806d53f3a0bf11418007ca7764e77655b4d1c3693bff6a8e1907eb77.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4169c92-8769-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616017416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017416, "uuid": "f756dfeb-7074-4849-a763-a5aff5f2ec79", "comment": "Malware payload", "value": "d17ac0da81d0c3fa3dcddc7ecd2b2e45", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017416, "uuid": "01a4d909-5881-46cf-9eb5-3821efc6841c", "comment": "Malware payload", "value": "a53db2148065772e7b75c5bd9fab7bdf427ddf93d8fa72809bc490d485a45956", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017416, "uuid": "38cce8d3-e2ab-447b-a4c0-064823c0ad64", "comment": "Malware payload", "value": "315f7e3aa1b402f1c1fdbd31dd05b6aae9d03452", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616017416, "uuid": "25b82e85-7edf-4ced-944d-a2100f38f863", "comment": "Malware payload", "value": "dcbca7bab7de967eab2993ee3d3ac82867fcec37365bbb9d3b7cb1b77e8d2a87e81ece4ef90bc30396092713233f4544", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017416, "uuid": "84abf4d6-8bed-4134-9767-b4bd046713ee", "value": "8D24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017416, "uuid": "3ac01f2a-454e-411d-8a76-6fb2b3fc0f30", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017416, "uuid": "758abece-6055-481d-8d68-4e5282e6dc15", "value": "3072:V9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:V9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616017416, "uuid": "e09901d9-a303-482c-875a-384c89f65925", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616017416, "uuid": "49b71068-3423-425b-9803-4475ac38f1f9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616017416, "uuid": "61cbcc91-caa3-45fe-82ed-f72a48b3685f", "value": "a53db2148065772e7b75c5bd9fab7bdf427ddf93d8fa72809bc490d485a45956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4acd93-8703-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1615973462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973462, "uuid": "5bf0f18b-e5e2-47d8-a1d1-4c1151c2fe45", "comment": "Malware payload (AgentTesla)", "value": "ca4cb3854899f8ad0579757e9594af89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973462, "uuid": "bbaac963-5027-4bb5-acdd-98ef66a9ba65", "comment": "Malware payload (AgentTesla)", "value": "a554b6694b6441582dc4cb3ba9299627f1915e0fc790bcdb430b2088fde93cd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973462, "uuid": "fbf873c6-e37a-4953-bdf9-6a25ff25441b", "comment": "Malware payload (AgentTesla)", "value": "df9bee425400ae84f7a4a783934ffee3b8708bac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615973462, "uuid": "37d96eaf-8410-48d3-865f-8d4513baade7", "comment": "Malware payload (AgentTesla)", "value": "c2d301a7fe3eb38b7b61baa0561e7816791f633131ea329b2d456fd70e1d5e9a6ac889664eb2cc6fe05a5d1f61af02ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973462, "uuid": "5a5593fb-c8e5-4d48-9193-c0ea1a23f638", "value": "F1F4F16037B85F01E9B9B7F6116754881B7A7A2FE2B1C31CECC660DD1A34F918652B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973462, "uuid": "48f8c6c2-9050-4ca0-bf3a-18da04eaec2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973462, "uuid": "7b1151a1-f07d-456d-8f00-5f9100b97ca6", "value": "12288:aN4r582cllc7O0XbxylgKdZurme9A7fFXtUME1c+K+P0cHfyuFx0fBNYyInJpETH:cc7xU+1COth2cHKun0uJiTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615973462, "uuid": "559893fb-1778-4341-83d5-6e5eac573843", "value": 767488, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615973462, "uuid": "de106403-0aef-4364-8387-b0ed84a5bf39", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615973462, "uuid": "b4bed277-ca2f-4410-86ac-6abc1cdc56ba", "value": "SecuriteInfo.com.Trojan.PackedNET.582.18887.25186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72230841-86fa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615969577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969577, "uuid": "a6663c7d-57ca-4328-b61e-9d54d509d64c", "comment": "Malware payload", "value": "2cb850c516fb509f5939f598cc01aeca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969577, "uuid": "9c693fce-6b83-4c5f-aa78-aec500ed75ad", "comment": "Malware payload", "value": "a5734afa91a34a6c9e6ac72d2edcd9e2ebbd5236177e986e88cb6f3180dc2e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969577, "uuid": "dea46bb5-14ba-4c30-8350-f5dd51554fc9", "comment": "Malware payload", "value": "cf42efa640fdb43fb952e3d84a15ccf4726fa13f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615969577, "uuid": "789089f3-1887-470f-a4f4-a9758bd3f9d9", "comment": "Malware payload", "value": "7d4023a62ca586111db6b1c114230e67ddb863b15c83ac3c5641543a5609c57c24818f6058c78813759b38135522af19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969577, "uuid": "3b3c2609-b59a-4e98-8fb5-4a8b677d9dcf", "value": "FC02B434F7EF5932EDBB4A729CA352807375B2A71636CF2F38C4918A5D625400E62B34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969577, "uuid": "dab7b6d9-c569-4dd5-a78f-56c52ae1bcd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969577, "uuid": "86211a59-d38f-405f-bcc3-c4d5b24545c1", "value": "192:cQbpsJyhngtt6yveMJOTbiUm8YqEp1ZI1iPBKcM1:cuxgtt6yveHTuF8NY1ZI1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615969577, "uuid": "ce69abf9-d408-4fec-bbed-4c4b2070c1b2", "value": 8704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615969577, "uuid": "f866bca3-e8fe-4c86-bd96-04414d93b5d9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615969577, "uuid": "a26a4922-097f-4598-acc5-08a15ae7bd55", "value": "2cb850c516fb509f5939f598cc01aeca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9d8188-8739-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1615996761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1615996761, "uuid": "a71b6062-cfcb-4f77-99c0-345291948038", "comment": "Malware payload", "value": "f64090ee549f6bbf89ae996b2d93fa3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1615996761, "uuid": "c9d89e7d-25d2-4786-a368-b7e59840b0db", "comment": "Malware payload", "value": "a5afd57e83f4692c49a877f4dacbba60ee4cf4ce5dc56eee743610e8d6d5cb11", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1615996761, "uuid": "c913f76d-af60-4939-989e-8fa22251b7d2", "comment": "Malware payload", "value": "de21d5655b7a625189a73aca86aeab599385b4ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1615996761, "uuid": "656471dc-a72a-4d42-8460-6cfa8e93d753", "comment": "Malware payload", "value": "d9d6966382d09c79d22bef04938b6b20321af40db47343ce1ff7996b62c0b22947b39337438651456f6395b179217c73", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1615996761, "uuid": "27a9a48b-e12a-4b6d-99fb-68c3e5563a1e", "value": "E0B423BA38F506D15D45DB92F130E1BCF5E4B1588626CFF038288AB1BAD8E5122167CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1615996761, "uuid": "6626d71b-4dc1-429b-ac16-851143293ffb", "value": "12288:8TCU9KFzKyG1er/2/G2uMckclzV5aC03KFL3GtZ:8GU9Cs4D2bXcRD5aXgr2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1615996761, "uuid": "7da15ea4-6763-410b-aec3-f50167c72b80", "value": 522685, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1615996761, "uuid": "20f14c9f-1e40-4398-950e-dbcdd9ff8709", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1615996761, "uuid": "a076bc4f-6bb0-430f-af03-836fec94ec74", "value": "PEDIDO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5981c62b-874e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616005614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005614, "uuid": "b9fab6a4-640f-478f-9c53-9b606a80a207", "comment": "Malware payload (Dridex)", "value": "b8ef0bae68b68d6c2aa973f5217611b9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005614, "uuid": "208e96d4-7762-40da-ae03-b7e65c940e59", "comment": "Malware payload (Dridex)", "value": "a5f0d07811be34c8665b22a220a23a91ad510d831c694e67dfa05fbdc50e5c04", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005614, "uuid": "4a7230d5-91f2-4a81-9036-a10fe4b8e91d", "comment": "Malware payload (Dridex)", "value": "05f79bddcee3daefc64fcd0d1383553a0cff8cd9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616005614, "uuid": "d2520093-ba57-4e34-a524-104b890c31db", "comment": "Malware payload (Dridex)", "value": "b1d18f1940dbf3f4c54c2ecc8a47aa1f27adca8ffbe2e764edb4af8e2bb7986576783d0a0ae5d28cc54f36b3a989387c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005614, "uuid": "801b1a31-b79b-4544-bd97-fa393347a6a0", "value": "9E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005614, "uuid": "f00ab628-67d4-407a-9a49-9908909adabe", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005614, "uuid": "8d3673fc-e8b9-4696-8fc3-564357ac5bfb", "value": "3072:U9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:U9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616005614, "uuid": "15e3789d-39b6-4356-bacb-ee648bdf74a1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616005614, "uuid": "7ad40dd6-6a40-45fb-84d0-1f9db609886e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616005614, "uuid": "f66a2528-73ee-4021-bbb1-f54d6eaaf3fc", "value": "a5f0d07811be34c8665b22a220a23a91ad510d831c694e67dfa05fbdc50e5c04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63891024-8745-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616001765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001765, "uuid": "6ed385c3-bd57-4c96-96d1-0d010069d4bc", "comment": "Malware payload (Dridex)", "value": "431b02bac89da78d3a815c616fed5071", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001765, "uuid": "ca0268e6-6f09-4ea3-808c-b7f8aeb77a7d", "comment": "Malware payload (Dridex)", "value": "a67cea9f624bb43f4b86d91a86ceac964c94d564bad5cd4db24e80c9664097f6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001765, "uuid": "db5bd324-a9ec-4b4b-9631-d9fc6197e0dd", "comment": "Malware payload (Dridex)", "value": "b0c6bfd4b48aef313e4c769c832f70f0a3407839", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616001765, "uuid": "f9d4d945-dec9-4dcb-b952-10f185c75ab8", "comment": "Malware payload (Dridex)", "value": "b389f9e701232f0705cbd70201f337cbb1cb73dddf2c751ce60d93766c66969bc39290c6c4805d6db7e545e81de795d3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001765, "uuid": "ff17137f-0f4e-471d-b8cb-836193455acf", "value": "2C24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001765, "uuid": "64374a8b-68d4-4bb3-98e9-6bb0ce6e466c", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001765, "uuid": "bf977f78-68f2-4763-950b-741d9a1f62e7", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616001765, "uuid": "f8d49f3c-4bed-40b8-996e-a3997093e596", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616001765, "uuid": "fa1eaff1-7080-4cf6-a532-cb1975e01b9a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616001765, "uuid": "ffc7b825-a246-4d7e-8ac0-849325339589", "value": "a67cea9f624bb43f4b86d91a86ceac964c94d564bad5cd4db24e80c9664097f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603e58f0-875f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616012927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012927, "uuid": "125715ee-9ffd-47e0-a009-b790072f3030", "comment": "Malware payload (Dridex)", "value": "1591360de18b8b66e8a5e1a2ed53d0f4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012927, "uuid": "c1553fed-7190-4d7f-b7b9-3088427839b2", "comment": "Malware payload (Dridex)", "value": "a6c834920a58131c0800fe96aeb109aef8fc19d4c1e67572e3c3ec5ea93f9940", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012927, "uuid": "6e5b5b86-7b2f-4ff5-b84a-6c78050f3071", "comment": "Malware payload (Dridex)", "value": "b853e0454e6d7341a8fd652531ccc16b6666301c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616012927, "uuid": "1c37f3cb-c8b4-4e98-b5fe-12755480b5f6", "comment": "Malware payload (Dridex)", "value": "605c7e100919bfe5eee646902fa54c023ce718c09685cdd8d9a3535803e660c202a60c5e11c340bf49ddf5012